Infrastructure
What is WHOIS?
The lookup service that returns a domain's registration record: registrar, creation and expiry dates, name servers and any public contact details.
WHOIS, now increasingly served through the RDAP protocol, returns the registration record for a domain or IP block: registrar, creation and expiry dates, name servers, status codes and, where not redacted, registrant contact details.
Since GDPR, most registrant details are hidden by privacy services. The record is still useful: creation dates expose freshly registered phishing domains, and historical WHOIS from before redaction can link old domains to an actor's email address.