Instantly check domain and IP ownership, registration dates, registrar details, and geographic location on an interactive map.
Download Free on the App StoreWhois Lookup and all 19 tools are free. No ads, no account required.
PingKit queries Whois registries for any domain name or IP address and presents the results in a clean, readable format. Instead of parsing raw Whois text, you get structured ownership data, registration timelines, and the server's geographic location plotted on a map.
See which registrar a domain is held at, when it was created, last changed and expires, its registry status codes, its name servers and whether DNSSEC is on. Registrant identity is redacted by the registries themselves, and the section below explains why.
Look up any IP address to find the allocated organization, ISP, ASN, and geographic location, shown on an interactive map.
Every IP lookup plots the geographic location on an interactive map. See at a glance which country and city a server operates from and who controls the surrounding network.
View when a domain was first registered, when it was last updated, and when it expires. Spot recently registered domains that may indicate phishing or fraud attempts.
Received a link that looks off? Run a Whois lookup to check when the domain was registered. Phishing domains are almost always brand new -- registered days or weeks before an attack. A domain created last Tuesday claiming to be your bank is a clear red flag.
Before purchasing a domain, check its history. A domain first registered years ago and continuously renewed reads very differently from one created last month. The creation date and the registrar are both in the lookup. Previous owners are not: a lookup returns the record as it stands today, and no registry publishes an ownership history.
When a server connects to your network, knowing who owns that IP address matters. PingKit's Whois tool reveals the organization behind any IP, its ISP and its ASN. This is essential for incident response and network administration.
Combine registration age with registrar details to evaluate domain trustworthiness. Legitimate businesses typically register domains years in advance through reputable registrars. Freshly registered domains on budget registrars that mimic well-known brands are almost certainly malicious.
An IP lookup answers a different question from a domain lookup, and it is the one people ask more often: an unfamiliar address has turned up in a log, a firewall rule, an email header or a router's connection list, and the question is what it is.
Enter the address and PingKit returns the organisation that holds it, the ISP, the ASN, and an approximate location drawn on a map when coordinates came back. You can enter a hostname instead and it resolves first, which saves a step when what you have is a domain and what you want is the network behind it.
Read the ASN before anything else. An Autonomous System is the unit of ownership in the internet's routing table, and unlike the city estimate it is a hard fact. It answers the question that usually matters: is this a hosting provider, a consumer ISP, a corporate network or a CDN? An address inside a cloud provider's AS is a server somebody rented. An address inside a residential ISP's AS is somebody's home connection. Those two findings lead to completely different next steps, and the ASN separates them reliably where the city label may not.
Three things an IP lookup cannot tell you, and it is worth knowing them up front. It cannot name a person: address blocks are registered to organisations, and the organisation on a home connection is the ISP. It cannot give a street address: see the accuracy notes for how far the location goes, which is reliably the country and rarely better than the region. And it does not say what the address was doing: for that, look at the ports it answers on with Port Scanner, or the path to it with Traceroute.
The common workflow is short. Look the address up, read the ASN and organisation, and if it is a hosting provider and the traffic was unwanted, the organisation name is who you report it to. Every large provider runs an abuse address, and a report naming the IP, the ASN and a timestamp is one they can act on.
This surprises almost everyone who runs their first lookup in a few years, so it is worth being direct about it. You will not find a person's name, email address or postal address in a modern domain lookup, and that is not a limitation of this app.
Until 2018 the WHOIS system published registrant contact details openly. When GDPR came into force the registries and registrars had no lawful basis to keep doing that, and the industry moved to redacting personal data by default. What a public lookup returns today is the registrar, the dates, the status and the name servers. The registrant is replaced by a privacy service, a redaction notice, or nothing at all. This is true of every public WHOIS tool, free or paid.
Registrar and registrant are different things, and confusing them is the root of most disappointment here. The registrar is the company the domain is bought and renewed through: GoDaddy, Namecheap, Cloudflare, Gandi. That is public, and PingKit shows it. The registrant is the person or organisation that owns the domain. That is redacted, and PingKit does not show it because the registries do not publish it.
If you genuinely need to reach a domain's owner, the route that still works is the registrar's own abuse or contact form, which forwards without disclosing anything. The registrar name in a lookup is what tells you where to send it.
What remains public is still enough for the thing most people actually want, which is judging whether a domain is trustworthy. A creation date of eleven days ago on a domain claiming to be a bank tells you everything you need, and no name would tell you more.
The registrar, with its URL where the registry publishes one.
Three dates. Created, last updated, and expiry, plus the number of days until expiry. Anything inside thirty days is flagged, because an expiring domain is a real operational risk and the window to renew before it is auctioned is short.
The name servers, which tell you who actually runs the DNS. A domain registered at one company with name servers at another is normal and worth noticing, because DNS is where changes take effect.
DNSSEC, on or off.
