Master domain research with WHOIS - View ownership, registration dates, nameservers, and contact information for any domain
WHOIS is a protocol used to query databases that store information about registered domain names, IP addresses, and autonomous systems. It's an essential tool for domain research, security investigations, and administrative purposes.
Note: WHOIS data accuracy depends on registrants providing correct information. False information can lead to domain suspension under ICANN policies.
WHOIS records contain various types of information about domain registrations:
EPP (Extensible Provisioning Protocol) status codes indicate the state of a domain. Multiple statuses can be active simultaneously.
ok - No restrictions, normal stateactive - Domain is active in DNSautoRenewPeriod - Grace period after expiryclientTransferProhibited - Transfer lock enabledclientUpdateProhibited - Changes prohibitedclientDeleteProhibited - Deletion prohibitedclientHold - Domain suspended by registrarserverTransferProhibited - Registry prevents transferserverUpdateProhibited - Registry prevents updatesserverDeleteProhibited - Registry prevents deletionserverHold - Domain suspended by registrypendingTransfer - Transfer in progresspendingDelete - Scheduled for deletionredemptionPeriod - Can be restored (extra fee)pendingRestore - Restoration in progressTip: Multiple "prohibited" statuses indicate strong domain security. These prevent unauthorized changes but must be removed before making legitimate updates.
Privacy concerns and regulations have significantly impacted WHOIS data availability:
Many registrars offer WHOIS privacy protection (also called Domain Privacy or WHOIS Guard):
Important: Privacy protection doesn't hide domain ownership from ICANN, law enforcement, or in legal proceedings. It only masks public WHOIS displays.
Domain expiry monitoring is crucial to prevent losing valuable domains:
Warning: Expired domains can be registered by anyone, including competitors or malicious actors. Domain squatters often target expired domains with existing traffic or backlinks.
Older domains (3+ years) are generally more trustworthy. New domains (< 6 months) used for e-commerce or financial services warrant extra scrutiny.
Well-known registrars (GoDaddy, Namecheap, Google Domains) indicate legitimate registration. Obscure or problematic registrars may signal issues.
Matching registrant, admin, and tech contacts suggest single ownership. Different contacts might indicate resellers or complex structures.
Multiple security locks (TransferProhibited, UpdateProhibited) indicate good security practices. Unusual statuses like ServerHold require investigation.
Frequent recent updates might indicate domain trading or configuration changes. Stable domains show infrequent updates.
Registration Data Access Protocol - The modern replacement for WHOIS with JSON output, authentication, and better internationalization support.
Search for domains by owner information. Useful for finding all domains owned by an organization (requires specialized services).
Track ownership changes over time. Essential for investigations and understanding domain history (premium service from providers like DomainTools).
Query multiple domains efficiently. Useful for portfolio management and monitoring (requires API access and respecting rate limits).