whois

WHOIS is a query/response protocol defined in RFC 3912 ↗. WHOIS servers listen on TCP port 43 and provide registration details for domain names. The domain registrar maintains these records for the domains they lease.

From a WHOIS response, the following details may be available (when not redacted):

• Registrar: The company (e.g., Namecheap, GoDaddy) that registered the domain.
• Registrant contact information: Name, organisation, address, phone, and email. However, privacy services (standard since GDPR 2018) usually replace this with “Withheld for Privacy” or similar.
• Dates: Creation (registration), Updated (last change), and Expiration (renewal deadline).
• Name servers: The DNS servers authoritative for the domain.
• Status codes: For example, clientTransferProhibited indicates the domain is locked against unauthorised transfers.
• Abuse contacts: The registrar’s email and phone for reporting issues.

Full personal details are now rare due to privacy laws (GDPR, CCPA) and widespread use of privacy proxies. In practice, attackers focus on dates (for estimating age or timing social engineering around renewal periods), the registrar (for phishing patterns), name servers (potential weak points), and historical changes. Services like whoxy.com provide historical WHOIS snapshots. Historical WHOIS data can reveal previous owners, registrar changes, or name server migrations that may indicate past compromises or infrastructure shifts.

To query WHOIS, use the whois command-line client (faster than most web tools) or online viewers for legacy queries.
Syntax: whois DOMAIN_NAME

Online tools:

• https://lookup.icann.org/en ↗
• https://whois.domaintools.com/ ↗
• https://who.is/ ↗

RDAP#

As of 28 January 2025, ICANN officially sunsetted the traditional WHOIS protocol for generic top-level domains (gTLDs) in favour of the Registration Data Access Protocol (RDAP). RDAP is the modern successor: it uses HTTPS (secure), returns structured JSON (machine-readable and consistent), supports internationalisation, provides better privacy controls (differentiated access), and aligns with current data protection rules. While legacy whois clients still work (often via failover or older servers), RDAP is now the authoritative standard. Many tools and browsers redirect to RDAP automatically, and command-line access is straightforward with curl or dedicated clients like OpenRDAP.

Using RDAP
Use curl to query a public RDAP endpoint (e.g., Verisign for .com domains).

curl -s https://rdap.verisign.com/com/v1/domain/example.com | jq .