> For the complete documentation index, see [llms.txt](https://docs.ipcheck.ing/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ipcheck.ing/knowledge-base/lookup-privacy/whois-search.md). # Whois Search ## What it does Every domain name and every block of IP addresses is registered with someone. That registration is public information, and **Whois Search** fetches it for you. Put in a domain name and you get the registrar, the registration and expiry dates, the name servers, and the current status of the domain. Put in an IP address and you get the network block it belongs to, the organisation that holds it, the country, and usually an abuse contact. Behind the scenes the tool uses two protocols. Classic **WHOIS** is the older text-based service. **RDAP** is its modern replacement, which returns structured data over HTTPS. Domains are looked up over WHOIS first and fall back to RDAP for newer top-level domains such as `.ing`, `.app` or `.dev`, which no longer run a WHOIS server. IP addresses go to RDAP first, because that is the authoritative source at the regional registries. ## How to run it {% stepper %} {% step %} ### Open the tool Go to **Advanced Tools** and click the **Whois Search** card, or open `/tools/whois` directly. {% endstep %} {% step %} ### Enter a domain or an IP Type a domain name, a full URL, or an IPv4 or IPv6 address. Subdomains are trimmed away, so `www.example.com` is queried as `example.com`. Then press Enter or click the search button. {% endstep %} {% endstepper %} ## Reading your results The result is raw registry text, shown exactly as the registry returned it. The tool tells you this above the output: *"Whois information contains various types of fields. The following is the raw text information."* For domains you may get several answers at once. Each one is a collapsible block labelled **Information Provider**, because a domain record often exists at both the registry and the registrar, and the two can carry different levels of detail. Open the first one, and check the others if a field you want is missing. For IP addresses you get a single block. ### Common fields for a domain | Field | What it tells you | | -------------- | --------------------------------------------------------------------------- | | `Domain Name` | The domain the record belongs to. | | `Created` | When the domain was first registered. | | `Updated` | When the record last changed. | | `Expires` | When the registration runs out. | | `Status` | Registry locks and pending actions, for example `clientTransferProhibited`. | | `Registrar` | The company the domain was bought through. | | `Name Servers` | The DNS servers that answer for this domain. | | `DNSSEC` | Whether the domain's DNS answers are cryptographically signed. | ### Common fields for an IP address | Field | What it tells you | | --------------------- | ---------------------------------------------------------------------------------------------- | | `NetRange` / `CIDR` | The first and last address of the block this IP sits in, and its size. | | `NetName` | The registry's short name for that block. | | `NetType` | How the block was assigned, for example a direct allocation or a reassignment. | | `Country` | The country the block is registered to. This is registration data, not a location measurement. | | `Created` / `Updated` | When the block was allocated and last modified. | | `Abuse` | Where to report misuse coming from this address. | {% hint style="info" %} The registered country of a network block often differs from where an IP actually appears to be. If the two disagree, see [Why Is My IP Location Wrong?](/knowledge-base/diagnose/why-is-my-ip-location-wrong.md) and [GeoIP: How IP Geolocation Works](/knowledge-base/concepts/geoip-explained.md). {% endhint %} ### Redacted contact details are normal You will often see `REDACTED FOR PRIVACY`, a generic proxy address, or an anonymised forwarding email instead of a person's name. This is expected. Since GDPR came into force, registries and registrars hide personal contact details for domain owners by default, and many registrars sell privacy protection on top of that. A redacted record does not mean the domain is hiding something. It is simply the default today. The technical fields — dates, status, name servers, network ranges — are still published in full. ## Typical uses * **Is this domain new?** A `Created` date from a few days ago, combined with a message pushing you to act fast, is a classic scam signal. * **Who runs this IP range?** Check `NetName` and the organisation entry to see whether an address belongs to a home ISP, a hosting company or a cloud provider. * **Where do I report abuse?** Use the abuse contact in the IP record. * **Is my domain about to expire?** Check the `Expires` date. * **Are my name servers what I think they are?** Compare the `Name Servers` field with what you configured. ### When a lookup returns nothing Some less common top-level domains publish no Whois or RDAP data at all, and a few registries rate-limit queries. If you get an error, wait a moment and try again, or try the domain's registry website directly. ## What to do next * See who announces an IP on the global routing table with [ASN Info & Upstream Topology](/knowledge-base/lookup-privacy/asn-info.md). * Check what a domain resolves to around the world with the [DNS Resolver](/knowledge-base/lookup-privacy/dns-resolver.md). * Learn what the network numbers mean in [What Is an ASN?](/knowledge-base/concepts/what-is-an-asn.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.ipcheck.ing/knowledge-base/lookup-privacy/whois-search.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.