The status codes, which are the least understood and most useful field in the record. They are EPP codes set by the registry[source], and they say what can and cannot happen to the domain right now.
| Status | What it means |
|---|---|
ok / active | Nothing unusual. No locks applied. |
clientTransferProhibited | A transfer lock the registrar sets, usually by default. Normal, and the thing you must clear before moving a domain elsewhere. |
clientHold | The registrar has asked the registry to stop resolving the domain. A site that has vanished with DNS intact often has this. |
serverHold | The same, imposed by the registry rather than the registrar. Usually a dispute or a legal order. |
pendingTransfer | A transfer to another registrar is in progress. |
pendingDelete | Heading for release. Preceded by a redemption period during which the owner can still recover it at a cost. |
redemptionPeriod | Expired and not yet released. Recoverable, expensively, for about thirty days. |
autoRenewPeriod | Renewed automatically; the registrar can still reverse it for a short window. |
An IP lookup returns a different set: the organisation and ISP that hold the address, the ASN, and the approximate location, drawn on a map when the lookup came back with coordinates. The IP Geolocation page covers how far to trust that location, which is further for the network and less far for the city.
One technical difference is worth explaining because it changes what you get. Classic WHOIS is a plain-text protocol on port 43 with no defined format, so every registry answers in its own layout and every tool that consumes it is parsing prose. RDAP is its replacement[source]: the same data over HTTPS as structured JSON, with defined field names and proper internationalisation. PingKit uses RDAP.
That is why the results here are labelled fields rather than a wall of monospaced text, and it is why the dates are real dates that can be counted down rather than strings in whichever format that particular registry favours. For the seven commonest extensions PingKit queries the registry's own RDAP service directly, and everything else goes through the standard redirector, so an unusual TLD still resolves.
| What matters | PingKit | Typical whois site or app |
|---|---|---|
| Price | Free, all 19 tools included | Free with ads, or a daily lookup cap |
| Protocol | RDAP, structured | Often legacy port 43 text, reformatted |
| Expiry warning | Days remaining, flagged under 30 | Usually a raw date |
| Ads & upsells | None | Commonly a domain sales pitch beside your result |
| Next step | DNS, ping, traceroute and SSL on the same host in the same app | Usually the lookup alone |
Being straight about one thing: no consumer tool has access to redacted registrant data, and any service implying it can reveal domain ownership for a fee is selling you either public information or a guess.
No data came back for a valid domain. Some country-code registries do not run a public RDAP service, and a few rate-limit aggressively. The domain is fine; the registry simply did not answer.
The registrant is blank or says REDACTED. Working as intended, for the reasons above.
The registrar looks wrong. Check whether it is a reseller. Many small registrars sell under their own brand while the registry record names the accredited registrar behind them, so the name you see may not be the site you bought from.
The expiry date is in the past and the site still works. An expired domain keeps resolving through the auto-renew and redemption periods. Look at the status codes: redemptionPeriod or pendingDelete mean it is genuinely on its way out.
You typed a URL and it worked anyway. Deliberate. PingKit strips http://, https://, a leading www. and anything after the first slash, so pasting a full link is fine.
A subdomain returns nothing. Registries hold records for registered domains, not for names below them. Look up the registrable domain and use DNS Lookup for the subdomain.
PingKit's Whois tool works alongside 18 other network utilities. Run a Whois lookup to identify a domain's hosting provider, then use DNS Lookup to check its records, Ping to test connectivity, and Traceroute to map the path your traffic takes. All tools share results so you can build a complete picture of any domain or IP without switching apps.
Cert Monitor for 50 domains (5 on Guardian, 1 free), a signed ISO 27001 PDF export, and scheduled, branded reports. $9.99/mo on iPhone and iPad, $4.99/mo on Mac.
Learn about Guardian Plus →Yes, in the sense of who operates it. Choose IP Address and PingKit returns the operator's name, shown as ISP and organisation, the ASN, and the country, region and city on a map. It is worth knowing where that comes from: an IP intelligence lookup rather than the regional registry, so there is no allocated address range and no abuse contact. It is enough to tell an AWS address from a residential ISP, which is usually the real question.
Yes. Choose Domain or IP Address, type the query, and PingKit runs the lookup from the phone. A domain returns the registrar, the created, updated and expiry dates with a countdown of days remaining, the authoritative name servers, the EPP status codes and whether DNSSEC is signed. An IP returns the ISP, the owning organisation and the ASN, with the country, region and city plotted on a map.
PingKit queries RDAP, the structured protocol that replaced classic Whois text. For a domain that gives you the registrar, when the record was created, last changed and when it expires, the name servers, the EPP status codes and the DNSSEC state. It does not show a registrant name, address or email: PingKit reads none of those out of the response, and registries redact them on most domains in any case. For an IP address you get the operator's name, the ASN and the location.
PingKit will not give you a person's name. It reads the registrar, the dates, the name servers and the status codes out of the record and nothing else, and registrant contact details are redacted on most domains anyway. What you do get is usually better suited to the question behind the question: which registrar manages the domain, when it was first registered, when it last changed, and where its name servers point. A domain registered nine days ago through a budget registrar tells you what you need without a name attached.
Yes. Whois is one of the 19 tools, all of which are free, with no ads and no account. The lookup goes through a shared service that rate-limits, so running many in quick succession can return 'Too many requests. Please wait a moment before trying again.', but there is no per-user quota and nothing to buy. PingKit Guardian is a subscription for continuous monitoring, and it changes nothing about a Whois lookup.
Download PingKit free and run Whois lookups in seconds.
Download Free on the App StoreRequires iOS 17.0 or later.