← Glossary

Network & Infrastructure

WHOIS (and RDAP)

Also: whois lookup · RDAP · domain registration lookup · registrar · registrant · domain age

Last reviewed:

In one sentence

WHOIS is the lookup that shows who registered a domain, when, through which registrar and on which nameservers — today served over RDAP, its structured JSON successor, with registrant contact details mostly redacted since the GDPR.

Why it matters

Registration date is one of the cheapest, highest-signal checks available during phishing triage: a domain registered three days ago that imitates your bank's login page is a much stronger signal than the same look-alike having existed for five years. Attackers register in bulk, cheaply, shortly before a campaign, and the lookup shows it. It also shows the registrar and the nameservers, which tie a domain to infrastructure you may have seen before, and the expiry — which matters for your own domains far more than people think (an expired corporate domain gets re-registered by someone else).

Since the GDPR, most registrars redact the registrant's personal contact details, and ICANN's policy followed; treat WHOIS as a registration-timeline and infrastructure check, not a "find the attacker's name" tool. The legacy port-43 WHOIS protocol is being retired in favour of RDAP: same data, JSON, over HTTPS, with a bootstrap registry telling clients which server answers for which TLD — which is what the tool on this site speaks.

What a record contains

  • Events: registration, last changed, expiration dates. Age = now minus registration.
  • Registrar and its IANA id, plus abuse contact e-mail and phone — the address to report a malicious domain to.
  • Nameservers: who serves the DNS; a domain parked on a phishing kit's default nameservers is a tell.
  • Status codes: clientTransferProhibited (locked, good hygiene for your own domains), pendingDelete, serverHold (suspended — often the registrar acted on an abuse report).
  • Entities: registrant, admin, tech — usually redacted or a privacy proxy; the organisation name sometimes survives.

IP addresses have their own RDAP: the regional registries (RIPE, ARIN, APNIC…) answer with the netblock, its holder and abuse contact, which is how you find out that a C2 address sits in a hosting provider's range and whom to notify.

Try it yourself hands-on

A user forwards a suspicious login page at secure-bank-example-login.com and you want a quick first signal before deeper investigation.

  1. Run the domain through the WHOIS Lookup. Read the events: a registration date within the last few days or weeks, paired with a name that mimics a known brand, is a strong phishing indicator on its own. Note the registrar's abuse contact — that is where the takedown request goes.
  2. Look at the nameservers and compare with the DNS Record Lookup for the domain: a fresh registration, free-tier nameservers and an A record on a bulletproof-hosting range is the full pattern. Legitimate new business domains exist, so this is context, not a verdict.
  3. Feed the domain into your broader triage — the Phishing Checker for look-alike and typosquat analysis, or the Phishing Investigation workflow — rather than treating a WHOIS result alone as conclusive either way. Record the defanged domain and the registration date together in the case.
  4. Turn it around for your own brand: the Domain Availability tool shows which look-alike variants of your domain are unregistered, so you can take the obvious ones before an attacker does.

Common misreadings

  • Old is not safe. Attackers buy aged domains precisely because triage trusts age; check the last changed date and nameserver history too.
  • Privacy proxies are normal. A redacted registrant is the default for a private individual, not a sign of malice.
  • Rate limits. RDAP servers throttle; automated bulk lookups need a plan (and, for the registries, an account).