WHOIS Lookup

GDPR (2018) forced registrars to redact personal data in WHOIS for EU registrants. Most registrars now redact all registrants' data by default. Domain privacy services replace owner details with proxy information. This protects privacy but complicates legitimate investigations. Legitimate requesters can use ICANN's Registration Data Access Protocol (RDAP) or contact registrars for non-public data with valid justification.

WHOIS helps identify: domain age (new domains are higher risk), registrar patterns (certain registrars popular with attackers), nameserver infrastructure (cloud provider or suspicious host), registration patterns (bulk registrations), and historical ownership changes. Combine with other intelligence: SSL certificates, DNS records, IP reputation, passive DNS history. Tools like DomainTools provide enhanced WHOIS with historical data and risk scoring.

Domain privacy replaces public WHOIS contact information with the privacy service's details, protecting against spam, identity theft, and harassment. Recommended for personal domains and small businesses. However, it may complicate trademark disputes, reduce trust for commercial sites, and doesn't hide technical nameserver information. Some countries (Canada) restrict privacy services. Weigh privacy benefits against transparency needs for your use case.

Common statuses: clientTransferProhibited (locked against transfers), clientUpdateProhibited (can't modify), clientDeleteProhibited (can't delete), pendingTransfer (transfer in progress), redemptionPeriod (recently deleted, recoverable), autoRenewPeriod (auto-renewing). "Client" indicates registrar-level locks; "server" indicates registry-level. Multiple statuses can apply. Check status to understand domain security posture and transferability. Lock domains to prevent unauthorized transfers.

Registration date indicates domain age; older domains are generally more trustworthy. Updated date shows recent changes (ownership transfer, nameserver changes—investigate if suspicious). Expiration date reveals abandonment risk; recently expired domains may be squatted. Look for patterns: domains registered in bulk (same day/registrar), frequent ownership changes, or expiration within days (possible disposable malicious infrastructure).

RDAP (Registration Data Access Protocol) is the modern successor to WHOIS: JSON-based, RESTful API, standardized responses, better internationalization support, authentication/authorization capabilities. RDAP enables controlled access to registration data post-GDPR. Most registries now support RDAP alongside WHOIS. For automated queries and modern applications, prefer RDAP; for quick manual lookups, WHOIS remains simpler and more universal.

Monitor: domain registration patterns matching your brand (typosquatting), newly registered similar domains, WHOIS changes to your domains (unauthorized transfers), SSL certificate issuance (Certificate Transparency logs), DNS changes, expired competitor domains (potential squatting). Use services like DomainTools, SecurityTrails, or VirusTotal for monitoring. Implement DPMA (Domain Protected Marks List) for trademark protection in new gTLDs.