In one sentence
WHOIS is the lookup that shows who registered a domain, when, through which registrar and on which nameservers — today served over RDAP, its structured JSON successor, with registrant contact details mostly redacted since the GDPR.
Why it matters
Registration date is one of the cheapest, highest-signal checks available during phishing triage: a domain registered three days ago that imitates your bank's login page is a much stronger signal than the same look-alike having existed for five years. Attackers register in bulk, cheaply, shortly before a campaign, and the lookup shows it. It also shows the registrar and the nameservers, which tie a domain to infrastructure you may have seen before, and the expiry — which matters for your own domains far more than people think (an expired corporate domain gets re-registered by someone else).
Since the GDPR, most registrars redact the registrant's personal contact details, and ICANN's policy followed; treat WHOIS as a registration-timeline and infrastructure check, not a "find the attacker's name" tool. The legacy port-43 WHOIS protocol is being retired in favour of RDAP: same data, JSON, over HTTPS, with a bootstrap registry telling clients which server answers for which TLD — which is what the tool on this site speaks.
What a record contains
- Events: registration, last changed, expiration dates. Age = now minus registration.
- Registrar and its IANA id, plus abuse contact e-mail and phone — the address to report a malicious domain to.
- Nameservers: who serves the DNS; a domain parked on a phishing kit's default nameservers is a tell.
- Status codes:
clientTransferProhibited(locked, good hygiene for your own domains),pendingDelete,serverHold(suspended — often the registrar acted on an abuse report). - Entities: registrant, admin, tech — usually redacted or a privacy proxy; the organisation name sometimes survives.
IP addresses have their own RDAP: the regional registries (RIPE, ARIN, APNIC…) answer with the netblock, its holder and abuse contact, which is how you find out that a C2 address sits in a hosting provider's range and whom to notify.
Try it yourself hands-on
A user forwards a suspicious login page at secure-bank-example-login.com and you want a quick first signal before deeper investigation.
- Run the domain through the WHOIS Lookup. Read the events: a registration date within the last few days or weeks, paired with a name that mimics a known brand, is a strong phishing indicator on its own. Note the registrar's abuse contact — that is where the takedown request goes.
- Look at the nameservers and compare with the DNS Record Lookup for the domain: a fresh registration, free-tier nameservers and an A record on a bulletproof-hosting range is the full pattern. Legitimate new business domains exist, so this is context, not a verdict.
- Feed the domain into your broader triage — the Phishing Checker for look-alike and typosquat analysis, or the Phishing Investigation workflow — rather than treating a WHOIS result alone as conclusive either way. Record the defanged domain and the registration date together in the case.
- Turn it around for your own brand: the Domain Availability tool shows which look-alike variants of your domain are unregistered, so you can take the obvious ones before an attacker does.
Common misreadings
- Old is not safe. Attackers buy aged domains precisely because triage trusts age; check the last changed date and nameserver history too.
- Privacy proxies are normal. A redacted registrant is the default for a private individual, not a sign of malice.
- Rate limits. RDAP servers throttle; automated bulk lookups need a plan (and, for the registries, an account).