WHOIS records often contain important data such as the registrar name and contact information. System administrators have been using WHOIS for years now, and although there are many tools available to query this protocol, Nmap proves itself invaluable because of its ability to deal with IP ranges and hostname lists.
This recipe will show you how to retrieve the WHOIS records of an IP address or domain name by using Nmap.
Open a terminal and enter the following command:
$nmap --script whois <target>
The output will look similar to the following:
$nmap --script whois scanme.nmap.org Nmap scan report for scanme.nmap.org (74.207.244.221) Host is up (0.10s latency). Not shown: 995 closed ports PORT STATE SERVICE 22/tcp open ssh 25/tcp filtered smtp 80/tcp open http 646/tcp filtered ldp 9929/tcp open nping-echo Host script results: | whois: Record found at whois.arin.net | netrange: 74.207.224.0 - 74.207.255...