Reverse WHOIS Search allows you to obtain a list of domains containing a specific search term (registrant's name, email address, phone number) in their current or historical WHOIS records. This tutorial teaches you:

• How to Perform a Basic Search
• Advanced Search Parameters
• How to Search for Specific Strings in Any WHOIS Field
• How to Search for Strings in Specific WHOIS Fields
• How to Build WHOIS and DNS Reports Based on the Search Results 

How to Perform a Basic Search

To look for domains containing a specific search term in any WHOIS field, follow these steps:

1. Open Reverse WHOIS Search. You will be directed to the Basic search tab by default.

2. Type the search term into the search field.

3. The tool will return a list of domains that have the search term in their current WHOIS records. The list can be downloaded in CSV format.

Advanced Search Parameters

Reverse WHOIS Search allows you to perform customized searches. Below are some parameters you can set.

• Search where: You can choose between Anywhere and In specific WHOIS fields.

• Select through domains: You can search through the domains’ Current or Historic WHOIS records (see image below). You can also choose to only search through Recently updated domains whose WHOIS records were updated in the last three days.

• Date filters: Setting date filters tells the tool to search through domains whose creation, update, or expiration dates fall within the date range set.

How to Search for Specific Strings in Any WHOIS Field

1. Open Reverse WHOIS Search and go to Advanced search.

2. Toggle the Anywhere radio button (see image below) to retrieve domains containing the search term in any WHOIS field.

3. Type the search string. You can provide up to four search terms, which you can include or exclude. In the screenshot below, we are searching for domains containing “Digital Crimes Unit,” excluding those with “Microsoft” in any WHOIS field.

4. Set the Search through domains parameters (see image below). For our demonstration, we searched through the Current WHOIS records of the domains.

5. Set date filters and click Search. The screenshot below shows we’re searching for domains that have been updated in September 2022, as specified in the Updated From and Updated To parameters.

6. You may download the list by clicking the Export CSV button. In our demonstration, the tool returned 28 domains updated in September 2022, containing “Digital Crimes Unit” in any current WHOIS record field, excluding those containing “Microsoft.”

How to Search for Strings in Specific WHOIS Fields

1. Open Reverse WHOIS Search and go to Advanced search.

2. Toggle the In specific WHOIS fields radio button (see image below) to look up domains containing the search term in the specified WHOIS field.

3. Under Search term(s), choose the WHOIS field where you want to look for the search term.

4. Select the placement of the search term. Choose from among Starts with, Contains a word, or Exact match. For search strings that begin with a vowel or a limited number of characters, choosing Starts with may help lessen the number of false positives.

5. Type the search term into the search field. You can specify up to four search strings to include or exclude. To illustrate, we are looking for domains whose Registrant Contact Name starts with “Digital Crimes Unit.” 

6. Set the Search through domains parameters. As in the previous demonstration, we searched through the domains’ Current WHOIS records.

7. Set a date filter and click Search. Again, we searched through the WHOIS records of domains updated in September 2022, as specified in the Updated From and Updated To parameters.

8. You can download the results by clicking the Export CSV button. In our demonstration, we found 19 domains updated in September 2022 and whose current registrant contact name starts with “Digital Crimes Unit.”

How to Build WHOIS and DNS Reports Based on Search Results

Whether you’re doing a basic or advanced reverse WHOIS search, you can build other WHOIS and DNS reports on any of the domains in the results.

You can do that by clicking the arrow (>) beside each domain.

You have the option to:

• Copy to clipboard: This functionality copies the domain to your device’s clipboard.

• Build Historic WHOIS report: A WHOIS history search will be performed on the domain, returning its historical WHOIS records.

• Build current Reverse WHOIS report: This will retrieve a list of domains that share the domain’s current WHOIS record details.

• Build historic Reverse WHOIS report: This function will retrieve a list of domains that share the domain’s historical WHOIS record details.

• Build WHOIS report: The domain’s current WHOIS record will be returned.

• Domain Availability Check: This will check if the specific domain is available for registration or not.

• Obtain connected domains: This will retrieve all domains sharing the domain’s IP address.

• Reverse MX report: A list of domains sharing the same mail server (MX) will be displayed.

• Reverse NS report: A list of domains sharing the same name server (NS) will be displayed.

• Add to Domain Monitor: The domain will be added to Domain Monitor and any changes made to its WHOIS records will be tracked.

• Add to Registrant Monitor: The domain will be added to Registrant Monitor to track any domains added, updated, dropped, and discovered that contain the registrant search term.

• Add to Brand Monitor: This adds the second-level domain (SLD) to Brand Monitor, and you will be notified of any newly added, dropped, updated, or discovered domains containing the SLD.

Your turn to have fun with Reverse WHOIS Search! You can access this tool and others here.