01
DOMAIN INPUT
Enter domain name
WHOIS Lookup
Get detailed domain registration information
HOW IT WORKS
WHOIS lookup process
02
WHOIS QUERY
Query WHOIS servers
03
DATA PARSING
Parse registration data
04
REPORT
Display detailed info
WHOIS After GDPR: What's Left to See
WHOIS used to be the world's biggest open phonebook for domain owners. Names, emails, phone numbers, mailing addresses, all queryable for free over a 1980s-era TCP protocol. Then GDPR took effect on May 25 2018 and most of that data went dark. Six years later, WHOIS is still the primary tool for domain research, drop-catching, fraud investigation, and registrar accountability. It just shows different things now. The protocol itself is still RFC 3912, plain TCP on port 43, no schema, no JSON. Each TLD operator runs their own server, returns text in their own format, and there's no standard for parsing it. RDAP (the JSON-over-HTTPS replacement specified in 2015) has partial adoption: most gTLDs serve it, half of ccTLDs ignore it, tooling lags both protocols. Sections below: how WHOIS routing actually works, what GDPR redacted versus what survived, and what the data is still good for when most of it says REDACTED FOR PRIVACY.
How a WHOIS Query Actually Routes
The first WHOIS query goes nowhere useful by default. You query whois.iana.org. IANA returns a referral pointing to the actual WHOIS server for that TLD: `whois.verisign-grs.com` for .com/.net, `whois.nic.io` for .io, `whois.tcinet.ru` for .ru. Your client follows the referral and queries the second server. Verisign's response for .com is itself thin: the registrar that owns the domain, plus a referral to that registrar's WHOIS server. So a complete .com lookup is three sequential TCP-43 queries: IANA, Verisign, registrar (whois.namecheap.com or whois.godaddy.com). Each registrar formats their output differently. ccTLD behavior diverges. .ru hits whois.tcinet.ru directly, no per-registrar redirect, returns everything in one query. .uk's Nominet server returns full data. .de's DENIC redacted everything in 2018, and the response is now around 10 lines of registry metadata. .fr's AFNIC follows GDPR strictly, redacts personal but shows organizational data. The lack of a structured response is genuinely a problem. Every WHOIS parser in production is some combination of regex, registrar-specific templates, and fallback heuristics. New TLDs ship new formats. Old registrars change formats without notice. Library maintenance for python-whois, go-whois, ruby-whois consists largely of "format X broke again, here's the patch". RDAP fixes this by returning JSON. The IETF specified it in 2015 (RFCs 7480-7484). ICANN mandated RDAP support for all gTLDs by 2025. Most gTLD registries comply. Most ccTLDs don't. The response is structured, machine-parseable, and bounded by a documented schema. The catch: the data RDAP returns post-GDPR is the same data a parsed WHOIS response returns. Redaction lives at the data layer, not the protocol.
What GDPR Removed and What It Kept
May 25, 2018 was the day WHOIS lost most of its personal data. ICANN's Temporary Specification, then the 2019 EPDP Phase 1 outputs, formalized the rules. EU data subjects' personal information must be redacted unless there's a documented legitimate interest. Most registrars apply redaction globally because separating EU from non-EU registrants per query is harder than just redacting everyone. What you used to see on a personal domain registration: - Registrant name - Registrant email - Registrant phone - Registrant street address - Same fields for admin and tech contacts (often identical to registrant) What you see now: - "REDACTED FOR PRIVACY" or empty fields - A registrar-controlled forwarding email like proxy-1234@privacyguard.org (some registrars), or just nothing (others) What survived redaction: - Registrar of record (always visible) - Creation date (always visible) - Expiration date (always visible) - Last update timestamp (always visible) - Name servers (always visible) - DNSSEC status (always visible) - Domain status codes: clientHold, serverTransferProhibited, redemptionPeriod, pendingDelete (always visible) - Organization name, sometimes. Corporate domains often keep this; on .com/.net it depends on registrar policy The hidden contact data isn't actually deleted. Registrars hold it, ICANN can compel disclosure under formal requests, law enforcement can subpoena it. ICANN's SSAD framework was supposed to standardize disclosure for legitimate researchers (trademark holders, security researchers, abuse investigators) by 2020. It's 2026 and SSAD is on indefinite delay. Real-world disclosure happens through informal registrar relationships and legal process. For pre-GDPR data, paid services like DomainTools and WhoisXML maintain historical archives. They harvested everything before May 2018 and serve queries against the snapshot. This is how phishing investigators trace domain campaigns from 2014. The modern WHOIS shows REDACTED, the archive shows the original registrant. Privacy advocates argue this is a permanent record violating the spirit of GDPR. The archives are legal where they're stored. The data they hold isn't going to disappear.
