GDE-068 |
WHOIS domain lookup | |||||||
Digital infrastructure | ||||||||
October 2026 | ||||||||
01
What it is
A WHOIS lookup is a query of the public registration record for a domain name, returning its registrar, key dates, name servers and any contact details that have not been redacted. Investigators use it to establish when a site was set up, through which company, and which other domains share its details.
WHOIS is the protocol that served these records for decades. For generic top-level domains such as .com and .org, ICANN made its successor, the Registration Data Access Protocol (RDAP), the definitive source on 28 January 2025, so most WHOIS lookups now run over RDAP. The record still answers the same questions: who sold the domain, when it was created, when it last changed and where its traffic points.
Since May 2018, ICANN rules introduced for the EU General Data Protection Regulation have hidden most registrants' personal details from public view. The registrar, dates and name servers stay visible, and they are often enough to start. Journalists, fraud researchers and due diligence teams all work from them.
| When to use this guide
|
02
How do you run a WHOIS lookup and trace who registered a domain?
Six tools and seven steps take you from a single domain name to a documented registration history.
Five of the six tools work without an account, and the sixth offers free credits after registration.
ICANN Lookup: Free, no login. ICANN's RDAP-based lookup returns a domain's current registrar, creation and expiry dates, status codes and name servers.
IANA Root Zone Database: Free, no login. Lists the organisation that manages every top-level domain, including country codes such as .uk, with its registration services and RDAP server where one is published.
ViewDNS.info: Free, no login for the web tools. Its reverse WHOIS search finds other domains registered with the same email address or name, alongside IP history and DNS lookups.
crt.sh: Free, no login. Searches certificate transparency logs for the TLS certificates issued to a domain, with issue dates and the subdomains each certificate names.
Wayback Machine: Free, no login to search. The Internet Archive's captures show what a site displayed on earlier dates, including contact, imprint and terms pages that can name an operator.
WhoisXML API WHOIS History: Free and paid tiers, registration required. Archives historical WHOIS records, the oldest often from 2010, before the 2018 redactions. The web lookup shows the three most recent records.
| Before you begin Stop at the login. ICANN Lookup, the IANA database, ViewDNS.info, crt.sh and the Wayback Machine need no account. WhoisXML API needs registration, so use a dedicated research identity rather than a personal login. Legal considerations. Historical registration records can hold names, addresses and phone numbers, so treat them as personal data under the GDPR and UK GDPR and keep only what the investigation needs. Requests for redacted data go to the registrar, or through ICANN's Registration Data Request Service, and need a stated legitimate interest. |
Strip subdomains, paths and tracking parameters back to the registered name. Record the original link, where and when you found it, and any redirect it passed through.
Enter the domain in ICANN Lookup and record the registrar and its IANA ID, the creation, update and expiry dates, the status codes and the name servers. Redacted contact fields are normal. The dates and the registrar are the evidence.
Country-code domains such as .uk and .de set their own rules on what is published. Look up the TLD in the IANA Root Zone Database to find its registry, then query that registry's own lookup or RDAP server, such as Nominet for .uk.
Run the domain through WhoisXML API WHOIS History and compare each record: registrant organisation, email, registrar and name servers. A change of registrant or name servers close to a key event is a lead to record, not a conclusion.
Search any unredacted email address, name or organisation from the history in ViewDNS.info reverse WHOIS. Treat every hit as a candidate and confirm it with a second shared attribute, such as the same name servers or a matching registration date.
Search crt.sh for the domain to see when certificates were first issued and which subdomains they named. Then check the Wayback Machine for the earliest capture and any page that names an operator.
Separate facts from the registry, facts from third-party archives and what remains unknown. A WHOIS lookup shows who registered a domain and through which registrar, not who runs the site today, so grade any attribution with a confidence tier.
|
03
Where a WHOIS lookup misleads an investigation
Most errors come from reading a privacy service, a registrar or a date as more than the record shows.
Privacy service read as the registrant: Many records list a privacy or proxy service instead of the registrant, and that service sits on huge numbers of unrelated domains. Sharing it links nothing. Verifying check: link domains only on details unique to the registrant, such as an email address, and confirm with a second shared attribute.
Registrar or host read as the operator: The registrar sold the domain and the host serves its files, but neither runs the site. Abuse contacts in the record belong to those companies, not the owner. Verifying check: name the registrant separately and cite the record field each fact came from.
Updated date read as the creation date: The updated date changes with renewals, transfers and routine registrar edits. Verifying check: take the age from the creation date and confirm it against the earliest certificate and Wayback capture.
Re-registered domain read as continuous: A domain that expires can be bought by someone new and keep its name, inbound links and search history. Verifying check: look in WHOIS history for a gap, a new creation date or a change of registrar, and compare the site content either side of it.
Old reverse WHOIS hit read as current ownership: Reverse WHOIS matches historical records, so a domain in the results may have changed hands since. Verifying check: confirm the current registration in ICANN Lookup before you connect it to your subject.
Chain of custody: Registration records change on renewal, transfer and expiry, and archives can revise what they hold. Keep a dated record of every lookup so an editor or court can repeat it.
Save the full RDAP or WHOIS output as text with the query date and time
Screenshot each lookup with the domain, tool name and date visible
Label every historical record with its source, keeping registry data apart from third-party archives
Archive the website and its contact pages before you make contact or publish
Hash saved files and log each hash in the case notes
Note every redacted field and any request you made for it
04
Go deeper
Two reference cards and one Methods tutorial for a full infrastructure investigation.
CARD · DIG-001
WHOIS investigation: from domain name to attribution chain
ViewDNS, SecurityTrails and crt.sh, pivoted from a registrant email to mapped domain infrastructure.
CARD · DIG-002 · SIGNAL TIER
Geolocate, fingerprint and attribute IP infrastructure
IPinfo, Shodan and BGP.tools, taken from an IP address to cross-referenced, hashed documentation.
METHODS · T35 · SIGNAL TIER
Website infrastructure analysis: WHOIS, DNS and SSL
WHOIS, DNS history, certificate transparency and BuiltWith, mapped to ownership and hosting history.
Evidentiary standard
Signal & Shadow operates to the LST-001 evidentiary standard. All claims are graded against the LST-001 v1.0.3 confidence tiers (Confirmed, Corroborated, Reported, Alleged) per the canonical voice and structural specification.
About Signal & Shadow
Signal & Shadow is an independent forensic investigation and methodology practice publishing tutorials, reference cards, and forensic dossiers for working practitioners. Founded by Derek Bowler.