# WHOIS Fields Guide

URL: https://phishdestroy.io/developer-tools/whois-fields-guide
Category: Phishing URL & domain
Where it runs: Runs locally (nothing you enter is uploaded)

A plain-language table of 17 fields you see in a domain's WHOIS or RDAP record, from Registrar and Creation Date to the abuse contact you report phishing to.

## Example input

Fields to read first

```
Creation Date: 2026-10-18T09:12:44Z
Registrar Abuse Contact Email: abuse@registrar.example
Domain Status: clientHold
```

A creation date a day or two before the phishing email, the registrar abuse address to report to, and clientHold, which means the registrar has suspended the domain and taken it out of DNS.

## FAQ

### Which WHOIS fields matter in a phishing investigation?

Creation Date (phishing domains are often only days old), Registrar and its abuse contact (where the report goes), Name Server (a DNS provider that can also act) and Domain Status, where clientHold or serverHold means the domain has been suspended.

### Why are the registrant details redacted?

Since GDPR took effect in 2018, most registrars hide registrant names, emails and phone numbers, so the owner is usually unknown. The registrar abuse contact is still published and is the right place to report abuse.

### Does this page look up a domain?

No, it is a static guide and nothing leaves your browser. For generic TLDs, RDAP replaced WHOIS as the authoritative source in January 2025; Abuse Contact Lookup queries RDAP for you.

## Related tools

- [Abuse Contact Lookup](https://phishdestroy.io/developer-tools/abuse-contact-lookup)
- [DNS over HTTPS Lookup](https://phishdestroy.io/developer-tools/dns-over-https-lookup)
- [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator)
- [DNS Record Types Reference](https://phishdestroy.io/developer-tools/dns-record-types)
- [Lookalike Domain Generator](https://phishdestroy.io/developer-tools/lookalike-generator)

All tools: https://phishdestroy.io/developer-tools