HTTP & Networking
What is WHOIS?
A protocol and public lookup service for retrieving the registration record of a domain, IP block, or autonomous system.
When someone registers example.com, the registrar files a record with the registry: registrant name, organization, contact email, registration date, expiration, and the authoritative nameservers. WHOIS is the protocol for querying that record. You can hit it via the whois CLI, a web form, or a structured RDAP endpoint that returns JSON.
GDPR changed WHOIS significantly. Personal contact details for European registrants are now redacted by default; what you get back is "REDACTED FOR PRIVACY" or a registrar relay address. Organization-registered domains (commonly business sites) often still show full details. The creation date, expiration date, registrar, and nameservers are still public for nearly all domains.
For brand-data work, WHOIS is one of the cheapest signals you have. The creation date tells you whether a domain is new (often a fraud signal) or established. The registrar and nameservers hint at the company's infrastructure choices. Bulk WHOIS lookups underpin domain monitoring, brand-protection (catching typosquats early), and M&A intelligence.
In the wild
- →A fraud team flagging an order from a domain registered three days ago
- →A brand-monitoring service alerting when a typosquat of
yourcompany.comis registered - →A sales team enriching leads with the registrant organization name to spot acquisitions
How Brand.dev uses whois
Endpoints in the Brand.dev API where this concept comes up directly.
FAQ
Is WHOIS data still useful after GDPR?
Yes, but with caveats. Registration dates, registrars, and nameservers are usually still public. Personal contact details for individuals in the EU are redacted; organization details often are not.
WHOIS vs RDAP?
WHOIS is the legacy text protocol; RDAP is its modern, structured (JSON, HTTPS, paginated) replacement. ICANN has been mandating RDAP for new registries; both currently coexist.
How do I get bulk WHOIS at scale?
Through a commercial provider that aggregates and normalizes registry data, or by running RDAP queries against the relevant registries with respect for their rate limits.
Related terms
The human-readable name that identifies a site on the internet, the part that maps to an IP address through DNS.
The Domain Name System, the distributed database that translates human-readable domain names into the IP addresses computers actually route to.
A prefix added to a parent domain to identify a separate section, app, or service, like `blog.example.com` or `api.example.com`.
The top-level domain, the rightmost piece of a domain name, like `.com`, `.org`, `.io`, or `.dev`.