When you encounter a suspicious website, or if you are interested in purchasing a domain name that currently belongs to someone else, you need a way to look up the public ownership records for that domain. The internet relies on a distributed database protocol to store this registration data, and you can query this database directly from the Linux terminal using the whois command. whois reaches out to the official domain registrars and returns a wealth of administrative information about the target website.
Installing the whois Tool
The whois utility is not always installed by default on minimal Linux server distributions. If you run the command and get a “command not found” error, you must install it via your package manager.
On Ubuntu/Debian systems, run:
sudo apt update
sudo apt install whoisRunning a Basic Domain Lookup
To look up the registration details for a domain, simply type whois followed by the base domain name (without the https:// or the www. prefix).
whois example.comWhen you press Enter, the terminal will print a large block of text. The most critical information is usually found near the top of the output, including:
- Registrar: The company that currently manages the domain name (e.g., Namecheap, GoDaddy, Google Domains).
- Creation Date: The exact date and time the domain was originally registered. This is highly useful for spotting phishing sites, as malicious domains are typically only a few days old.
- Registry Expiry Date: The date the current registration runs out. If you want to buy the domain, this tells you when it might become available if the current owner forgets to renew it.
- Name Servers: The DNS servers responsible for routing traffic for the domain.
Understanding Privacy Protection
Historically, a whois lookup would return the actual name, personal address, phone number, and email address of the human being who registered the domain. However, due to modern privacy laws (like the GDPR) and the widespread use of domain privacy protection services offered by registrars, this personal information is almost always redacted or replaced with a proxy email address. You will rarely see the actual owner’s name on a modern whois lookup.
Looking Up IP Addresses
The whois command is not limited to domain names. If you notice a strange IP address connecting to your server in your system logs, you can run a whois lookup on that IP address to determine which ISP or cloud hosting provider owns it.
whois 192.0.2.1This will typically reveal the network block owner (such as Amazon Web Services, DigitalOcean, or a specific regional internet service provider), helping you identify the source of the traffic.