WHOIS Lookups: What Domain and IP Records Actually Tell You
· 6 min read
WHOIS is one of the internet's oldest directory services: ask who's behind a domain or an IP range, get a text record back. It's also widely believed to be dead since privacy regulation hollowed out the contact fields. The truth is more useful — you just have to know which parts of the record still talk.
Two different WHOIS worlds
Domain WHOIS comes from registries and registrars and describes a domain name: when it was created, when it expires, which registrar manages it, its nameservers, and status flags. IP WHOIS comes from the five regional internet registries (ARIN, RIPE, APNIC, LACNIC, AFRINIC) and describes address space: which organization holds a range, its network name and country, and abuse contacts. Same protocol, entirely different databases — a common source of confusion when a lookup "returns the wrong thing."
What domain records still tell you
- Age: the creation date is unredactable and priceless. A "trusted store since 2009" on a domain registered three weeks ago answers itself. Newly registered domains are one of the strongest phishing signals there is.
- Expiry: tells you whether a domain is about to lapse — and how seriously its owner takes it (bulk-registered spam domains rarely get multi-year renewals).
- Nameservers: reveal the hosting or DNS provider, and changes to them mark ownership transfers or migrations.
- Status codes:
clientTransferProhibitedis normal protection;clientHoldmeans the domain is suspended and won't resolve — often the first public sign of an abuse takedown.
Since GDPR, the registrant's name and email are usually "REDACTED FOR PRIVACY." Treat that as the norm, not a red flag in itself.
What IP records tell you
IP WHOIS held up much better, because it describes organizations rather than people. Looking up an address shows who actually operates it — a telecom, a cloud provider, a university — plus the network's registered country and an abuse mailbox for reporting malicious traffic. Combined with an IP lookup for geolocation and ASN data, it's usually enough to characterize the party behind an address in under a minute.
Practical uses that never went away
- Vetting a suspicious link: registration date + registrar + nameservers takes seconds and catches most throwaway phishing domains.
- Finding where to report abuse: the abuse contact in IP WHOIS is the official channel for attack traffic from a range.
- Checking domain availability and drop dates before trying to register or buy.
- Tracing infrastructure: shared nameservers and registration patterns link related domains in an investigation.
Running a lookup
You don't need a terminal for any of this. Our WHOIS lookup handles both worlds — type a domain or an IP address and get the parsed record with the raw text alongside. Pair it with the DNS resolver to see where the domain actually points today, and you have the full picture: who registered it, who hosts it, and where it lives.