Why Domain Ownership Research Matters More Than Ever

You received an email from an unfamiliar website. You found a domain that suspiciously mimics your company's brand. You are about to sign a contract with a business whose website was registered six days ago. In each of these situations, the first question is identical: who is actually behind this domain?

That question has never been more urgent than it is today. A study published by Interisle Consulting in November 2025 found that cyberattacks involving malware, phishing, and spam grew by 60% in a single year, surpassing 26 million unique events. During that same period, malicious domain registrations increased by 149% year over year, and bulk domain registration for criminal purposes surged by 177%. More than 7.3 million domains used in cyberattacks were registered in batches, often with false or deliberately hidden identity data.

The picture becomes even more striking at the campaign level. Research from the Anti-Phishing Working Group documented that more than 60% of phishing domains are registered fewer than seven days before they are deployed in attacks. A newly created domain is, by itself, a meaningful risk signal that warrants investigation.

Knowing who registered a domain is the starting point of any serious digital investigation, whether the goal is protecting a brand, verifying the legitimacy of a business partner, investigating fraud, or simply deciding whether to trust a website that landed in your inbox.

What Are WHOIS and RDAP and How Do They Work

Since the earliest days of the internet, every registered domain has been associated with a set of public metadata identifying its owner, the responsible registrar, the creation and expiration dates, and the configured name servers (DNS). This data is stored in a system called WHOIS, a public query protocol created in 1982.

For decades, WHOIS functioned like a public registry of the internet: anyone who registered a domain had their contact information published openly, queryable by any other user. The transparency was total and unrestricted.

On January 28, 2025, however, ICANN made migration from WHOIS to a more modern protocol called RDAP (Registration Data Access Protocol) mandatory for all generic top-level domain registries and registrars. The difference is not merely technical. RDAP returns data in structured JSON format, supports HTTPS encryption by default, and introduces a tiered access system: public queries receive redacted data, while verified parties can request access to complete records through ICANN's Registration Data Request Service (RDRS) with documented justification.

In practice, when you use a "WHOIS lookup" tool today, it is almost always running an RDAP query in the background. The old name persists in popular vocabulary, but the underlying protocol has evolved significantly.

What You Can Find in a Domain Registration Record

Even with the restrictions introduced by GDPR and similar privacy regulations, a well-conducted domain lookup still yields a substantial amount of information. What you find varies depending on the domain type (generic or country-code), the registrant's country, and whether the owner enrolled in a privacy protection service.

In a record with full data available, you may access:

• Registrant name (individual or company name)

• Contact email (frequently replaced by a proxy after 2018)

• Physical address (country, state, and city often remain visible even under partial redaction)

• Registrar name (GoDaddy, Cloudflare, Namecheap, HostGator, etc.)

• Domain creation date

• Expiration date

• Last updated date

• Name servers

• Domain status (active, clientTransferProhibited, redemptionPeriod, etc.)

For domains using privacy services or belonging to registrants in GDPR-covered jurisdictions, the name and email fields typically appear with placeholders such as "Redacted for Privacy" or show the contact details of the registrar's own proxy service. However, information such as country, registrar, dates, and nameservers almost always remains accessible and is sufficient to build the foundation of an investigation.

Who Needs to Find a Domain Owner

The need to identify a domain's owner cuts across very different professional and personal profiles. Among the most common use cases:

Security and compliance professionals who need to verify whether a suspicious domain is associated with known phishing campaigns, malware infrastructure, or operators with a documented history of abuse. For this audience, the domain registration record is typically the first step in a pivot chain that connects email addresses, IP addresses, and other domains back to the same identity.

Legal and intellectual property teams that have identified brand infringement or unauthorized use of a trade name in a third-party domain. Knowing who registered the domain is a prerequisite for initiating ICANN's UDRP process or filing a civil lawsuit.

Due diligence and fraud prevention analysts who need to verify the legitimacy of a company before closing a contract, extending credit, or approving a partnership. A domain registered recently and associated with an anonymous registrant is an immediate risk indicator.

Fraud investigators and journalists tracking fraudulent operations, digital scam schemes, or coordinated disinformation networks frequently need to map clusters of domains tied to the same underlying entity.

