Advanced WHOIS / RDAP Lookup

Find structured registration data for any domain, IP address, or ASN.

IP & DNS Lookup WHOIS / RDAP Lookup

Enter a Domain, IP, or ASN

Understanding the RDAP Results

Learn what the data means and why it matters.

What is RDAP?

The Registration Data Access Protocol (RDAP) is the modern successor to the old WHOIS protocol. Instead of returning difficult-to-read plain text, RDAP provides data in a standardized, machine-readable JSON format. This allows for cleaner, more reliable, and more secure access to domain and network registration information.

Common Terms

Registrar: The organization that manages the registration of the domain name (e.g., GoDaddy, Namecheap, Cloudflare).
Registrant: The individual or organization that has registered the domain name. For privacy reasons, this information is often redacted.
Domain Status: These codes indicate the status of a domain. For example, clientTransferProhibited is a common status that prevents unauthorized transfers, acting as a security lock.
Nameservers (NS): The servers that translate a domain name (like example.com) into an IP address. They are a critical part of the Domain Name System (DNS).

A Note on Privacy

You will often see contact information listed as "Redacted for Privacy" or similar. This is a feature, not an error. Due to privacy regulations like GDPR, registrars now offer services that shield the owner's personal information from the public WHOIS/RDAP record to prevent spam and protect their identity.

WHOIS and RDAP: what changed

WHOIS is one of the oldest services on the internet, and it shows. Every registry answered in its own free-form text layout, which meant anything reading the results had to guess at the structure. RDAP — the Registration Data Access Protocol — is its replacement: same underlying records, returned as structured, consistently labelled data over HTTPS.

This tool queries RDAP where it is available and falls back to WHOIS where it is not, then presents whatever comes back in a single readable layout. It works for domains, IPv4 and IPv6 addresses, and autonomous system numbers.

The fields worth reading first

Creation date. This is the single most useful field on the page. Legitimate banks, retailers and couriers have held their domains for years, often decades. Fraudulent sites are disposable — registered in bulk, used for a few weeks until blocklists catch up, then abandoned. A site asking for card details on a domain created eleven days ago has told you what you need to know.

Expiry date. Serious businesses register years ahead. A domain set to expire twelve months after it was created suggests nobody expects to still be using it.

Registrar. A supposed national postal service registered through a budget offshore reseller is worth a second look.

Name servers. If a domain claiming to be a major brand resolves through free hosting, the brand almost certainly has nothing to do with it.

Status codes. Values like clientTransferProhibited are normal protective locks. pendingDelete or redemptionPeriod mean the registration is lapsing.

Why contact details are usually hidden

Since GDPR, registrars redact personal contact information for most domains by default, and privacy services are both common and entirely legitimate. Redacted details are not evidence of anything on their own. What is unusual is a large, established company hiding behind a privacy shield on its primary commercial domain.

Looking up IP addresses and ASNs

Enter an IP address and you get the network allocation rather than a domain registration: which regional registry issued it, which organisation holds it, the CIDR range it belongs to, and the abuse contact for reporting problems. Enter an AS number and you get the network operator behind it. This is how you find out whether an address belongs to a residential ISP, a cloud provider or a hosting company — useful context when a log entry looks suspicious.

What a lookup will not tell you

Domain age is a strong signal, not a verdict. Criminals do buy aged domains, and legitimate new businesses exist. A recently created domain is a reason to stop and verify through a channel you already trust — not proof of fraud by itself. Registration data also says nothing about the content of a site, only about its paperwork.

Frequently asked questions

What is the difference between WHOIS and RDAP?

Both return domain and IP registration records. WHOIS returns free-form text that varies between registries, while RDAP returns structured, consistently labelled data over HTTPS. RDAP is the modern replacement and supports standardised access controls.

Why are the registrant's contact details hidden?

Since GDPR came into force, registrars redact personal contact data for most domains by default, and privacy protection services are widely used. Redacted details are normal and are not on their own a sign of anything suspicious.

How does domain age help me spot a scam site?

Fraudulent sites are registered in bulk and abandoned within weeks, so their domains are typically days or weeks old. A genuine bank, retailer or courier has usually held its domain for years. A very recent creation date on a site asking for payment details is a strong warning sign.

Can I look up an IP address or ASN as well as a domain?

Yes. Entering an IP address returns the network allocation, the organisation it is assigned to, the CIDR range and an abuse contact. Entering an AS number returns details of the network operator.

Last reviewed: August 2026 · Reviewed by the ShowMyIP team