WHOIS Lookup

WHOIS Lookup

WHOIS is the registration record behind every domain name. This tool queries it live over the WHOIS protocol (TCP port 43) and pulls out the fields that matter: the registrar, when the domain was created, last updated and when it expires, the authoritative name servers, and the domain's status codes.

How the lookup actually works

There is no single WHOIS server. The query is a referral chain. First we ask IANA (whois.iana.org) which server is authoritative for the top-level domain — for .com that is Verisign, for .in the NIXI registry. We query that registry for your domain, and if it names a registrar's own WHOIS server we follow that one hop further for the fuller record. Each server we talk to is validated and pinned to a public IP first, so the referral chain can never be steered at an internal address.

Reading the result

• Registrar — the company the domain is registered through.
• Creation / Updated / Expiry dates — the domain's lifecycle. The expiry date is the operationally critical one: let it lapse and the name can be re-registered by anyone.
• Name servers — the authoritative DNS for the zone. A mismatch with what you expect can indicate a hijack or a stale delegation.
• Domain status (EPP codes) — values like clientTransferProhibited or clientDeleteProhibited are registrar locks that protect against unauthorised transfers and deletion. Their absence is worth noticing.

Why it matters for security

WHOIS is a staple of reconnaissance and incident response. Investigators use registration dates to spot freshly-minted phishing domains (a domain registered yesterday impersonating your brand is a red flag), pivot on registrant details and name servers to cluster related malicious infrastructure, and confirm ownership during takedowns. Defensively, watching your own domains' expiry and status codes prevents the two classic self-inflicted disasters: an accidental expiry and an unauthorised transfer.

Common mistakes

• Assuming a blank registrant means the domain is unowned — GDPR and privacy services redact personal contact data by default now; the registrar and dates remain.
• Reading a registrar's WHOIS server as authoritative for dates — the registry record is the source of truth for creation and expiry.
• Trusting WHOIS to be perfectly uniform — every TLD formats its output differently, which is why fields occasionally show as raw text below.