Who Owns a Website When WHOIS Is Private?

6 hours ago

10 min read

In short: When WHOIS is private, you can still find out who is behind a website. First run an RDAP lookup (the successor to WHOIS) at ICANN Lookup for the registration dates and registrar. Then follow the site's other traces: its legal pages, archived versions, tracking codes and security certificates, which often link it to an owner or to other sites.

This is one step of a full investigation. Learn the rest in FIMI 101 → debunkacademy.org Get new investigations by email → debunk.org/subscribe

Also known as: WHOIS lookup; domain owner lookup; RDAP lookup; website ownership check.

Key facts

A WHOIS or RDAP lookup shows a domain's registration and expiry dates, its registrar and status, and the owner only if the owner has not hidden it.
RDAP (Registration Data Access Protocol) replaced WHOIS for generic top-level domains: since 28 January 2025, ICANN no longer requires registries and registrars to offer WHOIS, except for .com, .name and .post.
Most personal data in domain records is now redacted under data-protection rules such as the GDPR, so a hidden owner is normal and not proof of fraud.
Tracking codes such as Google Analytics or Yandex Metrica IDs can link websites run by the same person, because the owner has to add the same account code to each site.
Two websites on the same server are often unrelated: shared hosting puts thousands of sites on one address.
Debunk.org analysis of a fake "Interpol compensation" site, January–February 2025: the domain was registered for one year on 7 January 2025, ads pointing to it began on 13 January, and 278 ads used it in five weeks.

Updated October 2026 · By Debunk.org, an independent non-profit that researches disinformation

Contents: Step 1: Read the site itself · Step 2: WHOIS / RDAP lookup · What replaced WHOIS? · When WHOIS is private · Step 3: Archives · Step 4: Trackers · Step 5: Certificates · Step 6: Hosting and linked domains · Step 7: Ads and social pages · How to unmask a domain owner · Which clues prove a link · Worked example · Is WHOIS legal to use? · FAQ · Sources

Step 1: Read the site itself

The first place to look for a website's owner is the site: its imprint, contact page, terms and privacy policy.

A legitimate business usually names its company, registration number and address. Check that company in the official business register of its country. Scam and propaganda sites often have no company details, a generic "About us" text, or details copied from another business. Also look at payment and checkout pages: the company named by the payment provider can differ from the one on the homepage.

Step 2: Look up the domain (WHOIS / RDAP)

A WHOIS/RDAP lookup shows a domain's creation date, expiry date, registrar and status, and the registrant if the data is public.

Enter the domain in ICANN Lookup, a free tool run by ICANN, the body that coordinates domain names. [1] It returns:

the creation date: a domain created days before an ad campaign is a warning sign;
the expiry date: a one-year registration is cheap and disposable;
the registrar: the company the domain was bought through;
the registrant: often shown as "REDACTED" or as a privacy service.

Why is the owner hidden? Since the EU's General Data Protection Regulation (GDPR) took effect in May 2018, registrars have redacted most personal data from public records under ICANN's rules, and many owners also pay for privacy services. [8] People with a legitimate reason, such as law enforcement or rights holders, can ask the registrar for the hidden data; ICANN launched a free Registration Data Request Service for such requests in November 2023. [3]

Get new investigations by email. debunk.org/subscribe

Next: ownership is one step of an investigation. See the full method in our guide to OSINT techniques and free tools.

What replaced WHOIS? RDAP explained

RDAP (Registration Data Access Protocol) replaced WHOIS as the official source of domain registration data for generic domains in January 2025.

ICANN describes RDAP as delivering "WHOIS-like registration data, but in standardized data access and query response formats", with "support for internationalization, secure access to data" among its other benefits. [2] In practice that means structured answers that software can read, and queries over a secure connection.

ICANN calls RDAP, the Registration Data Access Protocol, "the replacement for the WHOIS protocol". Since 28 January 2025, registries and registrars of generic domains (.org, .info, .site and others) are no longer required to provide WHOIS, except for .com, .name and .post. [2] Country domains such as .lt, .ru or .de follow their own registry's rules, and some withhold even the creation date.

How to find who owns a website when WHOIS is private

When the lookup shows "REDACTED" or a privacy service, move from the registration record to the site's own traces: steps 3 to 7 below.

You can still contact a hidden owner: ICANN's Registration Data Policy, in force since 21 August 2025, requires registrars to "publish an email address or a link to a web form to facilitate email communication with the relevant contact". [10] ICANN noted in May 2026 that some registrars' forms only send the owner a notice that someone is trying to reach them. A hidden registrant is normal and is not proof of fraud. Archived pages may still show an old owner or company; tracking codes and certificates can tie the site to other sites; and ads point to the pages that paid for them.

Step 3: Check the archives

Archived copies of a website show what it looked like before, who it named as its owner then, and when it changed.

The Wayback Machine keeps copies of billions of web pages. Enter the address and pick a date. Look for:

an earlier imprint or contact page that named a company or a person;
a change of topic: a domain that sold furniture last year and "investment software" today has changed hands or purpose;
the first archived date, a rough check on how old the site really is.

Archived pages also keep old tracking codes that have since been removed from the live site (step 4). [4]

Step 4: Check the trackers

Tracking codes link websites to the same owner, because each code belongs to one analytics or advertising account.

