What is WHOIS and how to read it.

Every domain name and every block of IP addresses on the internet is registered to somebody, and the record of who registered it – when, through which company, and until when – is public infrastructure. WHOIS is the decades-old protocol and query system that lets you read those records. Type a domain into a WHOIS lookup and, in the best case, you get back the registrant, the company they registered through, the creation and expiry dates, the name servers the domain points at, and a set of status codes describing the domain's administrative state. For anyone doing open-source intelligence, incident response, or plain domain due diligence, WHOIS is usually the first stop.

The catch – and it is a big one in 2026 – is that "the best case" is now the exception for most domains. Since GDPR landed in 2018, the majority of contact details in domain WHOIS come back redacted, and the underlying protocol is being replaced by a modern successor called RDAP. This article walks through what WHOIS returns, how to read a real record line by line, how domain WHOIS differs from IP WHOIS, what the redaction era changed, and which tools actually help when you are staring at a suspicious domain.

What WHOIS is, and what it is for

WHOIS started life in the 1980s as a simple directory of people responsible for network resources. Today it is a query/response service (the classic protocol runs on TCP port 43) layered over the databases held by two kinds of organizations: domain registries and registrars for domain names, and the Regional Internet Registries (RIRs) for IP addresses and autonomous system numbers. You send a query – a domain or an IP – and the server returns a text record.

People reach for WHOIS to answer a handful of practical questions. Who owns this domain, and how do I contact them? How old is it – was it registered yesterday or a decade ago? Is it about to expire? Which registrar and name servers is it using, and does that match the brand it claims to be? For a security analyst chasing a phishing link, those answers are the difference between "this is a legitimate corporate site" and "this domain was created 36 hours ago through a bulletproof registrar and hides behind a privacy proxy." For a network defender, IP WHOIS tells you which provider owns the address that just hammered your firewall, and where to send an abuse report.

What information a WHOIS record returns

A domain WHOIS record is a flat list of key-value fields. The exact set varies by top-level domain and registrar, but the important categories are consistent:

• Registrant, admin and technical contacts: the person or organization that holds the domain, plus administrative and technical points of contact. Historically this included names, postal addresses, emails and phone numbers. Post-GDPR, this is where most of the redaction happens.
• Registrar: the accredited company through which the domain was registered (GoDaddy, Namecheap, Cloudflare, OVH, and so on), usually with an IANA registrar ID and an abuse contact.
• Registry: the operator of the TLD itself (Verisign runs .com, for example). WHOIS distinguishes the registry from the registrar; if that distinction is fuzzy, our registry vs registrar vs ISP vs hosting guide untangles it.
• Dates: creation date, updated date, and expiry (registry expiry) date. These are among the most useful fields for an investigator and are almost never redacted.
• Name servers: the authoritative DNS servers the domain delegates to. These reveal the DNS or hosting provider and can cluster related domains together.
• Status codes (EPP): machine-readable states such as clientTransferProhibited that describe locks and pending operations on the domain.
• DNSSEC: whether the domain is signed.

Reading a real record, field by field

The clearest way to learn WHOIS is to read one. Here is a lightly trimmed lookup of example.com: a genuinely special domain reserved by IANA, which is why its contacts are visible rather than redacted:

$ whois example.com

Domain Name: EXAMPLE.COM
Registry Domain ID: 2336799_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.iana.org
Registrar URL: http://res-dom.iana.org
Updated Date: 2024-08-14T07:01:34Z          # last change to the record
Creation Date: 1995-08-14T04:00:00Z          # first registered in 1995
Registry Expiry Date: 2025-08-13T04:00:00Z   # when it must be renewed
Registrar: RESERVED-Internet Assigned Numbers Authority
Registrar IANA ID: 376
Domain Status: clientDeleteProhibited   https://icann.org/epp#clientDeleteProhibited
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: clientUpdateProhibited   https://icann.org/epp#clientUpdateProhibited
Name Server: A.IANA-SERVERS.NET
Name Server: B.IANA-SERVERS.NET
DNSSEC: signedDelegation
>>> Last update of whois database: 2026-01-05T17:22:41Z <<<

Read top to bottom, this tells a story. The domain has existed since 1995 (an immediate credibility signal – attackers rarely have decade-old domains), was last modified in 2024, and renews annually. It sits at the registrar reserved for IANA. Three Prohibited status codes lock it against deletion, transfer and update. It uses two IANA name servers and is DNSSEC-signed. Nothing here is redacted because this is a reserved demonstration domain.

