Where the data comes from

Registration data comes over RDAP — the modern protocol ICANN requires of gTLD registries, which returns JSON. Port 43, which classic WHOIS uses, is closed outbound from this host, so RDAP is the only transport available. That is not a downgrade: RDAP returns structured data instead of free text that has to be scraped per registrar.

It has a limit. Between IANA's bootstrap file and a few hand-added registries, an RDAP server is known for 1,209 TLDs, covering nearly every gTLD and a minority of ccTLDs.

"Thin" registries such as .com and .net hold only the delegation; the registrant organisation, country, contacts and the registrar's abuse desk live on the registrar's own RDAP server. When the registry answer links to one, it is fetched too and the two are merged.

Both raw answers are kept in separate tabs at the foot of a profile.

Since GDPR most registries no longer publish a registrant's name, address or email. Blank or redacted fields are withheld, not missing. Corporate registrations sometimes keep the organisation and country visible; individual ones almost never do.

DNS records are asked live of three public resolvers (8.8.8.8, 1.1.1.1, 9.9.9.9). For mail security the SPF, DMARC, MTA-STS, TLS-RPT and BIMI records are read; DKIM selectors cannot be listed from DNS, so common ones are tried.

Subdomains (api., vpn., mail.…) cannot be listed from DNS. They are gathered from Certificate Transparency logs (the names on every certificate issued for the domain), from the certificate the site serves and from a short list of common labels, then each is resolved live. The CT list is kept for 12 hours; resolution runs again on every lookup.

The site is visited from https://, following up to six redirects; only the response headers and the first slice of the page are read, and nothing is stored. Redirects to private addresses or non-standard ports are not followed.

The globe at the top of a profile places the web server, nameservers and mail servers by GeoIP. Its continents are not drawn from a coastline file but from where IP addresses geolocate: each dot is a 1.5° cell holding at least one network.

Every lookup is stored. The second time a domain is queried, its registrar, nameservers, status codes, expiry date, DNSSEC state and its A, AAAA, MX and NS records are compared against the previous record, and any difference is listed on the page.

The “Website Archive” section of a result shows how the site on a domain looked in past years. Those copies are not ours: they belong to the Internet Archive, a non-profit that has been preserving the web through the Wayback Machine since 1996 and opens it to everyone for free.

We only fetch the index of how many copies exist per year and keep it for 7 days; the page for the year you pick loads in your browser straight from web.archive.org. Old pages may miss images or styling.

The past ownership records in the domain history section come from the Internet Archive too: only organisation-level facts (registrant organisation, country, registrar, dates, nameservers) are read from archived who.is and whois.com pages; names of people, addresses, phone numbers and e-mail are never taken. Past addresses, nameservers and MX records come from the public passive DNS of Mnemonic and Robtex, whom we thank as well.

The addresses a domain resolves to are checked against the abuse pool ip-db.com builds from 46 open sources.

Queries are also subject to each registry's own rate limits; when a registry refuses, the page says so plainly. For programmatic access see the JSON API.