Registry Intelligence Engine
Direct-to-Registry WHOIS and RDAP interrogation. Query ownership forensics, EPP statuses, and infrastructure metadata.
WHOIS Lookup Analytics
Retrieve ownership metadata, registration timelines, and authoritative registrar details. Powered by modern RDAP (Registration Data Access Protocol) architecture.
WHOIS and RDAP: The Digital Pedigree of a Domain
A WHOIS lookup is the process of querying a database to find out who is responsible for a domain name or an IP address resource. In the early days of the internet, this information was public and exhaustive, listing the home address and phone number of the registrant. Today, due to privacy regulations like GDPR, the landscape has shifted toward the more structured and secure RDAP (Registration Data Access Protocol).
1. The Evolution: From Port 43 to HTTP/JSON
Legacy WHOIS operates on Port 43 and returns human-readable but machine-difficult text blocks. Because every registry format was different, parsing WHOIS data effectively was a nightmare for engineers.
RDAP solves this by using a RESTful API over HTTPS, returning data in structured JSON format. It allows for better internationalization, secure access controls, and a standardized way to query for "events" (like registration, expiration, and last transfer).
The GDPR Impact: WHOIS Redaction
Since May 2018, most registrars redact personal contact information by default. While this protects individual privacy, it makes cyber-investigations harder. Investigators now rely on "Proxy" email addresses or legal request mechanisms to contact domain owners.
2. Decoding Domain Status Codes
When analyzing a WHOIS record, you will see several status codes (EPP codes). These define the "locks" placed on the domain:
- clientTransferProhibited: The "Domain Lock." Prevents unauthorized transfer to another registrar. Highly recommended for all domains.
- clientHold: A dangerous status. It means the domain is suspended (often for non-payment or abuse) and will no longer resolve in DNS.
- addPeriod: The first 5 days after a domain is registered. Often used by "domain tasters" to see if a domain has value before committing to the purchase.
- redemptionPeriod: The domain has expired and is in its final phase before being deleted and returned to the open market.
3. Infrastructure Tracing: Who is the Registrar?
The Registrar is the company that sold the domain (e.g., MarkMonitor for large corporations, or generic retailers for individuals). The Registry is the entity that manages the entire TLD (e.g., Verisign manages .com).
Identifying the registrar is the first step in filing an abuse complaint or initiating a legal takeover during a domain dispute.
Professional Insight: Spotting Malicious Domains
Security engineers look for "Domain Age" during phishing analysis. A domain claiming to be `secure-bank-login.com` that was registered 2 hours ago is a 99.9% indicator of a phishing attempt. Legitimate financial institutions rarely register new domains for core services.
Frequently Asked Questions
Q: What is a WHOIS "Privacy Protection" service?
A: It is a service where the registrar's info (or a proxy firm's info) is listed instead of yours. Note that under RDAP and GDPR, this is now often included for free and automatically by most registrars.
Q: Can I lookup who owns an IP address?
A: Yes. IP addresses are managed by RIRs (Regional Internet Registries) like ARIN, RIPE, or APNIC. Querying an IP via RDAP will show the ISP or organization that was allocated that block.
Q: Why does it say "No Data Found" for some TLDs?
A: Not all TLD registries support RDAP yet, and some have proprietary lookup systems. This is especially common with certain ccTLDs (Country Code Top Level Domains).
Analysis conducted using RFC 7480, 7481, and 9083 (RDAP standards). Metadata extraction is subject to registry-specific redaction policies. Generated for the PingDo Infrastructure Learning Series.
Protocol Evolution: From Port 43 to RESTful RDAP
The legacy WHOIS protocol (RFC 3912) is remarkably simple—and technically flawed by modern standards. It operates over TCP on Port 43, sending a plain-text query and receiving an unstructured, non-standardized text block. This lack of structure necessitates complex Regular Expression (Regex) parsers to extract basic data like expiration dates or name servers, which vary per registry.
Legacy WHOIS (Port 43)
- TCP-only, no authentication mechanism.
- Unstructured ASCII text payload.
- No support for international characters (IDN complications).
Modern RDAP (RFC 7480)
- HTTP/S based, allowing for TLS encryption.
- JSON-based structured data responses.
- Native support for authenticated "Tiered Access."
