WHOIS Lookup

WHOIS / RDAP Lookup

What WHOIS Tells You

A WHOIS lookup shows the public registration details for a domain, IP address, or AS number. For domains, that means the registrar, creation date, expiry date, and authoritative name servers. For IP addresses and AS numbers, it means which Regional Internet Registry holds the block. That’s ARIN, RIPE, APNIC, LACNIC, or AFRINIC, plus who the block is assigned to and the abuse contact. This information is the starting point for incident response, fraud investigation, due diligence, and brand protection.

Why This Tool Uses RDAP

Traditional WHOIS is a 1980s text protocol with no standard format and no structured data. The Internet Engineering Task Force (IETF) replaced it with the Registration Data Access Protocol (RDAP). The IETF published the first RDAP specification as RFC 7480 through RFC 7484 in 2015. A consolidated version followed in 2023 as RFC 9082, RFC 9083, and RFC 9224. Every gTLD registrar and every Regional Internet Registry now publishes RDAP endpoints. This tool queries them directly through the well-known rdap.org bootstrap service. The result is faster, more structured, and more current than legacy WHOIS. It works for domains, IP addresses, and AS numbers through one interface.

WHOIS Is Disappearing, Not Just Aging

This is not a slow-moving standard anyone can safely ignore. ICANN ended the requirement for gTLD registries to run WHOIS on port 43 on January 28, 2025. Within a month, 74 gTLD registries shut their WHOIS service off completely.

RDAP query volume passed WHOIS for the first time in June 2025. That comes from the IETF’s own tracking of ICANN’s monthly registry reports. By September 2025, 374 gTLDs had disabled WHOIS entirely. In January 2026, ICANN terminated registrar Brennercom’s accreditation, citing its failure to deploy RDAP as the lead violation. For the full timeline and what changed under the new Registration Data Policy, see our RDAP vs WHOIS guide.

Reading the Results

• Registrar / Sponsor is the company that manages the registration on behalf of the owner. For domains this is GoDaddy, Namecheap, Cloudflare, etc. For IPs and AS numbers this is the RIR or downstream allocation holder.
• Registration date tells you when the domain or block was first registered. A very recent registration on a domain is a common phishing red flag.
• Expiry date tells you when the registration lapses. If a critical service is hosted on a domain, this date is worth monitoring.
• Status codes show registry-level locks like clientTransferProhibited or serverHold. They reveal a lot about the domain’s lifecycle and security posture.
• Name servers list which DNS servers are authoritative. Cross-reference these against actual DNS responses with our DNS Record Checker to spot misconfigurations.
• DNSSEC indicates whether the domain is signed. A signed delegation reduces exposure to DNS poisoning attacks.
• AS Number results show which organization operates a block of routed address space. They also show the registry contact for reporting abuse on that network.

Privacy and Redaction

Most registrant contact details are now redacted by default. That includes name, email, phone, and postal address, per GDPR and ICANN privacy rules. When contact details do appear, it’s usually for one of two reasons. Either the registrant skipped WHOIS privacy, or the registry doesn’t redact that entity type. Do not be surprised to see REDACTED FOR PRIVACY or similar placeholders. That’s the modern norm, not missing data.

For Developers and Power Users

Every lookup includes a View Raw RDAP JSON toggle beneath the results. It also shows the hostname of the authoritative server that answered your query. Use these if you are debugging your own RDAP integration. They also help when validating a registry’s response format, or when you just prefer raw data over the formatted table.

Use Cases

WHOIS and RDAP lookups solve everyday problems. Verify domain ownership before a purchase. Find the right abuse contact for a malicious IP or network. Check whether a domain is parked or actively managed. Confirm a transfer lock before you initiate one. AS number lookups help confirm which organization actually operates a block of address space you are troubleshooting or investigating — including whether traffic claiming to be an AI crawler really originates from that vendor’s published network, a check our AI crawler access checker complements. Our AI crawler guide lists the bots worth allowing and the ones worth blocking. These pair naturally with our DNS Record Checker and Reverse DNS Lookup. Together they trace the full picture of a domain or IP. To learn more about the difference between IP types, see public vs. private IP addresses.

Related Tools & Resources

Explore more free networking tools. Run a DNS lookup, find the PTR record for an IP, or check SPF, DKIM, and DMARC records. Look up your own public IP, or check the ASN and network owner behind any address with IP Geolocation. For the full WHOIS-to-RDAP story, read RDAP vs WHOIS.