WHOIS

What WHOIS Tells You

WHOIS is a query-and-response protocol that retrieves registration data stored in distributed databases maintained by Regional Internet Registries (RIRs) and domain registrars. A typical WHOIS response includes the registrant organization, administrative and technical contacts, registration and expiration dates, name servers, and the registrar that manages the domain. For IP addresses, WHOIS reveals which Autonomous System (AS)A large network or group of networks under a single administrative policy, identified by a unique Autonomous System Number (ASN). The internet is composed of tens of thousands of interconnected autonomous systems. or ISPInternet Service Provider. A company that provides internet access to consumers and businesses, assigning public IP addresses and routing traffic to the wider internet. Examples include Comcast, AT&T, and SK Broadband. holds the block, which is useful for tracing network ownership.

Privacy and RDAP

GDPR enforcement since 2018 caused most registrars to redact personal contact data from public WHOIS records, replacing individual names and addresses with privacy-service proxies. The newer RDAP (Registration Data Access Protocol) is gradually replacing the decades-old WHOIS protocol with a structured JSON format, authentication support, and better internationalization. Despite redaction, WHOIS remains the first stop for investigating spam sources, phishing domains, and BGP HijackAn attack or misconfiguration where a network falsely announces ownership of IP prefixes it does not control, causing internet traffic to be rerouted through the attacker's network. Can be used for surveillance, traffic interception, or denial of service. incidents.

Practical Uses

Network engineers rely on WHOIS alongside IP GeolocationThe process of estimating the geographic location (country, city, coordinates) associated with an IP address using databases and network metadata. Accuracy varies from country-level (reliable) to city-level (approximate). lookups to correlate IP ranges with organizations during security investigations. Registrar WHOIS data also exposes name server delegations, letting you verify DNSDomain Name System. The hierarchical, distributed naming system that translates human-readable domain names (e.g., example.com) into IP addresses (e.g., 93.184.216.34). Often called the "phonebook of the internet." ownership and spot hijacked or expired domains before they cause outages. WHOIS Lookup