client.rdap.org

A WHOIS lookup returns the registration record for a domain name or IP address: who registered it, through which registrar, when it was created and expires, and which name servers it uses. You run it when you need to verify who controls a domain, check whether a site is legitimate, or trace infrastructure during an investigation. The main caveat is that privacy services and data-protection rules often hide the registrant's personal details, so treat a WHOIS record as a starting point rather than proof of ownership.

What WHOIS actually is

WHOIS is a query-and-response protocol, not a single database. Domain registrars and registries publish registration records, and a WHOIS lookup queries those records for a given domain or IP address. The result is a plain-text record with standardized fields.

There are two broad record types:

• Domain records — returned for a domain name such as example.com.
• IP and network records — returned for an IP address, showing the organization or provider the block is allocated to.

What a WHOIS record returns

Field names vary slightly between registries, but a typical domain record includes:

The creation date is often the most useful field: a domain registered weeks ago that impersonates an established brand is a common fraud signal. Name servers matter too, because domains sharing unusual name servers frequently belong to the same operator.

How to run a WHOIS lookup

1. Choose a lookup tool. You can use a command-line client (whois example.com on most Unix-like systems) or a web-based tool. DNSlytics, for example, offers a WHOIS lookup alongside reverse IP, reverse NS, and reverse MX tools, and states that its IP/DNS data is refreshed every 14 days with more than 10 years of historical data.
2. Enter the target. Type the domain name (no http:// or trailing path) or an IP address.
3. Read the record. Expect the fields above. If the registrant section shows a privacy or proxy service, the real owner is masked.
4. Cross-check. Compare the name servers, creation date, and hosting against other lookups before drawing conclusions.

Expected result: a registration record for the domain, or an allocation record naming the organization that holds the IP block.

Common snags:

• Redacted contact fields are normal, not an error.
• Some country-code TLDs (ccTLDs) publish minimal or no public WHOIS data.
• A record can be stale between registry updates.

What people use WHOIS for

• Ownership verification — confirming which organization registered a domain before trusting or paying it.
• Fraud prevention — spotting newly registered domains, mismatched registrant details, or domains mimicking a brand.
• Brand protection — finding lookalike domains and the name servers or hosting they share.
• Incident investigation — tying a domain to a registrar, name servers, and IP range as part of a wider trace. WHOIS is one input here; pairing it with DNS, IP, and reverse lookups gives a fuller picture.

Limitations to keep in mind

• Privacy redaction. Most registrars now mask registrant contact details by default, so you often cannot see the individual owner.
• GDPR and similar rules. Data-protection law restricts publication of personal data in WHOIS records, which is a major reason for redaction.
• Accuracy. Registrants can supply false details, and records are only as current as the last registry update.
• Not proof of control. A registrant field, even when visible, does not by itself prove who operates a site today.

Where WHOIS fits in a broader investigation

WHOIS answers "who registered this and when." To answer "what else is connected to this," combine it with:

• DNS lookups — resolve the domain and inspect its records.
• Reverse IP — find other domains hosted on the same address.
• Reverse NS / reverse MX — find domains sharing name servers or mail servers, which often reveals a common operator.

Used together, these turn a single registration record into a map of related infrastructure — which is the point of an investigation tool that bundles WHOIS with reverse and DNS lookups.

A domain name is the human-readable address people type to reach a website or online service — like sedo.com. It works by mapping that readable label to a numeric IP address through the Domain Name System (DNS), so you don't have to memorize strings of numbers. You need a domain name if you want a stable, memorable address for a website, email, or brand. You can get one either by registering a new, unclaimed name through a registrar, or by buying an already-registered name on an aftermarket marketplace such as Sedo.

Domain name vs. URL, website, and hosting

These four terms get used interchangeably, but they describe different things:

A useful way to think about it: the domain name is the street address, hosting is the building on that land, the website is what's inside the building, and the URL is the directions to a specific room.

