What it is
WHOIS (pronounced “who is”) is a public lookup for domain names. Type a domain, and WHOIS tells you who owns it (or their registrar/proxy), when it was registered, when it expires, and where it’s hosted. It’s like a phone book for websites.
Why it matters
WHOIS helps you spot sketchy sites and solve simple web mysteries. New domain with hidden ownership and lots of complaints? Be careful. Legit sites usually have consistent details that match their brand.
How it works
-
Query: you enter a domain in a WHOIS tool.
-
Records: the service returns owner/registrar, dates, name servers, and status.
-
Privacy: many owners use privacy/proxy services, so you’ll see the proxy instead of a person.
-
Clues: dates, registrar, and DNS can hint whether a site is established or throwaway.
Red flags
-
Domain registered very recently for a site asking for payments or logins.
-
Owner info hidden and other signs look off (typos, look-alike brand name).
-
Frequent changes to registrar or name servers in a short time.
-
Domain expires soon but claims to be a major brand.
Do it right
-
Check WHOIS before trusting a new shop or download site.
-
Compare details with the brand’s official info (support pages, socials).
-
Treat proxy/hidden ownership as a signal, not proof—look at the full picture.
-
If it seems risky, don’t enter passwords or card details; find a verified alternative.
WHOIS and RDAP today
RDAP is the structured protocol designed to replace traditional WHOIS queries. Modern lookup services may still use the word WHOIS, but return RDAP data. Privacy law, proxy services, and registry policy can redact a registrant's personal details, so missing contact information is normal and is not evidence of fraud.
Use registration data as context
- Confirm the registrar, creation and expiry dates, domain status, and authoritative name servers.
- Compare unexpected changes with DNS history, certificate information, and the site's stated organization.
- Treat a very new registration as one risk signal, not a verdict.
- Remember that criminals can register old-looking domains and legitimate projects can use new ones.
A lookup does not verify site ownership, content, or safety. Combine it with direct contact details, technical evidence, and the site's broader digital footprint.