Glossary term
WHOIS
WHOIS is the query system and the registration records that say who holds a domain name or block of IP addresses and when it was registered.
What WHOIS means
WHOIS is the long-standing system for looking up registration information about internet resources — primarily domain names and blocks of IP addresses. The name is a play on the question "who is" responsible for a resource, and a WHOIS query returns the registration record: who registered it, through which registrar or registry, when it was created, when it expires, and which name servers or contacts are associated with it. WHOIS is both a protocol for asking the question and, colloquially, the body of records it returns.
For domain names, the records sit in a layered system. A registry operates each top-level domain and holds authoritative data about every domain under it. A registrar is the accredited business through which a registrant actually buys and manages a domain. The registrant is the person or organization that holds it. A WHOIS lookup for a domain typically reveals the sponsoring registrar, the creation and expiration dates, the domain's status codes, and the name servers it delegates to — the latter being the bridge from registration data into the live DNS.
For IP addresses, WHOIS is operated by the Regional Internet Registries — ARIN, RIPE NCC, APNIC, LACNIC, and AFRINIC — and the records describe address allocations rather than domains. An IP WHOIS query shows which organization holds a range of addresses, the Autonomous System Number associated with it, the registry that made the allocation, and administrative and abuse contacts. This is how an analyst moves from a raw IP address to the organization responsible for it and the abuse address to notify when something goes wrong.
WHOIS data is central to a wide range of investigative work. Security researchers use it to cluster malicious infrastructure by shared registration details, to estimate the age of a domain (newly registered domains are statistically riskier), and to find the right party to contact about abuse. Brand-protection teams use it to detect look-alike domain registrations. Network operators use IP WHOIS to identify who holds neighboring address space and who to reach during a routing incident. The creation date alone is a meaningful risk signal: a domain registered hours before it starts sending email behaves very differently from one that has been stable for a decade.
The WHOIS landscape has changed substantially. Privacy regulation, most prominently the European Union's General Data Protection Regulation, led registries and registrars to redact personal contact details from public domain WHOIS responses. Where a record once exposed a registrant's name, address, and email, many now show redacted fields or a privacy-service placeholder. This protects individuals but reduces the investigative value of public domain WHOIS, pushing some lookups toward the newer Registration Data Access Protocol (RDAP), a structured, access-controlled successor designed to replace the older free-text WHOIS protocol with consistent JSON responses and tiered access. IP WHOIS, which describes organizational allocations rather than individuals, remained comparatively rich because it is less likely to expose personal data.
A practical caution is that WHOIS data is self-reported at registration and is not continuously verified, so fields can be stale or deliberately false; the dates and the sponsoring registrar are more reliable than free-text contact details. Reading WHOIS well means weighing which fields are trustworthy and corroborating them against live DNS and routing observations.
Whisper Canon connects WHOIS-derived facts to the rest of the infrastructure graph. Registrar pages and the records attached to hostnames and IP allocations let an analyst move fluidly from a registration fact — who holds this, who accredited it, when did it appear — to the live behavior of the resource in DNS and routing. WHOIS supplies the provenance layer; the rest of the directory supplies the behavioral layer, and the two together tell a far more complete story than either alone.
Examples in Whisper Canon
Concrete pages in the directory that illustrate WHOIS.