The parts of a domain name

Reading a domain from right to left:

• Top-level domain (TLD) — the ending, such as .com, .org, or a country code like .us. This is the broadest category.
• Second-level domain — the part you choose and that makes the name yours, such as sedo in sedo.com. The combination of second-level name + TLD is what you register.
• Subdomain — an optional prefix you control, such as blog.example.com or shop.example.com. Subdomains don't need separate registration; you create them through your DNS settings.

So in blog.example.com: blog is the subdomain, example is the second-level domain, and .com is the TLD.

How DNS turns a name into an IP address

Computers locate each other by IP addresses, not names. DNS is the system that translates one into the other. When someone types your domain into a browser, roughly this happens:

1. The browser asks a DNS resolver to look up the name.
2. The resolver queries a hierarchy of name servers until it reaches the authoritative name server for your domain.
3. That server returns the IP address (and other records) associated with the name.
4. The browser connects to that IP address and requests the page.

The key practical point: your domain and your hosting are linked through DNS records. You point your domain at a server by setting records such as an A record (maps a name to an IPv4 address) or a CNAME record (points one name to another). Changing hosts usually means updating these records, not moving the domain itself.

How domains are registered, owned, and renewed

Domains aren't bought outright in the way physical property is. They're registered for a fixed term — commonly one year at a time — through an accredited registrar.

• Registration gives you the exclusive right to use that name for the term you paid for.
• Ownership is tracked in a registry database, with your contact details (often privacy-protected) on record as the registrant.
• Renewal is required. If you let a domain lapse, it can expire and eventually become available to others. Most registrars offer auto-renew to prevent accidental loss.
• Transfer lets you move a domain between registrars, usually by unlocking it and using an authorization code.

Because renewal is ongoing, the real cost of a domain is the registration or purchase price plus the recurring renewal fee.

Registering a new domain vs. buying a premium or aftermarket domain

There are two distinct paths, and they differ in price, availability, and process:

Registering a new domain

• You search for a name that no one currently holds and register it through a registrar.
• Typically the lowest-cost route, with standard renewal pricing.
• Best when your preferred name is still unclaimed.

Buying a premium or aftermarket domain

• The name is already registered, and the current owner is offering it for sale — often through a marketplace like Sedo, which lists domains for sale and premium domains.
• Pricing is set by the market or the seller and can be far higher than a standard registration, reflecting the name's perceived value.
• Best when the exact name you want is taken and matters enough to your brand to pay for it.

Sedo operates as a marketplace for buying, selling, and parking domains, so both new registrations and aftermarket purchases can fit into the same workflow depending on what you need.

What this means for your next step

If you just need any available name, start with a registrar search and register it, then point its DNS records at your hosting. If the name you want is already taken and central to your plans, look at aftermarket listings and expect market-based pricing. Either way, plan for renewal from the start — a domain is a recurring commitment, not a one-time purchase.

An IP address is a numeric label assigned to a device or network so data can be routed to and from it. On Windows you have two relevant kinds: a private (local) IP used inside your home or office network, and a public (external) IP that the outside world sees. To check your public IP, the fastest method is a browser-based lookup; if you want it always visible on your desktop, a small utility such as the IP Address Utility from rtmenu.com can display your external IP in a customizable window.

Private vs. public IP addresses

Your Windows PC normally holds a private address. The router translates traffic between that private address and the single public address your ISP gives your connection (a process called NAT). That's why "what is my IP" tools show the router's public address, not your PC's local one.

How to see your public IP on Windows

Method 1: Browser lookup (no install)

1. Open any browser.
2. Search for "what is my IP address" or visit an IP-lookup page.
3. The number shown at the top is your public/external IP.

Expected result: a single IPv4 (and sometimes IPv6) address. This reflects what external servers see.

Method 2: A dedicated Windows utility

The rtmenu.com IP Address Utility is described as displaying the IP address "as visible to the outside world (external ip address) in a customizable window," with a display format that "can be changed easily."

Typical flow for this kind of tool:

1. Install and launch the utility.
2. It queries an external service and shows your public IP in a small window.
3. Adjust the window's display format to suit how you want the address presented.

Expected result: your external IP stays visible without opening a browser each time — useful if you check it often (remote access, server work, troubleshooting).

