WHOIS lookup

How this tool works

Enter a domain name, an IPv4 or IPv6 address, or an AS number. The tool works out which kind of object you typed and asks the registry that holds its record. No account is needed and the lookup is free.

The query uses RDAP, the Registration Data Access Protocol. It is the protocol the registries adopted to replace the old port-43 WHOIS service, and it returns the same registration data as structured JSON over HTTPS. For you that means every field is labeled and consistent whether the record comes from a domain registry in one country or a regional internet registry in another, and the tool can present dates, statuses and contacts in one layout instead of showing you a wall of text in a different format for every registry.

Finding the right registry is the first step. IANA publishes bootstrap files that map every top-level domain, every IPv4 and IPv6 block and every AS number range to the RDAP server responsible for it. The tool downloads those files, caches them for 7 days, and matches your query against them: the TLD for a domain, the containing prefix for an IP address, the containing range for an AS number. It then calls the registry's RDAP endpoint directly, so there is no third-party data layer in between. More on the protocol is in the RDAP entry.

Results are cached for 24 hours. If a registry is temporarily unreachable and a cached copy exists, the tool shows the cached copy rather than an error.

Domains

For a domain the registry record contains the domain's status codes, the delegated name servers, whether the delegation is signed with DNSSEC, the registration, expiration and last-changed dates, the sponsoring registrar, and the contact entities that the registry chooses to publish. For large generic TLDs the registry holds only a thin record, and the registrar's own RDAP service is where the fuller record lives; the tool lists the registrar and includes the link to that service when the registry provides one.

If the bootstrap file lists no RDAP server for the top-level domain, the tool says so. If the registry answers that the domain does not exist, the tool reports it as not found, which usually means the name is unregistered.

IP addresses

For an address the regional internet registry (RIR) returns the block that contains it: its handle, network name, type, start and end address, the CIDR notation, the country recorded for it, the parent block it was carved from, its status, the organization and contact entities, the dates it was registered and last changed, and any remarks the holder added. The tool shows the smallest block the registry knows about, which for addresses that were sub-assigned to customers is often the customer's assignment rather than the ISP's whole allocation.

AS numbers

For an autonomous system the RIR returns the holder's name, the number or range, the country, status, the responsible entities and the dates. This is the registration view of the network; for what the network actually announces, use the ASN lookup, which works from routing data.

How to read the result

Status codes

Statuses are the most misread part of a WHOIS record. The common ones:

Dates

Registration is when the domain or block was first created. Expiration applies to domains and is the date the current term ends; a domain is not immediately available after it, since renewal grace and redemption periods follow. Last changed updates whenever the registrar or holder modifies the record, including routine renewals, so it is a weak signal of activity. Some registries also report when their own RDAP database was last refreshed.

A domain registered weeks ago that is sending you invoices or asking you to log in is the classic warning sign. Registration age is one of the few WHOIS facts that cannot be faked.

Entities and contacts

Entities carry roles: registrar, registrant, administrative, technical, abuse and sometimes billing. Under current privacy rules the registrant is usually shown as a redacted placeholder or as a privacy service, while the registrar and abuse entities remain visible because they are organizations, not people. For IP blocks the organization name is almost always published, since blocks are held by companies.

Name servers and DNSSEC

The name servers in the record are the delegation the registry publishes to the parent zone. They decide which servers answer for the domain, regardless of what any zone file elsewhere says. If they are not the servers you expect, DNS changes made at the wrong provider will never take effect; check them against the NS records from the DNS lookup. The DNSSEC flag tells you whether the registry holds a signed delegation for the domain.

Registry link

Each result shows the registry's own WHOIS host and links to the source record so you can read the raw JSON or follow up with the registrar's RDAP service for the fuller domain record.

What to do next

You need to report abuse from an IP address

1. Look up the address. The abuse entity in the result is the contact the block holder has published for exactly this purpose.
2. If the smallest block shown is a customer assignment with no abuse contact of its own, look up the parent block handle; the provider's contact applies.
3. Include the address, exact timestamps with time zone and log excerpts in the report. Providers can only act on evidence that identifies a specific customer at a specific time.
4. For spam, also check the blacklist status and report to the lists that accept submissions.

