What Can a WHOIS Lookup Tell You?
WHOIS data is the public registration record that shows who a domain name, IP address or network is registered to. This tool accepts three kinds of queries:
- Domain names (e.g.
example.com): registration, last-updated and expiry dates, the registrar, status codes, name servers and DNSSEC status. - IP addresses (e.g.
8.8.8.8): the network block and CIDR range the address belongs to, the organization using it, the country and the abuse contact. - AS numbers (e.g.
AS15169or just15169): the organization that operates the network, registration dates and contact details.
Results are cached for 12 hours, and each IP address can run up to 10 lookups per minute. To see an IP address's location and internet provider, use our IP lookup; for a domain's DNS records, try the DNS lookup.
WHOIS vs. RDAP
Classic WHOIS is an old protocol that returns plain text over TCP port 43. Every server formats its output differently, and international characters aren't handled consistently. RDAP (Registration Data Access Protocol) is the modern replacement developed by the IETF: it runs over HTTPS and returns standardized JSON. Since January 28, 2025, ICANN has treated RDAP as the definitive source of registration data for generic top-level domains (gTLDs).
Our tool routes each query to the right server using the RDAP “bootstrap” registry published by IANA. IP addresses and AS numbers go to the responsible regional internet registry, and domain names go to the registry that runs their extension (Verisign for .com and .net, for example). For extensions without RDAP, most notably Türkiye's .tr and .com.tr, the tool falls back to classic WHOIS and queries whois.trabis.gov.tr, the server of TRABIS, the .tr registry run by Türkiye's telecom regulator (BTK).
Who Assigns IP Addresses?
IP addresses and AS numbers are handed out by five Regional Internet Registries (RIRs), each responsible for a part of the world:
| Registry | Service region |
|---|---|
| ARIN | United States, Canada and parts of the Caribbean |
| RIPE NCC | Europe, the Middle East and parts of Central Asia (including Türkiye) |
| APNIC | Asia-Pacific |
| LACNIC | Latin America and parts of the Caribbean |
| AFRINIC | Africa |
What Do Domain Status Codes Mean?
- client transfer prohibited: a transfer lock set by the registrar. It prevents unauthorized transfers and is normal, even recommended.
- client hold / server hold: the domain isn't published in DNS, so its website and email stop working. This usually points to a billing, verification or legal issue.
- redemption period: the domain has expired and is in a grace period before deletion; the previous owner can usually restore it for an extra fee.
- pending delete: the domain is about to be deleted and will soon be available for registration again.
Tip: if a site claiming to be your bank, a delivery company or a government agency uses a domain that was registered only a few days ago, treat that as a strong sign of a scam.
How to Report Abuse
If an IP address is sending you spam, scanning your ports, attacking your server or trying to defraud you, the abuse contact in the WHOIS result is the complaints desk of the organization that runs that network. Include the IP address, the exact date and time with the time zone (for example, 2026-09-28 14:05 UTC) and any relevant log lines. Only the provider knows which customer used the address at that moment, so for crimes such as fraud, also report the incident to the police.
Why Is Personal Information Hidden?
Because of privacy laws such as the EU's GDPR and Türkiye's KVKK, registries and registrars usually redact the name, postal address, phone number and email address of individual registrants. You'll see placeholders like “REDACTED FOR PRIVACY” or the fields will be missing entirely. Organization names and countries are often still visible for business registrations. If you need to reach a domain owner, use the contact form offered by the domain's registrar.