Why your public IP changes

• ISP reassignment: Many ISPs hand out dynamic addresses that rotate over time or after a router reboot.
• Router restart: Power-cycling the router can trigger a new lease from the ISP.
• VPN or proxy: Connecting through a VPN replaces your visible IP with the VPN server's address; toggling a proxy does the same.
• Network switch: Moving to a different network (mobile hotspot, office, café) changes the public IP entirely.

Troubleshooting: the displayed IP looks wrong

• It shows a private address (192.168.x.x, 10.x.x.x): You're likely looking at your local IP, not the external one. Use a tool or page that explicitly reports the external/public address.
• It shows a VPN's location: Disconnect the VPN or proxy and re-check.
• It changed unexpectedly: Confirm whether your router rebooted or your ISP rotated the lease.
• IPv4 vs. IPv6 mismatch: Some tools report one or the other; check which family you actually need.

Quick decision guide

• Just need the number once: Use a browser lookup — no install required.
• Check it frequently on Windows: A tray/desktop utility that shows the external IP in a customizable window saves repeated browser trips.
• Need to confirm what a remote server sees: Always use an external lookup, since your PC's local IP won't match.

RDAP (Registration Data Access Protocol) is the structured, HTTPS-based replacement for WHOIS. You use it to look up registration data for a domain name, an IP address or CIDR block, or an Autonomous System Number (ASN), and you get back a JSON record instead of free-form text. A private RDAP lookup tool such as client.rdap.org sends your query directly from your browser to the relevant registry's RDAP server over an encrypted HTTPS connection, so only that registry sees the query.

What RDAP is and why it replaces WHOIS

WHOIS returns unstructured text that varies by registry, which makes it hard to parse reliably and hard to extend. RDAP standardizes both the transport and the data model:

• Transport: HTTPS requests instead of a plain-text protocol on port 43.
• Format: JSON with defined fields, so responses can be parsed and validated programmatically.
• Access control: Because responses are structured, registries can return different levels of detail depending on who is asking, rather than exposing everything to everyone.

The practical effect for you: the same query type returns a consistent shape of answer across registries that support RDAP.

How RDAP differs from WHOIS

The coverage gap matters in practice. All generic TLDs now support RDAP, but only a few country-code TLDs (ccTLDs) have deployed it. If a ccTLD has not deployed RDAP, an RDAP lookup for that domain will not return a registry record.

What you can look up

An RDAP lookup tool supports several query types:

• Domain — registration data for a domain name.
• TLD — information about a top-level domain.
• IP / CIDR — allocation data for an IP address or a CIDR block.
• AS Number — data for an Autonomous System Number.
• Entity — a registered entity such as a contact or organization handle.
• Registrar — registrar records.

Note one structural limitation: there is currently no bootstrap registry for ICANN-accredited registrars, so registrar queries are sent to the registrars.rdap.org server rather than resolved through a bootstrap mechanism.

How to run a lookup and read the response

1. Choose the query type that matches what you have — domain, IP/CIDR, ASN, entity, or registrar.
2. Enter the value and submit. Your browser connects directly to the registry's RDAP server over HTTPS.
3. Read the JSON response. The record contains the registration data for that object, with fields defined by the RDAP data model.
4. Decide whether to follow the referral. If the "Follow referral to registrar's RDAP record" checkbox is checked, the sponsoring registrar may also see your query — but only if the registry provides a referral.

The privacy point is the reason to care about step 4. With the referral option off, only the relevant registry sees your query. Turning it on can add the registrar as a second party that sees it. If you want the narrowest exposure, leave the referral option unchecked and accept that you may not see the registrar's portion of the record.

When a lookup fails or looks wrong

Two distinct problems come up:

• No RDAP record for a ccTLD. This is a coverage issue, not an error in your query. The ccTLD has not deployed RDAP, so there is no registry RDAP server to answer. There is no RDAP equivalent to fall back on for that TLD.
• A response that looks incorrect. RDAP responses are the registry's or registrar's content. If something in the response is wrong, contact the relevant registry or registrar — the lookup tool is only relaying the query. To check whether a response is malformed rather than merely unexpected, you can run it through an RDAP Validator.

