What is WHOIS?
A protocol and public lookup service for retrieving the registration record of a domain, IP block, or autonomous system.
When someone registers example.com, the registrar files a record with the registry: registrant name, organization, contact email, registration date, expiration, and the authoritative nameservers. WHOIS is the protocol for querying that record. You can hit it via the whois CLI, a web form, or a structured RDAP endpoint that returns JSON.
GDPR changed WHOIS significantly. Personal contact details for European registrants are now redacted by default; what you get back is "REDACTED FOR PRIVACY" or a registrar relay address. Organization-registered domains (commonly business sites) often still show full details. The creation date, expiration date, registrar, and nameservers are still public for nearly all domains.
For brand-data work, WHOIS is one of the cheapest signals you have. The creation date tells you whether a domain is new (often a fraud signal) or established. The registrar and nameservers hint at the company's infrastructure choices. Bulk WHOIS lookups underpin domain monitoring, brand-protection (catching typosquats early), and M&A intelligence.
In the wild
- A fraud team flagging an order from a domain registered three days ago
- A brand-monitoring service alerting when a typosquat of
yourcompany.comis registered - A sales team enriching leads with the registrant organization name to spot acquisitions