You want to know who is behind a domain

1. Read the registrar and registration date first. Both are reliable.
2. If the registrant is redacted, the registrar's RDAP record linked from the result sometimes shows more, including a contact form or an anonymized forwarding address.
3. Check the name servers and MX records; the hosting and mail providers often say more about the operation than the redacted contact.
4. Look up the domain's IP address to see its network and hosting provider.

Your own domain is about to expire or is locked

1. Compare the expiration date with your registrar account. Auto-renewal failures usually come from an expired payment card.
2. A transfer lock is removed in the registrar's control panel; many registrars also require you to disable it and obtain an authorization code before a transfer can start.
3. If the status shows a server hold, contact the registrar: the registry has suspended the domain, typically for an unverified contact email or a complaint, and only the registrar can resolve it with the registry.

You are checking whether a name is free to register

1. A not-found answer from the registry means no current registration. Reserved or premium names can still be unavailable, and some registries hold recently deleted names for a period.
2. If the domain exists but is in pending delete, note the date and watch for it to drop.
3. Register through any accredited registrar; the registry record does not favor one.

WHOIS for IP addresses versus IP geolocation

A WHOIS record and a geolocation lookup answer different questions. The registry says which organization holds the block and which country it registered the block in. Geolocation databases estimate where an address is actually in use, which can be a different country for a multinational provider or a block that was moved. When the two disagree, the registry is the authoritative source for ownership and the geolocation database is usually the better guess for location. The IP lookup shows both views side by side.

The registration record also does not say what kind of connection an address is. For that, the holder's name and the ASN classification are better signals: a block held by a hosting company is a datacenter IP no matter what country it is registered in.

Which registry answers: domains, IP blocks and AS numbers

Registration data is split across many registries, and part of what RDAP bootstrap does is pick the right one. Domain data lives with the registry of each top-level domain: one organization runs .com, another runs .de, and so on, each with its own RDAP service. IP addresses and AS numbers are managed by the 5 regional internet registries, which divide the world by region: ARIN for North America, RIPE NCC for Europe, the Middle East and Central Asia, APNIC for the Asia-Pacific region, LACNIC for Latin America and the Caribbean, and AFRINIC for Africa. A block allocated in one region is answered by that region's registry wherever the addresses are actually used.

Below the regional registries sit the providers, which register sub-assignments for their customers, and in some regions national registries in between. The record you see for an address is the most specific one the regional registry holds, which is why a lookup sometimes returns a customer's small assignment and sometimes a provider's entire allocation.

For domains there is a second split between registry and registrar. The registry operates the top-level domain and knows the status, the name servers and the sponsoring registrar. The registrar is the company the domain was bought from and holds the customer relationship and the contact details. Thin registries publish only their own part; thick registries carry the registrar's contact data as well, redacted where privacy rules apply.

How old is a domain, and why it matters

The registration date is one of the most useful facts in a WHOIS record because nobody can change it. Phishing domains, fake shops and disposable sender domains are overwhelmingly new, often registered days before they are used, while a business that has operated for years has a domain to match. A lookup takes seconds, so checking the age of a domain before entering payment details, replying to an unexpected invoice or trusting a login link is a habit worth having. Combine it with the registrar, the name servers and the hosting network from the IP lookup for a reasonable judgment in under a minute.

The expiration date is useful in the other direction. A domain that has been renewed years ahead signals an owner who intends to keep it; one that expires next month and has no name servers may be abandoned.

Limits of this tool

• Some top-level domains, mostly country codes, have no RDAP service. For those the tool reports that no server is published and cannot show registry data.
• Contact details are redacted by most registries and registrars. The tool shows what the registry publishes and cannot recover withheld names, emails or phone numbers.
• For thin registries the registry record omits contacts entirely; the fuller record lives at the registrar, which the tool links to but does not query.
• Results are cached for 24 hours. Very recent changes may not appear until the cache expires.
• Registries rate-limit RDAP clients. Under heavy use a lookup may fail; when a cached copy exists it is shown instead.
• The tool shows up to 12 entities and 20 remark lines per record. Unusually large records are truncated.
• A registry record describes ownership and administration, not current use. It cannot tell you who is using an address today, whether it is a proxy, or where the user is sitting.
• Historical records are not available. The tool shows the current record only, not previous owners or earlier name servers.