WHOIS lookup

Look up the WHOIS record of any domain name, IP address or ASN: registrar, registration and expiry dates, status, name servers and network owner. Results come live from the official RDAP servers of each registry.

{
  "ok": true,
  "query": "9.9.9.9",
  "type": "ip",
  "registered": true,
  "handle": "NET-9-9-9-0-1",
  "status": [
    "active"
  ],
  "events": {
    "last_changed": "2025-10-21T15:27:59-04:00",
    "registration": "2017-09-13T14:00:44-04:00"
  },
  "rdap_url": "https://rdap.arin.net/registry/ip/9.9.9.9",
  "name": "CLEAN-97",
  "range": "9.9.9.0 - 9.9.9.255",
  "cidr": [
    "9.9.9.0/24"
  ],
  "country": null,
  "allocation_type": "DIRECT ALLOCATION",
  "parent": "NET-9-0-0-0-0",
  "organization": "Quad9",
  "abuse_email": "abuse@quad9.net",
  "registry": "arin.net"
}

What a WHOIS lookup tells you

Every domain name and every block of IP addresses on the internet is registered to someone, and the registry keeps a public record of that registration. A WHOIS lookup reads that record. For a domain you get the registrar it was bought through, the date it was first registered, when the current registration expires, when it last changed, its status codes and the name servers that answer DNS for it. For an IP address you get the network block it belongs to, the organisation it is allocated to, the regional registry that manages it and an abuse contact for reporting spam or attacks. For an ASN (autonomous system number such as AS13335) you get the network operator behind it.

How FernTool looks it up: RDAP

The original WHOIS protocol dates from the 1980s: plain text over port 43, a different format at every registry and no reliable way to know which server to ask. Its replacement, RDAP (Registration Data Access Protocol, RFC 9082/9083), returns structured JSON over HTTPS. ICANN made RDAP the authoritative source for generic top-level domains like .com, .net and .org, and all five regional internet registries serve RDAP for IP addresses and ASNs. FernTool uses the RDAP bootstrap registry to find the right server for your query, fetches the record and turns it into a short, readable summary. The raw JSON is always one click away.

Reading the domain status codes

• client transfer prohibited: the registrar has locked the domain against transfer. This is normal and protects against hijacking.
• client delete / update / renew prohibited: further registrar locks. Many registrars set all of them by default.
• server … prohibited: a lock set by the registry itself, often on high-value names.
• redemption period or pending delete: the domain has expired and is on its way to being released.
• active or ok: no restrictions.

Why owner details are usually hidden

Before 2018 a WHOIS record often listed the owner’s name, email, phone and postal address. Privacy law, in particular the EU’s GDPR, ended that for most domains: registrars now redact personal data, or replace it with a privacy service. Organisations sometimes still publish their company name. If you need to reach a domain owner, use the registrar’s contact or abuse address shown in the result. For IP addresses the network owner is normally a company (an ISP, cloud provider or hosting company), so the organisation name is still shown.

Common uses

• Checking a domain before you buy it: if RDAP has no record, the name is probably unregistered.
• Tracking renewal dates for your own or your clients’ domains, and spotting domains about to expire.
• Investigating abuse: find the abuse contact for an IP that is scanning or spamming you, then check it with the IP lookup to see whether it is a VPN, Tor exit or datacenter.
• Troubleshooting DNS: confirm which name servers the registry has, then compare them with what the DNS lookup returns.

Frequently asked questions

What is a WHOIS lookup?

A WHOIS lookup shows the public registration record for a domain name, IP address block or autonomous system: who the registrar or network owner is, when it was registered and when it expires, plus its name servers and abuse contact.

What is RDAP and how is it different from WHOIS?

RDAP (Registration Data Access Protocol) is the modern replacement for the old WHOIS text protocol. It returns structured JSON over HTTPS, supports internationalised names and is now the official source for gTLD registration data. FernTool queries RDAP and shows the result in a readable WHOIS-style format.

Why is the domain owner’s name hidden?

Since GDPR (2018), registrars redact personal details of individual registrants. You usually see the registrar, dates, status and name servers, but not the owner’s name, email or address. To contact an owner, use the registrar’s contact form or abuse address.

How do I find out when a domain expires?

Enter the domain above. The “Expires” field is the date the current registration period ends. Most domains auto-renew, and after expiry there is normally a grace and redemption period of up to about 75 days before the name is released.

Can I look up who owns an IP address?

Yes. Enter an IPv4 or IPv6 address and FernTool asks the regional internet registry (ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC) responsible for it. You’ll see the network name, address range, owning organisation and abuse contact.

More network tools

• DNS lookup (A, AAAA, MX, TXT, NS, CNAME, SOA)
• Reverse DNS (PTR) lookup
• Subnet calculator (IPv4 & IPv6 CIDR)
• IP lookup with VPN/Tor/datacenter check
• What is my IP address?

API: GET /api/whois/{domain|ip|asn} · MCP tool whois_lookup. Data from each registry’s RDAP service, found via the IANA RDAP bootstrap (fallback: rdap.org).