WHOIS Lookup

How WHOIS works

WHOIS is a TCP-based query and response protocol defined in RFC 3912, originally developed in the 1980s to track network resource assignments. When you query a domain name, the WHOIS system determines the appropriate registry based on the TLD (top-level domain). Each TLD, such as .com, .org, or .io, has a designated registry operator that maintains the authoritative WHOIS database for all domains within that TLD. The registrar through which the domain was registered submits the domain's registration details to the registry, making them available via WHOIS queries.

For IP address lookups, WHOIS queries are routed to the appropriate Regional Internet Registry (RIR). The world is divided into five RIRs: ARIN (North America), RIPE NCC (Europe, Middle East, parts of Central Asia), APNIC (Asia Pacific), LACNIC (Latin America and Caribbean), and AFRINIC (Africa). Each RIR maintains WHOIS data for the IP address ranges it allocates. The query returns information about the IP block owner, the organisation to which the IP is assigned, and contact details for network abuse reporting.

The data returned by a WHOIS query has evolved significantly over time. Historically, WHOIS included full personal contact information for the domain owner, including name, address, phone number, and email. With the introduction of GDPR in Europe and similar privacy regulations in other jurisdictions, most registrars now offer WHOIS privacy services that redact or anonymise personal data. The ICANN Registration Data Access Protocol (RDAP) is gradually replacing WHOIS as the standard protocol, offering structured JSON responses, standardised error handling, and differentiated access for various levels of data sensitivity.

When to use WHOIS lookups

WHOIS lookups serve several practical purposes across different fields. Security professionals use WHOIS to investigate suspicious domains during threat hunts, checking when a domain was registered, who registered it, and whether those details match known threat actor patterns. Domain investors use WHOIS to research domain registration dates, expiry dates, and registrar information when evaluating potential acquisitions. Website owners check their own WHOIS records to ensure contact details are current and to confirm nameserver delegation before DNS changes propagate.

For intellectual property protection, trademark holders monitor WHOIS records for domains that infringe on their trademarks. Abuse teams use WHOIS contact information to report phishing, malware, and spam domains to the appropriate registrar. Network engineers use IP WHOIS lookups to identify the owner of IP ranges for troubleshooting network issues, planning BGP peering, and reporting network abuse.

Limitations and privacy considerations

The accuracy and completeness of WHOIS data have declined in recent years due to privacy regulations. With GDPR, the California Consumer Privacy Act (CCPA), and similar laws, many registrars now redact personal contact information by default. This means you may see "REDACTED FOR PRIVACY" or similar placeholders instead of actual names and addresses. ICANN's Temp Specification and the subsequent Registration Data Policy formalised this shift, allowing registrars to provide tiered access to registration data.

Some domains use proxy registration services that list the proxy company's information instead of the real registrant. While this protects privacy, it can make it harder to contact domain owners for legitimate purposes. Additionally, domain front-running and WHOIS privacy concerns have led to the development of RDAP, which offers authenticated access to privacy-protected data for verified requesters.

Frequently asked questions