Individuals who received a suspicious email, were approached by an unknown website, or want to verify whether an online service is legitimate before entering personal data or making a payment.

How to Find Out Who Owns a Domain: Step-by-Step

Domain ownership research can be conducted at different depths, from a basic lookup that takes seconds to a full investigation that crosses multiple open sources. The process below describes both levels.

Level 1: Basic WHOIS/RDAP Lookup

Step 1: Use ICANN's official lookup tool

Visit lookup.icann.org and enter the domain you want to research. This is the authoritative source, querying the RDAP endpoint of each registrar directly. The result includes the registrar, registration and expiration dates, nameservers, and, when available, registrant data.

Step 2: Identify the registrar

The registrar name is always public. With it, you can go directly to the registrar's website and use their own WHOIS tool, which may surface more detail than a generic query.

Step 3: Consult complementary lookup tools

Sites such as who.is, whois.domaintools.com, and whoisfreaks.com aggregate data from multiple sources and often offer historical registration records, which is especially useful when the current owner is hidden but past transfers left traces in earlier records.

Step 4: Check historical WHOIS data

The privacy service covering a domain today may not have existed at the time of the original registration. Historical WHOIS tools provide snapshots of previous records that may contain the actual owner's data from before privacy protection was activated.

Step 5: Analyze the nameservers

Name servers are rarely covered by privacy services and appear in almost every WHOIS/RDAP response. For investigators, nameservers are valuable because malicious infrastructure operators frequently reuse the same servers across multiple domains. Finding other domains that share the same nameserver is a classic pivot technique in OSINT investigations.

Level 2: Deep Investigation with OSINT

When a basic query returns redacted or insufficient data, the investigation shifts to cross-referencing information from multiple open sources.

Step 6: Run a reverse IP lookup

Identifying the IP address associated with the domain and correlating it with other domains hosted on the same server can reveal patterns. Operators of fraudulent domains frequently host multiple targets on the same infrastructure.

Step 7: Check SSL/TLS certificate transparency logs

Certificate transparency databases such as crt.sh record every SSL certificate issued for a domain and its subdomains. This data is not subject to the same privacy restrictions as WHOIS and can reveal undocumented subdomains, infrastructure patterns, and organizational associations.

Step 8: Review passive DNS records

Querying passive DNS (pDNS) data allows you to see which IP addresses a domain has resolved to over time, even if the current configuration is different. Sudden IP changes are frequently associated with attempts to conceal infrastructure after abuse is detected.

Step 9: Use Sherlockeye to consolidate the investigation

When the depth and speed of an investigation matter, manually aggregating data from dozens of open sources is time-consuming and increases the risk of missing critical connections. Sherlockeye was designed precisely for this scenario: the platform queries more than 800 open sources simultaneously, cross-references WHOIS records, DNS, certificates, IP reputation, social media profiles, and breach data, and returns a consolidated digital profile of the domain under investigation. For professionals conducting recurring investigations, due diligence reviews, or threat triage at scale, automating this process represents a meaningful difference in both efficiency and coverage.

Step 10: Verify reputation and blocklist status

Search the domain against public blocklists such as Spamhaus, VirusTotal, and URLhaus. Check whether it appears in abuse reports, security forums, or phishing databases. A domain with a history of abuse, even if currently appearing clean, deserves heightened scrutiny.

Red Flags: When a Domain Deserves Immediate Attention

Not every investigation begins with a clear suspicion. Sometimes the registration data itself is the signal. Several patterns that recur consistently among malicious domains are worth knowing:

Very recent registration age. Domains registered fewer than 30 days ago carry significantly elevated risk of being associated with active campaigns. As documented by the APWG, the majority of phishing domains are put into operation within a week of registration.

High-risk registrar. Analysis from the Cybercrime Information Center shows that a disproportionately large share of domains reported for phishing is concentrated among a small number of registrars with more permissive verification policies. Identifying the registrar and checking its abuse history is a relevant triage step.

High-risk TLD. Extensions such as .xyz, .top, .tk, .club, and .icu consistently appear in rankings of domain extensions with the highest proportion of malicious activity. They are not inherently suspicious in isolation, but combined with other factors they raise the risk profile substantially.

