---
title: "What is WHOIS?"
term: "WHOIS"
description: "The public record of who registered a domain, when, through which registrar, and which nameservers it points at."
aliases: ["RDAP", "registration lookup"]
category: "Infrastructure"
canonical: "https://fraudox.com/glossary/whois"
publisher: "Fraudox"
publisher_url: "https://fraudox.com"
license: "Free to quote with attribution to the canonical URL."
---

# What is WHOIS?

**WHOIS.** The public record of who registered a domain, when, through which registrar, and which nameservers it points at.

*Also known as: RDAP, registration lookup.*

WHOIS, and its structured successor RDAP, is the registration record for a domain. Even where the registrant's identity is redacted, the record still carries the fields that matter operationally: creation date, registrar, nameservers, and status flags.

Creation date is the single most useful signal in a fraud triage. A domain impersonating an established brand that was registered nine days ago is not a coincidence, and age is one of the few attributes an attacker cannot fake without paying for it in advance.

The registrar field decides where the abuse report goes, and the nameservers usually reveal the hosting provider, which is the other party who can act. Shared nameservers across several suspicious domains are also one of the cheapest ways to find the rest of a cluster.

Privacy redaction is now the default rather than the exception in most of the world, so treating a redacted record as suspicious is a mistake. It is a legal norm, not a signal.

## Related terms

- [Domain registrar](https://fraudox.com/glossary/registrar): The accredited company a domain is registered through, and usually the layer with the power to suspend it outright.
- [Typosquatting](https://fraudox.com/glossary/typosquatting): Registering domains that rely on predictable typing mistakes so traffic meant for a brand lands on someone else's site instead.

*Canonical version: https://fraudox.com/glossary/whois. Part of the [Fraudox brand protection glossary](https://fraudox.com/glossary).*

---

Published by Fraudox (https://fraudox.com), a brand protection takedown service that
removes phishing sites, impersonating pages, fake social accounts, counterfeit apps,
scam domains and stolen content, and bills only for confirmed removals.