---
title: "WHOIS Registration Information | ThreatConnect"
slug: "whois-registration-information"
description: "This article describes how to view WHOIS registration information for Host Indicators."
updated: 2023-03-10T19:40:46Z
published: 2023-03-10T19:40:46Z
canonical: "knowledge.threatconnect.com/whois-registration-information"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt
> Use this file to discover all available pages before exploring further.

# WHOIS Registration Information

On a Host Indicator’s **Details** screen, you can enable the WHOIS feature and view WHOIS registration information, if available, for the Indicator.

## New Details Screen

### Enabling the WHOIS Feature

To enable the WHOIS feature for a Host Indicator, select the **Enable Whois Lookups** checkbox at the upper-right corner of the **Whois** card on the **Overview** tab of the Indicator’s [**Details** screen](https://knowledge.threatconnect.com/docs/the-details-screen) (Figure 1).

![Figure 1_WHOIS Registration Information_7.0.2](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%201_WHOIS%20Registration%20Information_7.0.2.png)

NoteIt may take up to 60 minutes for WHOIS information to populate after selecting the **Enable Whois Lookups** checkbox.

### Viewing WHOIS Information

The **Whois** card (Figure 1) will display WHOIS registration information for the Indicator if the WHOIS feature is enabled for it and such information exists. Clicking on a registrar’s entry in the table will expand it and display contact information for the registrar, if available.

## Legacy Details Screen

### Enabling the WHOIS Feature

To enable the WHOIS feature for a Host Indicator, select the **Whois** checkbox in the **Details** card on the **Overview** tab of the Indicator’s **[](https://knowledge.threatconnect.com/docs/the-details-screen-legacy)**[](https://knowledge.threatconnect.com/docs/the-details-screen-legacy)[legacy **Details** screen](https://knowledge.threatconnect.com/docs/the-details-screen-legacy)[](https://knowledge.threatconnect.com/docs/the-details-screen-legacy)**[](https://knowledge.threatconnect.com/docs/the-details-screen-legacy)** (Figure 2).

![Figure 2_WHOIS Registration Information_7.0.2](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%202_WHOIS%20Registration%20Information_7.0.2.png)

NoteIt may take up to 60 minutes for WHOIS information to populate after selecting the **Whois** checkbox.

### Viewing WHOIS Information

On a Host Indicator’s legacy **Details** screen, click the **Whois** tab and, if populated, the screen will display a results table with hyperlinked items in the **Contacts** column (Figure 3).

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%203_WHOIS%20Registration%20Information_7.0.2.png)

Click a hyperlink to view related Hosts in ThreatConnect that have a matching value in their WHOIS information. The **Related Hosts** window will be displayed (Figure 4).

![Table Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%204_WHOIS%20Registration%20Information_7.0.2.png)

To view the full WHOIS record for an entry in the **Whois** results table, click **Full Record****![Full Record icon_WHOIS Registration Information](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Full%20Record%20icon_WHOIS%20Registration%20Information.png)**in the rightmost table column (Figure 3). The **Whois Record** window will be displayed (Figure 5).

![Graphical user interface, text, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%205_WHOIS%20Registration%20Information_7.0.2.png)

---

*ThreatConnect® is a registered trademark of ThreatConnect, Inc.*

20030-04 v.12.A