Whois Lookup

What sits inside a Whois record?

A Whois entry consists of several fields, which vary in detail depending on the domain TLD and the provider. The most relevant fields for a domain lookup:

• Registrar — the provider with which the domain is registered (e.g. GoDaddy, Cloudflare, Namecheap).
• Creation Date / Updated Date / Expiration Date — when the domain was registered, last changed and is set to expire. Older = more trustworthy.
• Nameservers (NS) — where the DNS records are hosted. For deeper DNS analysis, see our DNS Lookup.
• Status Codes — e.g. clientTransferProhibited (the domain cannot be transferred to another registrar) — important before buying a domain.
• Registrant Information — owner, often masked by privacy services or GDPR filters.

Whois for IP addresses — the other variant

For an IP lookup, the Whois system queries not a domain registry but the responsible Regional Internet Registry (RIPE for Europe, ARIN for North America, APNIC for Asia-Pacific). You get: which network the IP belongs to, which organisation owns it, which ASN manages it, and which abuse contacts are on file. The last one is relevant when reporting attacks or spam from a specific IP to the responsible provider.

Why some data is missing

Since GDPR (2018) and the ICANN RDDS reform, personal data in Whois responses is often masked — either by registrar privacy services or by automatic anonymisation. For legal action against domain owners there are separate request procedures via the registrars. For research purposes plenty remains: nameservers, registration dates and ASN data cover 90 % of practical use cases.

Typical use cases

You want to check whether a domain is free or already registered. You investigate the ASN/organisation behind a suspicious IP that shows up in your logs. You look for the abuse contact of a spammer. You run due diligence before a domain purchase and check age, registrar-lock status and prior ownership changes. For deeper background see the glossary entry on ASN.