Full privacy protection combined with suspicious behavior. Having WHOIS privacy enabled is legitimate and common. But a domain with complete privacy protection, a high-risk TLD, a recent registration date, and suspicious content forms a combination that warrants investigation.

Inconsistent registrant data. When partial data is available and includes generic names, disposable email addresses, or clearly invalid physical addresses, this suggests deliberately false registration information.

Frequent nameserver changes. Rotating DNS infrastructure is a well-established technique for evading tracking. Legitimate domains rarely change their nameservers multiple times within short periods.

The Impact of GDPR and Global Privacy Laws on Domain Lookup

To understand why so many domain records today appear with redacted data, it is necessary to understand the regulatory shifts of recent years.

Before May 2018, anyone could query the WHOIS of any domain and find the registrant's full name, address, email, and phone number. Transparency was total. When the GDPR came into force in the European Union, it established that this data constitutes personally identifiable information and cannot be published without a clear legal basis. The response from most registrars was to adopt default redaction for all individual registrants, regardless of their geographic location, in order to simplify global compliance.

The practical result is that today most public domain records show only the registrar, dates, and nameservers, replacing personal data with markers such as "Redacted for Privacy."

Similar frameworks in other jurisdictions have reinforced this shift. Brazil's LGPD, California's CCPA, and Canada's PIPEDA follow comparable data minimization principles, contributing to a global trend toward privacy-first domain registration practices.

The transition to the RDAP protocol, made mandatory by ICANN in January 2025, introduced a partial solution for legitimate investigators. The ICANN RDRS system allows security researchers, trademark holders, and other professionals with documented justification to formally request access to full registrant data directly from registrars. Approval is not automatic and requires a legal basis, but the channel exists and functions.

For domains using commercial proxy or privacy services rather than GDPR-default redaction, the formal path is to contact the registrar with the justification and request that the information be forwarded to the actual domain owner. In trademark or litigation contexts, WIPO can conduct UDRP proceedings even without the registrant being identified upfront.

Legal and Ethical Considerations

Researching who registered a domain is, in itself, a completely lawful activity. Domain registration data is public by design, and querying it is a right available to any internet user. What varies across jurisdictions is what can be done with that data afterward.

In the United States, there is no federal law that restricts the lookup of public WHOIS data, though using personal data obtained through such lookups to harass, stalk, or harm an individual can trigger liability under state privacy statutes and federal anti-harassment laws. In the European Union, the GDPR governs what happens to any personal data collected, even from public sources, once it enters a processing workflow.

For investigators, compliance officers, and legal teams, a few practical principles apply:

Querying and recording public WHOIS/RDAP data is legitimate for due diligence, information security, brand protection, and fraud investigation purposes. Cross-referencing WHOIS data with other open sources is accepted practice in the OSINT field. However, attempting to obtain GDPR-protected data through unofficial channels, or using data obtained through legitimate lookups for harassment or unauthorized surveillance, constitutes a legal violation.

The line between legitimate investigation and privacy infringement runs through intent and method. Professional investigators should document the purpose of each query and ensure that the chain of custody of any information gathered is preserved, particularly when the data may be used in legal proceedings.

Limitations of Domain Research in 2026

It is important to hold realistic expectations about what a domain lookup can and cannot reveal in 2026.

The most significant limitation is the widespread redaction of personal data. For domains registered by individuals in jurisdictions with data protection legislation, the name, email, and phone number fields are rarely visible. Even for organizations, coverage varies by registrar and TLD.

The second relevant limitation is the use of false data at registration. Criminals who register domains for malicious purposes frequently fill the required fields with invented information. Registrar validation practices vary widely, and many do not verify the accuracy of information provided at the time of registration.

Third, there is the temporal limitation: historical WHOIS data is preserved by specialized services, but not always comprehensively. When a domain is deleted or transferred, parts of the history may be lost depending on the registrar and the period in question.

Finally, country-code TLDs (ccTLDs) follow their own national policies, which vary significantly. A .io domain, for example, operates under entirely different policies than a .de or a .uk. There is no single answer that applies uniformly across all domains.

