Find the registrar and network abuse contacts for a domain or IP from RDAP.
Network: RDAP + DoHNew
WHOIS Fields Guide
Runs locally
Use WHOIS Fields Guide
What it does
A plain-language table of 17 fields you see in a domain's WHOIS or RDAP record, from Registrar and Creation Date to the abuse contact you report phishing to.
It runs entirely in your browser: nothing you enter is uploaded.
Example
Fields to read first
Creation Date: 2026-10-18T09:12:44Z
Registrar Abuse Contact Email: abuse@registrar.example
Domain Status: clientHoldCreation Date: When the domain was first registered
Abuse Contact Email: Email for reporting abuse
Name Server: Authoritative DNS servers for the domainA creation date a day or two before the phishing email, the registrar abuse address to report to, and clientHold, which means the registrar has suspended the domain and taken it out of DNS.
FAQ
Which WHOIS fields matter in a phishing investigation?
Creation Date (phishing domains are often only days old), Registrar and its abuse contact (where the report goes), Name Server (a DNS provider that can also act) and Domain Status, where clientHold or serverHold means the domain has been suspended.
Why are the registrant details redacted?
Since GDPR took effect in 2018, most registrars hide registrant names, emails and phone numbers, so the owner is usually unknown. The registrar abuse contact is still published and is the right place to report abuse.
Does this page look up a domain?
No, it is a static guide and nothing leaves your browser. For generic TLDs, RDAP replaced WHOIS as the authoritative source in January 2025; Abuse Contact Lookup queries RDAP for you.