What WHOIS Is Still Good For
The fields that survived GDPR carry most of the practical signal anyway. Domain age is the single most predictive feature for scam-site detection. Phishing campaigns register fresh domains for each campaign because old domains accumulate reputation. A .com registered 8 days ago that's serving a "PayPal login" page is almost certainly malicious. Browsers, antiviruses, and corporate filters all check creation date. The Spamhaus dataset shows domains under 30 days old are 50x more likely to be malicious than domains over a year old. Registrar choice tells you about risk environment. Namecheap, Tucows, GoDaddy, Hostinger, Cloudflare, and the budget Chinese registrars all have different abuse-handling reputations. Phishing campaigns gravitate toward registrars with weak abuse desks. A domain at Namesilo or NameCheap doesn't mean fraud, but a domain at AlpNames (defunct, was a known abuse haven before takedown) used to mean it. Name servers reveal infrastructure. Shared name servers can connect sister domains: if attacker.com and victim-cdn.net both point to ns1.evilhost.tld, they're related. This was a major OPSEC failure in early ransomware campaigns. Modern operators use Cloudflare or registrar-default name servers to blend in. Status codes carry incident signals. clientHold means the registrar suspended the domain (often for abuse). serverTransferProhibited is normal protection. redemptionPeriod means the domain expired and is in the 30-day recovery window. pendingDelete means it's about to drop and become available. Drop-catching services watch pendingDelete states and race to register the moment release fires. Same logic as taxi drivers queuing outside an airport: first to claim gets the fare. DNSSEC presence amounts to a weak security indicator. Adoption sits around 7-8% globally as of 2024. Most legitimate businesses don't bother. Most attackers don't bother. The signal is noisy but not zero. WHOIS in 2026 is what survived a major regulatory cleanup. The personal data is gone for most domains. The infrastructure data (registration timing, registrar, name servers, status) is as visible as ever, and that's the data most use cases actually need. The privacy-vs-transparency debate that ICANN spent a decade losing ended up removing the part of WHOIS that was always more useful for spam-list harvesting than for legitimate research. The WHOIS lookup in WHOX queries the appropriate registry directly, follows registrar referrals where applicable, parses both classic WHOIS and RDAP responses, and surfaces the fields that still mean something in a post-GDPR world.
FREQUENTLY ASKED QUESTIONS
What is WHOIS privacy?
WHOIS privacy (also called domain privacy or proxy protection) replaces your personal contact information in WHOIS records with that of a privacy service. This protects you from spam, identity theft, and unwanted solicitations. Most registrars offer this service for free or a small fee.
Why is some information hidden?
Due to GDPR and other privacy regulations, many registrars now redact personal information from WHOIS by default, especially for domains registered by individuals in the EU. You may see 'REDACTED FOR PRIVACY' in registrant fields.
How accurate is WHOIS data?
WHOIS data accuracy depends on the registrant. While registrars require valid contact information, some domain owners provide inaccurate data. Additionally, WHOIS data is cached and may not reflect recent changes. Our service caches results for 48 hours.
All our tests
Run the full WHOX toolkit from one place: leak checks, fingerprint probes, network diagnostics, reputation lookups, and privacy failure tests.