WHOIS Lookup
Look up domain WHOIS: registrar, registration and expiry dates, owner details where disclosed, nameservers, statuses. Clean unified output for gTLDs and ccTLDs.
About WHOIS lookup
WHOIS is the public registry record for a domain. It lists who registered the name, which registrar holds it, when it was first registered, when it was last updated and when it expires. Modern WHOIS output often redacts owner details for privacy, but the registrar, dates, nameservers and status flags remain.
What you'll see
- Registrar where the domain is registered (GoDaddy, Cloudflare, Porkbun, etc.).
- Created / Updated / Expires dates from the registry.
- Nameservers currently authoritative for the zone.
- Status flags such as
clientTransferProhibited(registrar lock) orpendingDelete.
When it's useful
- Checking if a domain is about to expire and can be acquired.
- Seeing which registrar a target uses, e.g. during phishing investigations.
- Confirming a zone is using the expected nameservers after a DNS migration.
How it works
WHOIS is a simple query protocol: a client opens a connection to the WHOIS server that is responsible for the top-level domain, sends the domain name and receives a block of text. Each registry decides what that text contains and how it is laid out, so the raw output differs between extensions. NetSight sends the query to the appropriate server for the TLD, reads the answer and maps it onto one common set of fields, so you do not have to interpret each format yourself.
Two levels of data exist. A registry holds the authoritative record for the domain itself, with dates, status flags and nameservers. The registrar that manages the domain may add details such as the sponsoring registrar name. Which fields are filled depends on what the responsible server publishes. Fields that are empty in the source are simply left out of the result instead of being shown with a placeholder.
Enter the bare domain, for example example.com. A full URL, a path or a hostname with a subdomain is not a registered domain, and the registration data always belongs to the registrable domain.
How to read the results
Registration
- Registrar: the company through which the domain is managed. It is the contact for transfers, renewals and abuse reports about the domain.
- Created: the date of the first registration. A very recent date is not a problem in itself, but for a domain that appears in a phishing or spam report it is a useful hint, because such domains are often only days or weeks old.
- Updated: the last change of the registry record, for example new nameservers or a status change. It is not the date of the last change inside the DNS zone.
- Expires: the end of the current registration period. The badge at the top counts the remaining days: red below 30 days, orange below 90 days, green above that. An expiry date in the past does not always mean the domain is gone, because most registries add a grace period before it is deleted.
- Registrant: the holder, shown only if the registry publishes it. Many records show a redacted or privacy placeholder instead, which is normal and not a sign of anything suspicious.
Nameservers
These are the servers the registry points to for the domain. They should be the same hosts you see in the NS records of a DNS lookup. If the two lists differ, a delegation change has not finished or the zone is configured at a different place than you expect.
Status flags
clientTransferProhibited,clientDeleteProhibited,clientUpdateProhibited: locks set by the registrar or holder. They protect against unwanted transfers and changes and are a good sign.serverTransferProhibitedand similar server flags: locks set by the registry itself.okoractive: no special restrictions apply.clientHoldorserverHold: the domain is not published in DNS. Websites and mail under it stop working.redemptionPeriodandpendingDelete: the domain has expired and is in the final phase before it is released.
Examples
Example 1: checking a domain you want to buy
Enter example.com. If the expiry date lies years ahead and the status shows transfer locks, the domain is actively held and renewed. A status of pendingDelete would mean it will be released soon, which is the only case where waiting makes sense.
Example 2: a suspicious link
For a domain from a suspicious message, compare the created date and the registrar. A creation date from the past few days together with privacy-redacted registrant data fits the pattern of throwaway domains, but it proves nothing alone. Use it as one signal next to the content of the message and the DNS records.
Example 3: after a DNS migration
You moved a zone to new nameservers and want to confirm the change. The Nameservers card should now list the new hosts. If the old hosts are still listed, the change at the registrar was not saved or has not reached the registry yet. The Updated date should also have moved to the time of your change.
Common problems and how to fix them
- The lookup returns an error. Check that you entered only the domain without protocol or path. Some registries limit the number of queries per address, so a second attempt after a short wait often works.
- Almost no fields are shown. Some country-code registries publish only a few fields, such as the status and nameservers. This comes from the registry and is not an error of the tool.
- Registrant is missing. The holder data is redacted or hidden by the registry or by a privacy service. To contact the owner, use the abuse or contact channel of the registrar.
- Dates look off by one day. The dates are shown in your local time zone, while the registry stores them in UTC.
- The domain is about to expire. Renew it at the registrar before the end date. After expiry most registries allow a limited redemption period, but this is usually more expensive and not guaranteed.