logo
GeekFormat

WHOIS Lookup

Query target

Free online WHOIS lookup tool. Enter a domain or IP to view registrar, registrant, creation date, expiration date, and domain status. Smart key field extraction, color-coded expiration warnings, and one-click summary copy.

Related

Use Cases

  • Domain renewal management: Batch query domain expiration dates, set renewal reminders to avoid losing domains from forgotten renewals
  • Domain investing/purchase: Check target domain registration date, expiration date, registrar to assess dropcatch potential
  • Enterprise IT asset management: Inventory company domain assets, record registrar, expiration date, DNS configuration
  • Security incident analysis: Use IP WHOIS to confirm attack source IP ASN/organization/country, aiding security response
  • Domain disputes/legal: Collect evidence of domain registration date, registrant information for UDRP disputes or legal proceedings
  • SEO & competitive analysis: Check competitor domain registration dates, historical changes to assess website operational history

Features

  • Dual domain/IP support: Query either domains or IP addresses with automatic detection
  • Smart field extraction: Automatically extracts registrar, registrant, creation/update/expiration dates, status, and other key fields from various WHOIS/RDAP formats
  • Color-coded expiration alerts: Green >60 days, yellow 14-60 days, red <14 days - see renewal timing at a glance
  • Status tags display: EPP status codes shown as tags; abnormal statuses identified at a glance
  • One-click summary copy: Quickly copy key field summaries for reports, asset ledgers, or tickets
  • Raw data view: Expand to view complete JSON/RDAP raw data, copyable for deep analysis
  • Dual WHOIS+RDAP channels: Uses structured RDAP first, with traditional WHOIS fallback for broader TLD coverage

How to Use

  1. Enter the domain (e.g., example.com) or IP address (e.g., 8.8.8.8) you want to query, no http:// prefix needed
  2. Click the query button or press Enter; the tool automatically initiates WHOIS/RDAP requests
  3. Check the remaining days color (green/yellow/red) in the top status bar to assess renewal urgency
  4. View registrar, registrant, creation/update/expiration dates, remaining days in the key fields section
  5. Check domain status tags to confirm abnormalities like clientHold, serverHold, pendingDelete
  6. For detailed information, expand raw JSON to view complete WHOIS/RDAP data

FAQ

What information can WHOIS show?

WHOIS records include: Registrar, Registrant (person/organization), Creation Date, Updated Date, Expiration Date, Status Codes, Name Servers (NS), etc. Due to GDPR privacy protection, after 2018 most registrars redact personal information like registrant name, email, and phone, showing proxy or REDACTED instead.

What is the difference between WHOIS and RDAP?

WHOIS is a protocol born in the 1980s, based on plain text, port 43, with inconsistent formats. RDAP (Registration Data Access Protocol) is the ICANN-mandated successor to WHOIS, based on HTTP/JSON, structured output, internationalization support, and built-in access control. This tool tries RDAP first, falling back to traditional WHOIS on failure.

How long before expiration should I renew my domain?

We recommend renewing at least 30 days before expiration. The tool uses color alerts: green >60 days (normal), yellow 14-60 days (prepare to renew), red <14 days (urgent). Note: Grace periods vary by registrar; after expiration you may not be able to renew at regular price, and some registrars immediately enter redemption period (requiring high redemption fees).

Why can't I see registrant information for some domains?

Main reasons: 1) GDPR privacy protection (required by EU since May 2018; most registrars enable WHOIS privacy by default, showing proxy information); 2) Privacy protection services offered by registrars (like WhoisGuard, Domains By Proxy); 3) Some TLDs (like .com.cn/.de) do not disclose full registrant information; 4) Domain was just registered or transferred, WHOIS cache not updated.

Is there a limit to WHOIS queries?

Most traditional WHOIS servers have rate limits (e.g., Verisign limits ~1000 queries per IP per day); frequent queries may result in temporary bans. This tool queries via backend proxy with automatic caching and retry, but we don't recommend high-frequency batch queries on the same domain.

What does clientTransferProhibited status mean?

This is a 'transfer lock' set by the registrar, a default security setting at the vast majority of registrars to prevent unauthorized transfers to other registrars. If you need to transfer the domain, you must first unlock it at your registrar (disable transfer protection), then obtain an Auth Code/EPP Code to initiate the transfer. This is not an abnormal status.

Can I query WHOIS information for IP addresses?

Yes. This tool supports entering IP addresses, returning the RIR (Regional Internet Registry: APNIC/ARIN/RIPE/LACNIC/AFRINIC), assigned organization, IP range, country/region, ASN, and other information, suitable for cybersecurity analysis and IP ownership confirmation.

IP Geolocation Lookup

What is WHOIS Lookup?

WHOIS is an internet standard protocol for querying domain and IP address registration information, born in 1982 and one of the internet's oldest protocols. Through WHOIS lookup, you can obtain 'registration identity information' for a domain or IP address - who the registrar is, who the registrant/organization is, when it was registered, when it expires, current status, what DNS servers are used, which organization and country the IP belongs to, and more.

**Why is WHOIS lookup important?** For domain owners, forgetting to renew domains is the most common cause of domain loss - regularly checking expiration dates and setting renewal reminders is fundamental domain management. For security professionals, WHOIS attribution of attack IPs is foundational data for threat intelligence and incident response. For domain investors and corporate legal teams, WHOIS information is critical evidence for domain purchase decisions, dispute resolution (UDRP), and brand protection.

