Cybersecurity glossary
What is WHOIS?
Learn what WHOIS is, how domain registration lookups work, the shift to RDAP and privacy redaction, and how defenders use WHOIS data in investigations.
Definition
WHOIS is a query protocol and ecosystem historically used to look up registration data for Internet resources—especially domain names—returning registrant, registrar, and nameserver information; modern practice increasingly uses RDAP with privacy-redacted outputs.
Why WHOIS still comes up
When a suspicious domain appears in phishing or malware traffic, analysts ask: when was it registered, where, and on which nameservers? WHOIS (and increasingly RDAP) answers those metadata questions.
Public output is thinner than a decade ago, but registration intelligence remains a core investigation skill.
What a lookup typically shows
Registrar
Which company sold/manages the registration.
Dates
Creation, update, and expiry timestamps for age analysis.
Nameservers
Delegation targets that cluster related malicious domains.
Status codes
clientTransferProhibited and similar locks affecting risk.
WHOIS to RDAP evolution
Classic WHOIS
Text protocol returning free-form registration records.
Privacy pressure
GDPR and policy changes redact many personal fields publicly.
RDAP adoption
Structured JSON queries replace or accompany WHOIS interfaces.
Tiered access
Full data may require authenticated access for eligible requestors.
Defensive uses
| Use | Value |
|---|---|
| Phishing triage | New domains with sparse history score as higher risk |
| Infrastructure pivoting | Shared nameservers/registrars link campaigns |
| Brand protection | Detect suspicious lookalike registrations early |
| Incident response | Identify registrar contacts for takedown requests |
- Use RDAP when available for structured, consistent lookups.
- Do not assume public emails/phones will be present for contacts.
- Correlate registration age with certificate and DNS history.
- Protect your own domains with registrar locks and accurate recovery contacts.
- Prefer privacy services thoughtfully—balance spam risk vs operational reachability.
- Document registrar abuse contacts before you need emergency takedowns.
- Combine WHOIS/RDAP with CT logs and passive DNS for fuller pictures.
- Treat registration data as a lead, not definitive attribution.
The practical takeaway
WHOIS is the traditional domain registration lookup system; RDAP is its modern structured counterpart. Even with privacy redaction, registration metadata remains vital for abuse investigations.
Look up domains early in triage—and keep your own registrar details accurate enough to recover ownership if something goes wrong.
Related security terms
Domain Name System (DNS)
DNS publishes how names resolve; WHOIS/RDAP describe registration metadata.
Domain Hijacking
Investigations often start with registrar and contact data.
Typosquatting
Lookalike domains are researched via registration lookups.
Certificate Transparency
Complements WHOIS for discovering related hostnames.
Frequently asked questions
What is WHOIS in simple terms?
It is a way to look up who registered a domain and which registrar and nameservers are associated—though much personal contact data is now hidden.
Why is WHOIS data often redacted?
Privacy regulations and ICANN policy changes led registrars to mask personal registrant details from public queries.
What is RDAP?
Registration Data Access Protocol—a modern, standardized JSON-based successor/companion to classic WHOIS for registration data.
Is WHOIS still useful for security?
Yes. Registrar, creation date, nameservers, and status codes still help triage phishing and infrastructure clustering—even with redaction.
Can WHOIS prove domain ownership in court?
Public WHOIS alone is weak proof today. Registrars hold authoritative records accessible via proper legal or accredited channels.
How do attackers abuse WHOIS?
Historically for harvesting contacts for spam; today more for recon on infrastructure reuse and timing of new malicious registrations.
References
Explore authoritative guidance and frameworks related to whois.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.