DNS & domains

WHOIS lookup

Find out who a domain, IP address or network is registered to, and when it expires.

Try: · ·

What is WHOIS?

WHOIS is the public directory of who has registered a domain name, an IP address block or a network (AS number). It shows the registrar, important dates, name servers and how to report abuse.

WHOIS and RDAP

This tool uses RDAP, the modern replacement for WHOIS, which returns clean, structured data straight from the official registries (found through IANA's directory). For the few domain extensions without RDAP, it falls back to classic WHOIS.

Why is the owner's name hidden?

Since privacy laws like GDPR, most registries hide personal details of domain owners. You will usually see "REDACTED FOR PRIVACY" or a privacy service instead. You can still contact the owner through the registrar, and the abuse contact is always shown.

When does a domain expire?

The expiry date is shown above. Most domains renew automatically; after expiry there is usually a grace period of around 30–45 days before the domain can be registered by someone else.

What you can find in a WHOIS record

For a domain name

Registrar – the company the domain was bought through. Contact them to transfer the domain or report abuse.
Creation, update and expiry dates. A very new domain sending you an urgent email about your bank account is a classic phishing sign.
Status codes such as clientTransferProhibited (a normal lock that prevents unauthorised transfers) or redemptionPeriod and pendingDelete (the domain has expired and may soon be released).
Name servers – the DNS provider for the domain.

For an IP address or AS number

Network owner and the address range (for example 203.0.113.0/24) allocated to them.
Regional internet registry – ARIN (North America), RIPE NCC (Europe, Middle East), APNIC (Asia-Pacific), LACNIC (Latin America) or AFRINIC (Africa).
Abuse contact – the right address for reporting spam, attacks or scanning coming from that network.

Practical uses

Checking a suspicious website or email. Look at how old the domain is and where it is registered before trusting it.
Reporting abuse. If an IP keeps attacking your server, WHOIS gives you the hosting company’s abuse address. Include timestamps with time zone and log lines.
Buying an expired domain. Expiry and status show when it may become available.
Diagnosing your own domain. Make sure auto-renew is working and the expiry date is not close.

Tips for reading results

Dates are usually given in UTC, and field names vary slightly between domain endings because each registry formats its data a little differently. For IP addresses, the record you see may belong to a smaller sub-allocation inside a provider’s larger block – the most specific range shown is the one that matters for abuse reports.

WHOIS lookup – frequently asked questions

Can WHOIS tell me who is behind an IP address?

It tells you which organisation the address range belongs to – usually an internet provider or hosting company – not which individual customer was using it.

Why does WHOIS show a different owner than the website?

For IP addresses, the owner is the hosting or cloud company that runs the server, not the website’s owner. For domains, privacy services often appear instead of the real owner.