WHOIS Lookup

What is WHOIS and How Does Domain Registration Work?

WHOIS (pronounced "who is") is a query-and-response protocol used to look up registration data for internet resources — primarily domain names. When someone registers a domain like example.com, their registrar submits the registration details to a global registry database maintained by ICANN (Internet Corporation for Assigned Names and Numbers) and the relevant registry operator (such as Verisign for .com domains). WHOIS allows anyone to query this database to retrieve that information.

Every domain registration includes mandatory data: the registrar's name, the domain's creation date, its expiration date, and the authoritative nameservers. Registrant contact details (name, email, phone, address) were historically public but are now often redacted under GDPR privacy protections for European registrants and voluntary privacy proxy services offered by most registrars.

The JumpTools WHOIS lookup tool queries the authoritative WHOIS servers for each domain's top-level domain (TLD) and returns both a structured summary and the raw server response. This eliminates the need to use command-line tools or pay for commercial WHOIS APIs to access basic domain registration data.

Domain Status Codes: What EPP Status Means

WHOIS results include one or more EPP (Extensible Provisioning Protocol) status codes that indicate the domain's current operational state. Understanding these codes is important for domain management and security monitoring:

clientTransferProhibited: The registrar has locked the domain against unauthorized transfers to another registrar. This is a security measure that should be enabled for all domains you own. A domain without this lock can be transferred away by an attacker who gains access to the registrar account.

clientDeleteProhibited: Prevents the domain from being deleted at the registrant level. Recommended for business-critical domains.

serverTransferProhibited: Set by the registry (not the registrar), this lock provides stronger transfer protection and is often applied to newly registered or recently transferred domains for a 60-day period (per ICANN policy).

pendingDelete: The domain has expired, the grace and redemption periods have passed, and the registry is about to release it for re-registration. Domains in this status are targeted by domain investors and may be snatched seconds after release.

redemptionPeriod: The domain is expired but within the 30-day redemption window where the original registrant can recover it, typically for a significant penalty fee ($100-$200). After this period, the domain enters pendingDelete.

Practical Uses of WHOIS Lookup

Domain acquisition research: Before purchasing a premium domain or approaching an owner for a sale, WHOIS data shows you who owns it, when it was registered (indicating investment intent), when it expires (potential drop-catching opportunity), and which registrar holds it.

Cybersecurity investigations: Security researchers and incident responders use WHOIS to investigate suspicious domains — identifying recently registered domains (a common indicator of phishing infrastructure), mapping domain portfolios to suspected threat actors by common registrant data, and correlating nameserver patterns across malicious domains.

Trademark and brand protection: Brand owners monitor WHOIS data to identify newly registered domains that incorporate their trademarks — potential cybersquatting, phishing, or brand impersonation attempts that require legal action through ICANN's UDRP (Uniform Domain-Name Dispute-Resolution Policy).

Technical troubleshooting: When DNS changes don't propagate as expected, WHOIS confirms which nameservers are authoritative for a domain. Mismatched nameserver records between WHOIS and the actual DNS response are a common source of configuration errors.