WHOIS lookup

whois <domain>

Query the WHOIS database to obtain domain registration information and owners.

Passive reconnaissance phase to obtain contact data, NS servers, domain creation and expiration dates. In a red team engagement, contact information can be used to craft social engineering pretexts. Additionally, upcoming expiration dates indicate possible neglect in domain management.

If the domain has private WHOIS (proxy), the information is not useful. Also avoid bulk queries because WHOIS servers block due to rate-limiting.