A normal commercial domain registered after 2018 looks different in exactly one respect: the contact block. Instead of a name and address you will typically see boilerplate like this:

Registrant Name: REDACTED FOR PRIVACY
Registrant Organization: Privacy service provided by Withheld for Privacy ehf
Registrant Email: https://withheldforprivacy.com/contact/?domain=example.org
Registrant Country: IS

The registrar has stripped the personal data and left you either a proxy contact form or a relay email. The Country field often survives even when the name does not, which is still a useful data point.

Field reference for investigators

What the EPP status codes actually mean

Those Prohibited lines are EPP status codes (Extensible Provisioning Protocol), the standard vocabulary registries use to describe a domain's state. They split into two families. Client codes are set by the registrar at the owner's request; server codes are set by the registry itself. The one you will see most is clientTransferProhibited, which means the registrar has locked the domain so it cannot be transferred to another registrar without first unlocking it: a routine, healthy anti-hijacking measure, not a red flag. Its siblings are just as literal: clientDeleteProhibited and clientUpdateProhibited block deletion and changes. On the registry side, serverHold means the domain has been pulled from the DNS (often after an abuse complaint), and pendingDelete means it is in the grace window before becoming available again. When you see none of these, the domain is in the default ok (or active) state – which, paradoxically, means it is unlocked and easier to move.

Why so much is redacted now: GDPR and the rise of RDAP

Before 2018, domain WHOIS was a genuine directory: query almost any .com and you got the registrant's real name, email, and address. The EU's GDPR made publishing that personal data by default a legal liability, and ICANN responded with a "Temporary Specification" that told registrars to redact registrant contact details for essentially everyone. The result is the redacted blocks you see today. The data still exists – registrars hold it, and law enforcement or trademark holders can request it through formal channels – but it is no longer sprayed into every anonymous query.

Alongside redaction came a technical replacement. Port-43 WHOIS is unstructured free text with no standard format, no authentication, and no way to serve different data to different requesters. Its successor, RDAP (Registration Data Access Protocol), fixes those problems: it is a RESTful service that returns structured, predictable JSON over HTTPS, supports internationalized data cleanly, and provides a framework for differentiated access so that an authenticated requester could, in principle, receive more than an anonymous one. Registries and registrars for generic TLDs are now required to run RDAP, and it is the direction of travel for everything. The easiest front door is rdap.org, which redirects your query to the correct authoritative RDAP server. A lookup is as simple as an HTTPS request:

$ curl -s https://rdap.org/domain/example.com | jq .

{
  "objectClassName": "domain",
  "ldhName": "EXAMPLE.COM",
  "status": ["client transfer prohibited", "client delete prohibited"],
  "events": [
    { "eventAction": "registration", "eventDate": "1995-08-14T04:00:00Z" },
    { "eventAction": "expiration",   "eventDate": "2025-08-13T04:00:00Z" }
  ],
  "nameservers": [ { "ldhName": "A.IANA-SERVERS.NET" } ]
}

Same information, but now it is machine-parseable, which is why every serious tooling pipeline is moving from scraping WHOIS text to consuming RDAP JSON. For a human, WHOIS is still fine; for automation, RDAP wins.

Domain WHOIS versus IP WHOIS

WHOIS answers two related but separate questions depending on what you feed it. Give it a domain and you query the registry/registrar system described above. Give it an IP address and you query a completely different set of databases run by the five Regional Internet Registries (RIRs), each responsible for a part of the world:

• ARIN – North America
• RIPE NCC – Europe, the Middle East and Central Asia
• APNIC – Asia-Pacific
• LACNIC – Latin America and the Caribbean
• AFRINIC – Africa

