WHOIS Lookup

WHOIS is the long-standing system for looking up the registration record of an internet resource — a domain name or an IP address. For a domain, the record typically shows which registrar the domain was bought through, when it was first registered, when it expires and when it was last changed, the domain status codes that control whether it can be transferred or deleted, and the nameservers that answer DNS for it. Historically it also listed the registrant’s name, address, email and phone, but since GDPR and ICANN’s Temporary Specification (2018) those personal contact fields are almost always redacted or replaced with a privacy-proxy address for most generic TLDs. So today a public WHOIS tells you the registrar, the timeline and the technical configuration far more reliably than it tells you a human name.

RDAP (Registration Data Access Protocol) is the modern replacement for the legacy WHOIS protocol. Classic WHOIS runs over port 43 and returns unstructured free text whose format differs from registry to registry, which makes it hard to parse reliably. RDAP returns structured JSON over HTTPS with a consistent schema, supports standardised redaction, internationalised data and secure access, and is bootstrapped through IANA so a client can be redirected to the correct authoritative registry for any TLD or IP block. ICANN has required gTLD registries and registrars to offer RDAP since 2019, and it is steadily becoming the official way to query registration data. This tool queries RDAP and presents the fields in plain language; it does not use port-43 WHOIS at all.

This is a best-effort, 100% client-side tool: your browser talks to the public RDAP registry directly. Browsers enforce the same-origin policy, so a cross-origin request only succeeds when the registry’s RDAP server returns a permissive CORS header (Access-Control-Allow-Origin). The IANA bootstrap (rdap.org) and the registries behind many common TLDs — .com, .net, .org and others — do send that header, so those lookups work. Some ccTLDs and smaller registries do not, and their lookups will fail in the browser with a network error even though the domain is perfectly valid. We treat that as expected and tell you honestly rather than routing the request through a server to work around it — keeping the request client-only means nothing you look up ever touches our infrastructure.

Partly. The registrant’s personal name and address are usually hidden behind privacy protection for GDPR-covered domains, so you often cannot get an individual’s identity from WHOIS/RDAP alone. What you can almost always see is the registrar, the registration and expiry dates, the status codes and the nameservers — and that is frequently enough for the practical question. A brand-new registration on a throwaway registrar with privacy protection, pointed at an unusual host, is a very different signal from a ten-year-old domain on a mainstream registrar. Where an actual legal owner must be identified (abuse, law-enforcement or dispute cases), registrars disclose the underlying data through formal request channels, not the public record.

Registration metadata is a fast, cheap triage signal. Domain age is one of the strongest: phishing and malware domains are overwhelmingly young — often registered days or hours before a campaign — so a creation date in the last week on a link you were sent is a red flag worth escalating. The registrar and nameservers can cluster related malicious infrastructure, the expiry date tells you whether a domain is about to lapse (and could be re-registered by someone else), and status codes such as clientHold indicate a domain a registrar has already suspended. For IP lookups, the owning organisation and country of an address help you judge whether traffic to or from it is expected. None of this is proof on its own, but it is the first thing most analysts check when assessing an unfamiliar domain or address.