Frequently Asked Questions

Is it legal to look up who registered a domain?

Yes. Querying publicly available domain registration data via WHOIS or RDAP is completely lawful in any jurisdiction. This data is public by design, and accessing it requires no special authorization. What varies by jurisdiction is how any personal data obtained through the lookup may be processed, stored, and shared afterward, particularly when it involves identifiable information about private individuals.

Why does the WHOIS of most domains show "Redacted for Privacy"?

Starting in 2018, when the GDPR came into force in the European Union, registrars began hiding personal registrant data by default, replacing real information with privacy markers. Most major registrars applied this policy globally, not just for European registrants, to simplify compliance. The practical result is that most public domain records today no longer display the real owner's name, email, or phone number.

How can I find a domain owner when the data is hidden?

When personal data is redacted, several investigative paths remain viable. You can consult historical WHOIS records to check whether data was exposed before privacy was activated. You can analyze the nameservers, IP address, and SSL certificates associated with the domain to connect it to other assets registered by the same entity. If there is a legitimate legal basis such as trademark infringement or fraud investigation, you can formally request registrant data from the registrar through the ICANN RDRS system.

Does GDPR completely prevent identifying a domain owner?

No. The GDPR limits the publication of registrant personal data in public queries, but does not eliminate access entirely. Law enforcement agencies can obtain full data through court orders or formal legal requests. Trademark holders and verified security researchers can request data through the ICANN RDRS. Privacy protection hides information from the general public, but not from competent authorities or parties with documented legitimate interest.

What are nameservers and why are they useful in domain investigations?

Nameservers are the servers responsible for translating a domain name into an IP address. They are rarely covered by privacy services and appear in almost every WHOIS/RDAP response. For investigators, nameservers are valuable because malicious infrastructure operators frequently reuse the same servers across multiple domains. Identifying other domains that share the same nameserver configuration is a classic pivot technique that can reveal an operator's full portfolio of assets.

Is a domain with privacy protection automatically suspicious?

No. WHOIS privacy protection is a common and legitimate practice used by companies, journalists, activists, and individuals who prefer not to have their personal data publicly exposed. The presence of privacy protection alone is not indicative of bad intent. What elevates the suspicion level is the combination of full privacy protection with other risk factors, such as very recent registration, a high-abuse TLD, and suspicious site content or behavior.

What is the difference between WHOIS and RDAP?

WHOIS is the original domain data query protocol, created in 1982, which returns unstructured free-form text that varies unpredictably across registrars. RDAP (Registration Data Access Protocol) is its official replacement, mandatory since January 2025 for all generic top-level domains including .com, .net, and .org. RDAP returns data in standardized JSON format, operates over HTTPS with encryption, and supports tiered access control that allows different levels of visibility for public versus authenticated queries. Most popular lookup tools already use RDAP internally, making the transition largely invisible to end users.

Can I find the owner of a domain even after it has been transferred or expired?

In some cases, yes. Specialized historical WHOIS services archive registration records over time, capturing snapshots before domain transfers, ownership changes, or expiration. If the original registrant had not yet activated privacy protection at the time those snapshots were taken, their data may still be accessible in the historical record. The completeness of this data depends on which archiving services were actively crawling the registrar at the relevant time, so coverage is not guaranteed.

Conclusion

Finding out who is behind a domain has never been more necessary, and never more challenging at the same time. The growing volume of malicious domains, the impact of GDPR and equivalent privacy laws on data visibility, and the transition to RDAP have transformed what was once a two-minute lookup into a process that often requires crossing multiple sources, analyzing historical patterns, and applying OSINT techniques to reach reliable conclusions.

For most everyday situations, the public tools described in this guide provide a solid starting point. For professional investigations that demand depth, speed, and coverage across hundreds of sources simultaneously, Sherlockeye offers the right environment: an OSINT search engine with end-to-end encryption, a maximum 30-day data retention policy, and the ability to automatically correlate domain records with emails, phone numbers, IP addresses, social media profiles, and breach data in a single platform.

Regardless of the sophistication level of your investigation, the starting point is always the same: question, verify, and never assume a website is legitimate just because it looks professional.

Start your investigation now at www.sherlockeye.io