An IP WHOIS record does not tell you who runs a website; it tells you which organization was allocated that address range, the network's name (netname), the CIDR block, the country, and – crucially – an abuse contact. This is the record you pull when an IP is attacking you and you want to know whether it belongs to AWS, a residential ISP, or a hosting provider in another jurisdiction, and where to file a complaint. IP WHOIS is far less affected by GDPR redaction because much of it describes organizations and network infrastructure rather than private individuals:

$ whois 93.184.216.34

NetRange:       93.184.216.0 - 93.184.216.255
CIDR:           93.184.216.0/24
NetName:        EDGECAST-NETBLK-03
Organization:   MCI Communications Services (later Verizon/Edgecast)
Country:        US
OrgAbuseEmail:  abuse@example-provider.net   # where to report abuse

Reading a suspicious domain

Put together, a WHOIS record gives you a fast triage read on a domain you do not trust. No single field is a verdict, but a few of them stacked together usually are. The signals worth internalizing:

• Age. Check the creation date first. A domain registered in the last few days or weeks that is already sending you a "your account is locked, click here" email is the single most reliable phishing tell. Legitimate brands do not run their login pages on 48-hour-old domains.
• Privacy proxy on a supposedly corporate domain. A privacy service is completely normal for a personal blog. It is out of place for something claiming to be a bank or a government portal, which would ordinarily show a real organization.
• Registrar reputation. A handful of registrars are disproportionately represented in abuse data because they are cheap, fast, and lax on verification. A brand-new domain at one of those, impersonating a well-known company, is a pattern.
• Mismatched name servers. If the domain claims to be a major enterprise but its name servers point at free dynamic-DNS infrastructure, the story does not hold together.
• Short registration window and imminent expiry. Attackers buy the minimum term. A one-year registration that is days from expiry, on a young domain, fits disposable infrastructure.

For a full, repeatable checklist that combines WHOIS with DNS, TLS certificate, and reputation checks, see how to check if a domain is suspicious. WHOIS is one input; it is strongest in combination.

Tools and websites

You can do everything by hand, but a small kit of tools covers almost every WHOIS task from quick lookups to historical pivots.

• The whois command: the command-line client shipped with Linux, macOS and BSD (and installable on Windows). Fastest for a raw, unfiltered record and for scripting. Just run whois domain.com or whois 8.8.8.8.
• who.is: a clean, free web lookup that also shows DNS records and basic diagnostics. Good for a quick browser check when you are not at a terminal.
• whois.domaintools.com – DomainTools' front end, a long-standing reference lookup with additional context on many domains.
• ICANN Lookup – the official registration data lookup run by ICANN itself, built on RDAP. The authoritative, no-marketing option when you want the canonical record.
• rdap.org: the RDAP redirector. Query it and it forwards you to the correct authoritative RDAP server, returning structured JSON. The modern, automation-friendly path.
• ViewDNS.info: a Swiss-army toolbox: WHOIS, reverse WHOIS, reverse IP (other domains on the same host), DNS history and more, all in one page. Excellent for pivoting.
• WhoisXML API – a commercial API for WHOIS, RDAP, DNS and reputation data at scale, when you need to enrich thousands of domains programmatically rather than one at a time.
• Whoisology – a WHOIS database built for cross-referencing: search by email, name or other fields to find every other domain sharing that data point, even historically.
• WhoisFreaks and DomainTools Whois History – historical WHOIS, which is often the real prize. GDPR redacts today's record, but archived snapshots from before 2018 (or before an owner switched on privacy) may still show the original registrant, letting you connect a redacted domain to a real identity.

That historical angle is worth dwelling on. Current WHOIS may be a wall of "REDACTED FOR PRIVACY," but a domain registered in 2015 almost certainly has archived records from before the redaction era. History services turn a dead-end lookup into a lead, which is exactly why they are staples of investigative and threat-intelligence work.

The bottom line

WHOIS is still one of the highest-value, lowest-effort checks in an investigator's kit – you just have to read it with 2026 eyes. Contact details are mostly gone, so lean on the fields that survive: creation and expiry dates, registrar, name servers, status codes, and country. Use RDAP when you want structure, IP WHOIS when you are chasing infrastructure, and historical WHOIS when the current record is redacted. Combined with DNS and certificate data, a thirty-second lookup will tell you more about a strange domain than almost anything else you can do from a keyboard.

Frequently asked questions