# WHOIS

> The public lookup that tells you who registered a domain name and when.

- Level: Intermediate
- Topics: Networks
- URL: https://tidbit.legios.com.ar/whois/
- In Spanish: [WHOIS](https://tidbit.legios.com.ar/es/whois/)

**WHOIS** is a decades-old system for asking "who is behind this domain or IP address?". Type a domain into a WHOIS lookup and you get its registration record: which registrar it was bought through, when it was created, when it expires, which name servers it uses, and sometimes who the owner is.

It is a daily tool for many people. Someone checking whether a domain is free, a security analyst looking at a suspicious link (a phishing site registered three days ago is a red flag), a company chasing a trademark copycat, or a network engineer finding who runs a block of IP addresses, which regional internet registries also publish this way.

What it shows has changed. Since privacy laws like GDPR took effect in 2018, personal names, emails and phone numbers are usually hidden or replaced by a privacy service. The protocol is also being replaced by **RDAP**, which returns the same kind of data in a structured JSON format with better access control; for generic domains like `.com`, ICANN has made RDAP the official source since 2025. Most lookup websites already query RDAP behind the scenes, so to a user it looks the same.

## An analogy

The land registry for internet names. You can look up a property and see when it was registered, when the lease ends and which agency handled it; the owner's home phone number is usually not on the public card anymore.

## Keep in mind

- Looks up registration data for a domain or IP address.
- Shows registrar, creation and expiry dates, and name servers.
- Owner contact details are usually redacted since GDPR (2018).
- RDAP, a JSON-based successor, is replacing it.

## Go deeper

- [WHOIS on Wikipedia](https://en.wikipedia.org/wiki/WHOIS)
- [ICANN Registration Data Lookup](https://lookup.icann.org/)
- [Registration Data Access Protocol (ICANN)](https://www.icann.org/rdap)

## Related terms

- [IP address](https://tidbit.legios.com.ar/ip-address/): The number that identifies a device on a network, like a postal address.
- [Server](https://tidbit.legios.com.ar/server/): A computer whose job is to answer requests from other computers, all day, every day.
- [Phishing](https://tidbit.legios.com.ar/phishing/): A fake message that tricks you into handing over a password or a payment.
- [Internet](https://tidbit.legios.com.ar/internet/): A worldwide network of networks that lets any connected device reach any other.
- [Personal data and GDPR](https://tidbit.legios.com.ar/personal-data-and-gdpr/): Information about you, and the laws that say who can use it and how.
- [JSON](https://tidbit.legios.com.ar/json/): The plain-text format programs use to hand each other structured data.
- [Website](https://tidbit.legios.com.ar/website/): A set of web pages under one address, stored on a server and opened in a browser.