Registrar Info Lookup

Find the domain registrar, IANA ID, and official abuse contact information.

About Domain Registrars

A domain name registrar is an accredited company that manages the reservation of internet domain names. If a domain is being used for malicious activity (like phishing or spam), you should report it to the registrar's abuse contact email listed above. Registrars are required by ICANN to investigate abuse complaints.

Our Domain Registrar Lookup identifies which company currently manages any domain registration, returning the registrar name, IANA ID, abuse contact and the EPP status codes that reveal whether transfer locks are in place.

What is a Domain Registrar?

A registrar is an ICANN-accredited company authorised to sell and manage domain registrations. It sits between you and the registry, which is the organisation operating the TLD itself — Verisign for .com, PIR for .org, and so on.

You buy from a registrar; the registry holds the authoritative record. The registrar submits changes to the registry on your behalf through the EPP protocol, which is also where domain status codes originate.

The registrar matters operationally because it is where you renew, where you change nameservers, where transfer locks are set, and where account compromise would have the most severe consequences. It is also, in practice, the party you deal with in any recovery situation.

An ICANN-accredited company that sells and manages registrations
Distinct from the registry, which operates the TLD itself
Identified by name and a unique IANA ID number
Controls renewals, nameserver changes and transfer locks
Publishes an abuse contact required by ICANN

Why the Registrar Matters

Your registrar account is the root of trust for your entire online presence. Whoever controls it controls your nameservers, and whoever controls your nameservers controls your website, your email and any service that depends on your domain resolving correctly. Domain hijacking almost always begins with registrar account compromise rather than any technical attack on DNS itself.

Identifying the registrar also matters when investigating abuse. Every accredited registrar must publish an abuse contact and act on reports, so knowing which one manages a phishing domain is the first step in getting it taken down.

Registrar account compromise is the usual route to domain hijacking
Controls nameserver delegation, and therefore everything downstream
The abuse contact is the practical route to phishing takedowns
Transfer lock status is visible in the EPP codes it sets
Registrar quality varies considerably in security features and support

How This Registrar Lookup Works

The tool queries WHOIS and extracts the registrar identification and status fields.

Validates the domain input against format and SSRF safety checks
Queries the authoritative WHOIS server for the TLD
Extracts the registrar name and IANA ID
Retrieves the published abuse contact details
Reports the EPP status codes indicating lock and transfer state

How to Use the Registrar Lookup

Enter the domain name you want to check
Run the lookup to query WHOIS
Review the registrar name and IANA ID
Check the EPP status codes for active transfer locks
Note the abuse contact if you need to report the domain

Understanding Your Registrar Lookup Results

The lookup returns registrar identity and the status codes governing the domain:

Field / Value	Meaning
`Registrar name`	The company currently managing the registration. This is where renewals and configuration changes are made.
`IANA ID`	A unique number identifying the accredited registrar. Useful because several registrars operate under multiple brand names that share one ID.
`Abuse contact`	The email and phone required by ICANN for abuse reports. This is the correct route for reporting a phishing or malware domain.
`clientTransferProhibited`	A registrar lock is active, preventing transfer to another registrar without first unlocking. This should be set on every domain you own.
`serverTransferProhibited`	A registry-level lock, stronger than the client lock and typically part of a registry lock service for high-value domains.
`pendingTransfer`	A transfer to another registrar is in progress. If you did not initiate it, treat this as an active hijack attempt and contact your registrar immediately.
`clientHold`	The registrar has instructed the registry to stop resolving the domain, usually for non-payment or an abuse complaint. The domain will not work while this is set.

Common Problems & How to Fix Them

Without clientTransferProhibited, an attacker who gains access to your registrar account or intercepts the authorisation code can move the domain to another registrar, after which recovery becomes far harder.

Enable the transfer lock in your registrar control panel. It is free, takes seconds, and only needs to be lifted deliberately when you genuinely intend to transfer.

Someone has initiated a transfer of your domain. If it was not you, this is an active hijack in progress.

Contact your registrar immediately and request the transfer be rejected — most allow the losing registrant to deny it within a five-day window. Then change your registrar account password, enable multi-factor authentication, and review who has access.

The registrar has suspended resolution, usually for non-payment, an unverified registrant contact, or an upheld abuse complaint.

Check your registrar account for outstanding notices. ICANN requires registrant email verification, and a bounced verification message will suspend the domain until it is confirmed.

The registrar name and IANA ID remain visible even under privacy protection — only the registrant contact details are masked. If those fields are genuinely absent, the TLD registry may restrict WHOIS output entirely.

Try RDAP, the structured successor to WHOIS, which many registries now serve and which often returns more consistent data.

Use the abuse contact published in the WHOIS record. Every ICANN-accredited registrar must maintain one and respond to reports.

Include the exact URL, timestamps, and evidence such as headers or screenshots. Reports with concrete evidence are acted on considerably faster than assertions alone.

Best Practices

Enable registrar transfer lock on every domain you own
Use multi-factor authentication on the registrar account
Keep registrant contact details accurate and monitored
Use a role address for contacts rather than an individual employee
Consider registry lock for high-value domains
Review EPP status codes periodically as part of domain auditing
Consolidate domains with a registrar that offers proper security controls

Security Recommendations

Treat the registrar account as the root of trust for your entire online presence and protect it accordingly
Enable registry lock on critical domains, which requires out-of-band verification for any change
Monitor WHOIS for unexpected registrar or nameserver changes, which are the clearest signal of a hijack
Never leave the registrant contact as a departed employee, since account recovery may depend on it
Restrict who has access to the registrar account and review that list regularly
Be aware that an unlocked domain plus a compromised email account is sufficient for a complete takeover

Frequently Asked Questions

A registry operates a TLD and holds the authoritative records — Verisign for .com, for example. A registrar is an accredited company that sells registrations to the public and submits changes to the registry on your behalf.

A unique number identifying an ICANN-accredited registrar. It is useful because many registrars operate several consumer brands that all share a single accreditation and IANA ID.

A registrar lock is active, so the domain cannot be transferred to another registrar until it is deliberately unlocked. This should be enabled on every domain you own — it is free and it prevents the most common hijack path.

Use the abuse contact published in the WHOIS record. Every accredited registrar must maintain one and act on reports. Include the exact URL, timestamps and supporting evidence such as message headers or screenshots.

Treat it as an active hijack. Contact your registrar immediately to reject the transfer — there is usually a five-day window in which the losing registrant can deny it. Then secure the account with a new password and multi-factor authentication.

The registrar has suspended it, typically for non-payment, an unverified registrant email, or an upheld abuse complaint. ICANN requires registrant contact verification, and a bounced verification message alone is enough to trigger suspension.

Yes. They differ substantially in security features, support responsiveness and transfer handling. For domains that matter, choose one offering multi-factor authentication, registry lock, granular account permissions and reachable support.