RDAP solves the "Parser Fragility Problem" by providing a machine-readable schema. For example, instead of searching for the string "Expiry Date:" or "Expiration Time:", an RDAP response provides a deterministic JSON key:
{
"events": [
{
"eventAction": "expiration",
"eventDate": "2027-04-12T18:30:00Z"
}
],
"status": ["clientTransferProhibited", "active"],
"objectClassName": "domain"
}The Registry Hierarchy: Thick vs. Thin Architecture
Not all registries store data the same way. The distinction between Thick and Thin registries is critical for identifying the "Authoritative Source" of domain metadata.
Thin Registry (.com, .net)
In a thin registry, the central registry (e.g., Verisign) only stores technical operational data: Name Servers, Registrar information, and Status codes. To find the registrant's name or contact info, the WHOIS client must "refer" to the specific Registrar's (e.g., GoDaddy, Namecheap) WHOIS server.
Thick Registry (.org, .info, .me)
A thick registry stores all registration data centrally. A query to the registry WHOIS server returns the complete record, including administrative, billing, and technical contacts, in a single response cycle. This is generally preferred for data consistency.
EPP Status Forensics: The Domain Vital Signs
A domain's WHOIS record is effectively a real-time monitor of its legal and technical health. These states are communicated via EPP (Extensible Provisioning Protocol) status codes. Understanding these values is the difference between diagnosing a DNS outage and a legal seizure.
The Domain Lifecycle Timeline is mathematically predictable. For most gTLDs, the purging process follows a strict sequence governed by the central registry's chron job frequency:
Deterministic window of availability: typically 35–75 days post-expiry.
Professional "Drop Catchers" utilize the Renewal Probability Model to identify high-value targets. The probability of a domain being released to the public market is inversely proportional to its current Authority Score and the number of active Backorders :
Where \omega represents the registrar's retention motivation and \beta represents the secondary market demand.
Privacy Engineering: WHOIS in the GDPR Era
The "Great Redaction" of 2018 (triggered by GDPR) fundamentally altered the WHOIS landscape. Historically, WHOIS was a public phonebook. Now, it is a privacy-first directory with Redacted-by-Default policies for personal identifiers.
The Tiered Access Model
Anonymous access via Port 43 or RDAP. Displays non-personal metadata: TLD, Registrar, EPP Status, Creation/Expiry dates, and Name Servers. Identity fields are replaced with "REDACTED FOR PRIVACY" placeholders.
Accessed via RDAP OAuth2. Requires legitimate interest (law enforcement, trademark counsel, security researchers). Provides full access to Name, Email, Phone, and Address of the registrant.
Threat Intelligence: Pivot Point Analysis
For cybersecurity analysts, WHOIS data is a critical signal for Infrastructure Mapping. When a phishing domain is detected, the workflow involves "Pivoting" on specific registry indicators to uncover the attacker's broader network.
Registrar Clustering
Attackers often use "Bulletproof Registrars" known for ignoring abuse complaints. Identifying that multiple suspicious domains share a niche registrar allows for predictive blocking.
Creation Date Jitter
Legitimate enterprise domains are typically multiple years old. A cluster of domains registered within 5 minutes of each other (Creation Date Forensic) is a high-confidence signal for a DGA (Domain Generation Algorithm) or a malware campaign.
Registry Forensics Laboratory
Raw WHOIS Interrogation
$ whois -h whois.verisign-grs.com example.comQueries a specific registry host directly on Port 43, bypassing registrar referrals.
RDAP Curl Request
$ curl -H "Accept: application/rdap+json" https://rdap.verisign.com/com/v1/domain/example.comRetrieves structured, machine-parsable JSON data via the HTTPS REST API.
ASN Infrastructure Mapping
$ whois -h whois.radb.net 1.1.1.1Focuses on BGP route objects to identify the owner of the IP space rather than the domain.
PeeringDB Interrogation
$ curl https://www.peeringdb.com/api/net?asn=13335Accesses the "Whois of the IXPs" to discover peering points and network capacity metadata.
Registry Intelligence FAQ
Frequently Asked Questions
Protocols & Standards
Technical Standards & References
"You are our partner in accuracy. If you spot a discrepancy in calculations, a technical typo, or have a field insight to share, don't hesitate to reach out. Your expertise helps us maintain the highest standards of reliability."
Contributors are acknowledged in our technical updates.