**WHOIS vs RDAP**: Traditional WHOIS is based on port 43 plain text protocol, with wildly varying output formats across registries, making programmatic parsing difficult, with no access control or privacy protection mechanisms. RDAP (Registration Data Access Protocol) is the ICANN-mandated successor to WHOIS, based on HTTP/JSON, structured output, internationalization support, built-in differential queries and access control, formally required by ICANN starting 2025. This tool uses RDAP first, falling back to traditional WHOIS when RDAP is unavailable.

**GDPR's impact on WHOIS**: After the EU GDPR implementation in May 2018, public disclosure of registrant name, address, phone, email and other personal information was deemed illegal. Now in WHOIS results for the vast majority of gTLD domains, registrant fields appear as REDACTED or proxy information, retaining only non-personal information like registrar, registration date, expiration date, DNS servers, and status codes. This is normal, not a query error.

This tool initiates WHOIS/RDAP queries from backend servers (avoiding browser CORS restrictions), with **smart field extraction** compatible with different registrar format differences, automatically parsing registrar, registrant, time fields and status codes, and providing **color-coded expiration alerts** (green >60 days/yellow 14-60 days/red <14 days), supporting one-click summary copy and full raw JSON view. Supports both domain and IP query modes.

术语表

WHOIS
A directory service protocol based on TCP port 43 (RFC 3912, 2004) for querying domain/IP registration information. Born in the 1980s, uses free text format with inconsistent output across registries, currently the most widely used domain information query method.RFC 3912
RDAP
Registration Data Access Protocol, the next-generation WHOIS replacement promoted by ICANN, based on HTTP/REST and JSON structured output, with built-in internationalization support, access control, and standardized error codes, gradually deployed since 2015.ICANN RDAP
Registrar
ICANN-accredited domain registration service providers (such as GoDaddy, Namecheap, Alibaba Cloud, Cloudflare, etc.). Users purchase and manage domains through registrars, which submit registration information to registries.
Registry
Organizations that operate top-level domains (TLDs), responsible for maintaining the authoritative database for all domains under that extension, e.g., Verisign operates .com/.net, CNNIC operates .cn, Google operates .dev, etc.
EPP Status Codes
Extensible Provisioning Protocol status codes indicating a domain's current operational state (e.g., ok/locked/expired/redemption/pending deletion). A domain can have multiple status codes simultaneously, affecting renewal, transfer, and resolution behavior.
GDPR Privacy Protection
EU General Data Protection Regulation, effective May 2018. Public disclosure of registrant personal information (name, address, phone, email) in WHOIS was deemed a GDPR violation, resulting in the vast majority of registrars redacting these fields by default, replacing them with proxy or REDACTED.
Redemption Period
A phase approximately 30-45 days after domain expiration, when the domain has been removed from the original registrar account. The original owner can restore the domain by paying a high redemption fee (typically $100-200). After redemption period ends, it enters a 5-day pending delete phase, then released for public registration.
Name Servers (NS)
Authoritative server addresses providing DNS resolution for the domain. NS records in WHOIS show the DNS hosting service currently used by the domain (such as Cloudflare/DNSPod/AWS Route53, etc.). Modifying NS records is the first step in switching CDN/hosting providers.
RIR (Regional Internet Registry)
Regional organizations responsible for allocating and managing IP addresses and ASNs. There are 5 globally: APNIC (Asia-Pacific), ARIN (North America), RIPE NCC (Europe), LACNIC (Latin America), AFRINIC (Africa). IP WHOIS queries typically return the RIR and assigned ISP/organization information.
Auth Code / EPP Code
Domain transfer authorization code. Obtain from your original registrar and submit to the new registrar to initiate a domain transfer. Transfers usually require a 5-7 day confirmation period during which the domain resolves normally, and typically include a 1-year renewal upon successful transfer.

Common TLD WHOIS Servers and Registries

TLDTypeRegistryWHOIS Server
.comgTLDVerisignwhois.verisign-grs.com
.netgTLDVerisignwhois.verisign-grs.com
.orggTLDPIRwhois.pir.org
.cnccTLDCNNICwhois.cnnic.cn
.com.cnccTLDCNNICwhois.cnnic.cn
.ioccTLDNic.iowhois.nic.io
.aiccTLDNic.aiwhois.nic.ai
.devgTLDGooglewhois.nic.google

Common WHOIS EPP Status Codes Explained

Status CodeMeaningEffect
okActive statusDomain is active, renewable and transferable
clientTransferProhibitedRegistrar transfer lockPrevents unauthorized domain transfers; enabled by default at most registrars
clientUpdateProhibitedUpdate prohibitedDomain information cannot be modified; protects domain security
clientHoldRegistrar DNS holdDomain will not resolve; usually due to incomplete verification or disputes
serverHoldRegistry DNS holdResolution stopped at registry level; contact registry to resolve
redemptionPeriodRedemption period~30 days after expiration; domain can be redeemed at a premium price
pendingDeletePending delete5 days after redemption period ends; available for re-registration after deletion
autoRenewPeriodAuto-renew grace period~0-45 days after expiration (varies by registrar); can be renewed at regular price to restore

Domain Lifecycle Timeline

StageDurationRecoverableDescription
ActiveRegistration termNormal renewalActive use, renewable at any time
Auto-Renew Grace Period0-45 daysRenew at regular priceDomain may have stopped resolving, but normal renewal restores it
Redemption Period~30 daysPremium redemption (typically $100-200)Domain is deleted and enters redemption; only original registrant can redeem
Pending Delete5 daysCannot be recoveredAwaiting deletion; released for public registration after 5 days
Released for Re-registrationAfter deletionPublic dropcatchAnyone can register; first-come, first-served

Authoritative References