What Is WHOIS and What Can a WHOIS Lookup Tell You?
A WHOIS lookup returns the registration record for a domain name or IP address: who registered it, through which registrar, when it was created and expires, and which name servers it uses. You run it when you need to verify who controls a domain, check whether a site is legitimate, or trace infrastructure during an investigation. The main caveat is that privacy services and data-protection rules often hide the registrant's personal details, so treat a WHOIS record as a starting point rather than proof of ownership.
What WHOIS actually is
WHOIS is a query-and-response protocol, not a single database. Domain registrars and registries publish registration records, and a WHOIS lookup queries those records for a given domain or IP address. The result is a plain-text record with standardized fields.
There are two broad record types:
- Domain records — returned for a domain name such as
example.com. - IP and network records — returned for an IP address, showing the organization or provider the block is allocated to.
What a WHOIS record returns
Field names vary slightly between registries, but a typical domain record includes:
| Field | What it tells you |
|---|---|
| Registrar | The company the domain was registered through |
| Registrant / Admin / Tech contacts | Name, organization, email, phone (often redacted) |
| Creation date | When the domain was first registered |
| Expiration date | When registration lapses if not renewed |
| Updated date | Last change to the record |
| Name servers | The DNS servers authoritative for the domain |
| Domain status | Flags such as clientTransferProhibited or ok |
| DNSSEC | Whether DNSSEC signing is enabled |
The creation date is often the most useful field: a domain registered weeks ago that impersonates an established brand is a common fraud signal. Name servers matter too, because domains sharing unusual name servers frequently belong to the same operator.
How to run a WHOIS lookup
- Choose a lookup tool. You can use a command-line client (
whois example.comon most Unix-like systems) or a web-based tool. DNSlytics, for example, offers a WHOIS lookup alongside reverse IP, reverse NS, and reverse MX tools, and states that its IP/DNS data is refreshed every 14 days with more than 10 years of historical data. - Enter the target. Type the domain name (no
http://or trailing path) or an IP address. - Read the record. Expect the fields above. If the registrant section shows a privacy or proxy service, the real owner is masked.
- Cross-check. Compare the name servers, creation date, and hosting against other lookups before drawing conclusions.
Expected result: a registration record for the domain, or an allocation record naming the organization that holds the IP block.
Common snags:
- Redacted contact fields are normal, not an error.
- Some country-code TLDs (ccTLDs) publish minimal or no public WHOIS data.
- A record can be stale between registry updates.
What people use WHOIS for
- Ownership verification — confirming which organization registered a domain before trusting or paying it.
- Fraud prevention — spotting newly registered domains, mismatched registrant details, or domains mimicking a brand.
- Brand protection — finding lookalike domains and the name servers or hosting they share.
- Incident investigation — tying a domain to a registrar, name servers, and IP range as part of a wider trace. WHOIS is one input here; pairing it with DNS, IP, and reverse lookups gives a fuller picture.
Limitations to keep in mind
- Privacy redaction. Most registrars now mask registrant contact details by default, so you often cannot see the individual owner.
- GDPR and similar rules. Data-protection law restricts publication of personal data in WHOIS records, which is a major reason for redaction.
- Accuracy. Registrants can supply false details, and records are only as current as the last registry update.
- Not proof of control. A registrant field, even when visible, does not by itself prove who operates a site today.
Where WHOIS fits in a broader investigation
WHOIS answers "who registered this and when." To answer "what else is connected to this," combine it with:
- DNS lookups — resolve the domain and inspect its records.
- Reverse IP — find other domains hosted on the same address.
- Reverse NS / reverse MX — find domains sharing name servers or mail servers, which often reveals a common operator.
Used together, these turn a single registration record into a map of related infrastructure — which is the point of an investigation tool that bundles WHOIS with reverse and DNS lookups.