Quick reference

• RDAP = structured, HTTPS, JSON replacement for WHOIS.
• Supported queries: domain, TLD, IP/CIDR, ASN, entity, registrar.
• Privacy: your browser connects directly to the registry over HTTPS; only the registry sees the query unless you follow the referral to the registrar.
• Coverage: all generic TLDs support RDAP; only some ccTLDs do.
• Registrar queries: no bootstrap registry exists, so they go to registrars.rdap.org.
• Bad response content: report it to the registry or registrar, and validate it with an RDAP Validator first.

DNS (Domain Name System) is the internet's naming layer: it translates human-readable domain names like google.com into the IP addresses machines use to route traffic, such as 188.114.96.3 (IPv4) or 2a06:98c1:3120::3 (IPv6). You rely on it every time you open a site, send email, or connect an app to a server. Understanding it also matters if you do troubleshooting or online investigation, because DNS records and lookup tools expose who hosts a domain, where its mail goes, and how it relates to other infrastructure.

The core problem DNS solves

Computers route packets by numeric address, not by name. Humans remember names. DNS is the distributed database that maps one to the other, and it does so at internet scale without a single central server holding every record.

How a DNS lookup works

When you type a domain into a browser, resolution typically follows this path:

1. Local cache / hosts file — The browser and operating system first check whether they already know the answer from a recent lookup.
2. Recursive resolver — If not cached, your device asks a resolver (often run by your ISP or a public provider). The resolver does the legwork on your behalf.
3. Root servers — The resolver asks a root server, which points it toward the correct top-level domain (TLD), such as .com.
4. TLD servers — The TLD server points to the authoritative name servers for that specific domain.
5. Authoritative name servers — These hold the domain's actual records and return the answer.
6. Response and caching — The resolver returns the IP to your browser and caches it for a period set by the record's TTL (time to live), so future lookups are faster.

Each step is a query-and-referral chain. The resolver does the recursion; the authoritative servers give final answers.

Common DNS record types

These records are the raw material for both troubleshooting and investigation.

Why DNS matters for troubleshooting and investigation

Because DNS records are public and queryable, they reveal relationships between domains, IPs, and providers. Tools built for this purpose let you:

• Run DNS lookups to confirm what a domain currently resolves to.
• Reverse IP to see which other domains share an IP address — useful for spotting shared hosting or linked infrastructure.
• Reverse NS / Reverse MX to find domains using the same name servers or mail servers.
• WHOIS lookups to check registration details.
• Review historical data to see how records changed over time.

This is the approach behind platforms like DNSlytics, which describes itself as an online investigation tool for finding information about domains, IP addresses, and providers, and for discovering relations and historical data between them. It reports coverage of 330+ million active domains, 60+ million mail servers, 7+ million name servers, and 1+ billion PTR records, with IP/DNS data refreshed every 14 days and 10+ years of historical data. Those figures indicate the scale at which DNS data supports fraud prevention, brand protection, and digital investigation.

Practical implications: caching, propagation, and security

• Caching and TTL — Resolvers and devices cache answers. A record change won't be seen everywhere until caches expire, which is why updates appear to "propagate" gradually rather than instantly.
• Propagation delays — The TTL value controls how long stale answers persist. Short TTLs mean faster updates but more queries.
• DNS security basics — Because DNS is central to connectivity, it is also a target. Be aware that DNS responses can be spoofed or intercepted, and that TXT records often carry email authentication policy (such as SPF) that affects whether mail is trusted.

When to use a DNS investigation tool

Reach for DNS lookups and related tools when you need to:

• Verify where a domain actually points before trusting it.
• Trace shared infrastructure between suspicious domains.
• Check mail routing and email policy records.
• Compare current records against historical ones to spot changes.

For routine browsing, DNS works invisibly. For troubleshooting and investigation, its records are the evidence — and tools that aggregate lookups, reverse queries, and history turn that evidence into something you can act on.