OSINT › Module 5 › Lesson 1
WHOIS and RDAP Literacy
Registration records are public-ish and often redacted
Visual · whois_rdap_literacy
whois + lookup.icann.org + RDAP. YOUR domain or example.com literacy.
Opening
WHOIS is a phone book with missing pages. RDAP is the same idea with JSON manners.
WHOIS and RDAP answer “who registered this name” at a registrar/registry — often redacted for privacy. ICANN Lookup (lookup.icann.org) and about.rdap.org explain the modern path. whois.icann.org is the old public doorway. You may whois example.com as a public example. You may whois a domain YOU own. You may not whois a classmate’s blog to dox them, and you may not treat a home router at 192.168.0.1 as a domain record. Original Cyberlium.
1. WHOIS vs RDAP: same question, different interface
WHOIS is a text protocol/CLI many OS still ship as whois. RDAP is HTTP JSON designed to replace much of that. Privacy laws mean you often see registrar name and dates, not a home address. That redaction is a feature, not a puzzle to bypass with shady “whois history” shops.
ICANN Lookup (https://lookup.icann.org/) is the official consumer UI. about.rdap.org explains RDAP. ; do not whois the router.
Command guide
WHOIS vs RDAP: same question, different interface
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install whois
macOS:
Command — copy this
brew install whois
Windows: Use https://lookup.icann.org or install via WSL
═══ LINUX / macOS ═══
Query WHOIS for domain registration info
Command — copy this
whois example.com whois example.com | grep -i 'registrar\|creation\|expir'
RDAP (modern replacement for WHOIS)
Command — copy this
curl -s https://rdap.org/domain/example.com | python3 -m json.tool | head -40
═══ WINDOWS ═══
Windows has no built-in whois — use browser: https://lookup.icann.org/ Or install via WSL: whois example.com
2. Your domain vs example.com vs other people’s names
If you own a domain, whois it and compare to ICANN Lookup in the browser. If privacy is on, you should see your registrar’s privacy service — good. If your real address is public and you did not want that, that is a registrar setting to fix.
ViewDNS (viewdns.info) is named as another public map. Use it only for example.com or YOUR domain. Not for a journalist’s personal name.
3. Redaction is not a challenge; shady history shops are out
If RDAP hides the registrant, you do not buy a “historical whois” dump to unmask a stranger. For YOUR domain, you already know who you are — you are checking what the public sees.
Next: live DNS records (A, NS, MX, TXT) for names you own, plus example.com literacy.
4. What you ship: whois/RDAP literacy on example.com or YOUR domain, official ICANN URLs
whois example.com and/or YOUR domain. Bookmark lookup.icann.org, about.rdap.org, whois.icann.org. ViewDNS named for owned/example only. DEMO GATE. Notes 600.
5. What you record before the next lesson
Date. whois example.com ran or ICANN Lookup. DOMAIN or skip. NEVER dox shops. File t12-m05-l01-whois-rdap.txt chmod 600.
6. Wrong vs right: strangers vs identifiers YOU own
Worked failure — same OSINT word, opposite target. Right never needs a classmate or a dump site.
Wrong
whois a classmate blog to find a home address. Buy historical WHOIS dumps. nmap the registrar.
Right
example.com + YOUR domain. Official ICANN/RDAP pages. Next: dig nslookup and DNS Records YOU Own.
Mission: read registration records without unmasking strangers
1) / STOP if router. 2) whois example.com or ICANN Lookup. 3) whois YOUR domain or skip. Never classmate domains as dox practice.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor why privacy redaction exists — not how to bypass it on a stranger.
Knowledge Check
APPLY: curl http://192.168.0.1/ is Huawei Router Admin in a WHOIS lesson. You:
Multiple choice
Knowledge Check
APPLY: True or False: RDAP privacy redaction should be bypassed with a paid unmask dump.
True or False
Knowledge Check
APPLY: Official consumer lookup named here?
Multiple choice