WHOIS Lookup

What it does

WHOIS Lookup queries the registry and registrar databases to retrieve the public registration record for a domain name. It returns the registrar of record, creation and expiration dates, last update timestamp, registration status codes, the authoritative nameservers, and — where not redacted by privacy services or GDPR — the registrant, admin, and technical contact information. To go beyond ownership and inspect the live setup, run DNS Lookup for full record types, MX Lookup for mail config, and SSL Certificate Checker for certificate validity.

When to use it

• Verifying that a domain you intend to buy is actually expiring soon and not just listed as available by a broker.
• Confirming the registrar of a domain before initiating a transfer so you know which platform's auth-code process to follow.
• Checking the expiration date of your own domains across multiple registrars in a single audit.
• Investigating a phishing or impersonation domain to identify its registrar for an abuse report. Cross-reference the IP of the domain with IP Lookup and IP Blacklist Check.
• Reading the registration status codes to determine why a transfer or update is being rejected.

How to read the results

The registrar is the company managing the domain on behalf of the registrant — distinct from the host or DNS provider. Status codes (clientTransferProhibited, serverHold, pendingDelete, etc.) describe locks and lifecycle states; ok means no restrictions. Most TLDs include a grace period and a redemption period after expiry. Redacted contact data is normal for most generic TLDs since GDPR — that's by design, not a sign of suspicious activity. WHOIS only describes the domain registration. To identify the host, follow the nameservers via DNS Lookup and the A records out to a real IP via IP Lookup.

Common mistakes

• Trusting the "Updated Date" as evidence the registrant changed — it updates on any change, including auto-renewal.
• Assuming a redacted WHOIS record is anonymous; the registrar still holds the underlying data and can act on legal requests.
• Reading clientTransferProhibited as a registry-imposed lock; it's a registrar-set status the owner can remove from the dashboard.
• Confusing domain expiry (here in WHOIS) with certificate expiry (in SSL Certificate Checker) — they're independent.
• Looking at WHOIS to determine where a site is hosted — WHOIS describes domain registration, not hosting; for that, follow the nameservers via DNS Checker.

# curl — JSON response (default)
curl https://internettimes.com:80/api/v1/whois-lookup/example.com \
  -H "Authorization: Bearer YOUR_API_KEY"

# Markdown response — ingest-friendly for agents
curl "https://internettimes.com:80/api/v1/whois-lookup/example.com?format=md" \
  -H "Authorization: Bearer YOUR_API_KEY"