WHOIS

What WHOIS is

WHOIS is one of the oldest services on the internet: a way to ask a registry "who is responsible for this?" The answer is a registration record. For an IP block it names the organization that holds the range, its size, the country it was registered in, and an abuse contact. For an autonomous system it names the network operator. For a domain it names the registrar, the creation and expiry dates, the name servers, and status codes such as clientTransferProhibited.

The word refers to two things at once: the records themselves, and the original text protocol on TCP port 43 used to fetch them. The protocol has no structure, no authentication, and a different output format at every registry, which is why it is being replaced by RDAP. The records are the same either way.

Why it matters

WHOIS is the ground truth under every IP classification. A geolocation database can guess a city; the registry record states which organization was allocated the block and for what purpose. If a range is registered to a hosting company, no amount of browser tuning makes it residential. Domain WHOIS matters for a different audience: checking whether a domain is registered, when it expires, which registrar holds it, and whether DNSSEC is enabled.

Personal data in domain records has been largely redacted since 2018. Expect to see the registrar and an abuse contact rather than an individual's name and address.

How to check

The WHOIS tool accepts an IP address, a CIDR block, an ASN (with or without the AS prefix), or a domain. We query the responsible registry over RDAP, normalize the result into named fields, and cache it for 24 hours; the raw record link is included so you can see the registry's own response. ASN lookup shows the registry record for a network alongside its announced prefixes, and DNS lookup complements a domain WHOIS by showing what the name servers actually publish.

Reading an IP record

• handle and name: the registry's identifier and the holder's label for the block.
• start, end, and cidr: the exact range.
• type: typically ALLOCATED or ASSIGNED, sometimes LEGACY.
• entities: organizations and contacts with their roles (registrant, abuse, technical).
• events: registration and last-changed dates.

A common misconception

WHOIS does not show who is using an address right now. It shows who was allocated the block, which may be a provider that sub-leases it to many customers.