Website owners add codes from services such as Google Analytics, Google Tag Manager, Yandex Metrica, the Meta Pixel or Google AdSense to measure visitors or earn money from ads. Each code carries an account number. If two sites carry the same account number, someone with access to that account added it to both: a strong sign of a common owner.

How to check:

Open the page source (right-click → "View page source") and search for UA-, G-, GTM-, pub-, ym( or fbq(.
Search for the same code on other sites with a reverse-lookup service, or in archived copies of the site.
Older Google Analytics codes (UA-1234567-1, UA-1234567-2) share an account root: the number in the middle. Two codes with the same middle number come from one account.

Google's old "UA" properties stopped processing data on 1 July 2023, but archived copies of websites still contain the codes. [9] Bellingcat, the investigative group, publishes a free tool for "scraping current and historic Google Analytics data" from Wayback Machine snapshots. [4]

Step 5: Check the security certificates

Certificate logs list every security (HTTPS) certificate issued for a domain, and sometimes the other domains on the same certificate.

Search the domain on crt.sh, a free search of public Certificate Transparency logs. [7] Each certificate shows the date it was issued and the names it covers. A single certificate that covers several unrelated brand names is a strong sign they are run together. New certificates also show when a site was being set up, sometimes before it went live.

Step 6: Check the hosting and linked domains

Hosting data shows where a site lives; it only points to a common owner when few other sites share the same server.

Look up the site's IP address and hosting provider. Then look for other domains with:

the same server, if that server hosts only a handful of sites;
the same registrar and registration date, sometimes within minutes or seconds: in Debunk.org's WeRedirect investigation, some scam domains "were created within a very similar time frame (sometimes within a few seconds)"; [5]
the same name pattern, page template or website theme.

If a site sits behind a content-delivery network such as Cloudflare, you see the network's address, not the real host.

Step 7: Check ads and social media pages

If you reached a website through an ad, the advertiser's page is another lead to its owner.

Open the advertiser in the Meta Ad Library. The page's transparency section shows when the page was created, whether it changed its name, and the countries its administrators are based in. In one Debunk.org study of scam ads, most pages had administrators based in Lithuania and/or the United States. [6]

How to unmask a domain owner

To unmask a domain owner, look for clues that only the owner could have created and that also appear on sites whose owner is known.

The most useful are: the same analytics or advertising account code on another site (step 4), one security certificate that covers several domains (step 5), an owner or company named on an archived version of the site (step 3), and, for professionals, registrant details in older registration records from before data was redacted. Law enforcement and rights holders can also ask the registrar for the hidden data through ICANN's request service. [3]

Which clues prove a link, and which don't

Investigators separate strong clues, which the owner must create deliberately, from weak ones that thousands of unrelated sites share.

Strength	Clue	Why
Strong	The same analytics or ad account code; one security certificate covering several sites; the same registrant email in old, unredacted records	Only the owner (or someone with access) can create them
Medium	Domains registered through the same registrar within minutes of each other; a dedicated server shared by a few sites; the same custom website theme	Owner choices, but shared by some unrelated sites
Weak	The same registrar; the same large hosting company; Cloudflare; a privacy service	Shared by millions of sites; useful only to narrow a search

Rule of thumb: one strong clue is a lead worth recording; two independent medium clues count as much as one strong one; weak clues never prove a link on their own. Debunk.org applies the same logic when it attributes influence operations; see attribution and confidence levels.

Worked example: a fake "Interpol compensation" site

Debunk.org traced a deepfake scam-ad site in 2025 without ever learning the owner's name, because the pattern was enough.

In early 2025, Debunk.org analysts found deepfake video ads on Facebook in which an AI-generated TV reporter urged "scam victims" to claim compensation from Interpol. The ads led to joversv[.]site. [6]

The site: no company details and no emergency contacts.
Registration: created on 7 January 2025, set to expire on 7 January 2026: a one-year, disposable domain. Ads pointing to it began on 13 January.
Hosting: a private hosting service; the same IP addresses hosted over 700 websites and had previously been associated with phishing.
Ads: 278 ads used the domain between 13 January and 19 February 2025, most staying up only a few hours.

Result: the owner stayed hidden, but the fresh one-year registration, phishing-linked hosting and short-lived ads were enough to identify a fraud site and report it. The ads were removed. [6]

Want to investigate websites and networks like this? FIMI 101 teaches the open-source checks analysts use, with real cases. → Start FIMI 101

Is WHOIS legal to use?

Yes: looking up WHOIS or RDAP records is legal and intended; they are public services, but the personal data that is hidden stays protected.

Registries set conditions on how you use the data. The .nl registry SIDN, for example, says that "if you use Whois information for marketing, that's abuse" and lists "using an automated system to look up information in the Whois" among the forbidden uses. [11] WHOIS/RDAP records, Certificate Transparency logs and the Wayback Machine are public services. What you may not do is break into accounts, pose as someone else to obtain data, or misuse personal data you find. Hidden registrant data can be requested from the registrar only with a legitimate reason. [3] This is general information, not legal advice.

FAQ

How can I find out who owns a domain name for free? Use ICANN Lookup or another WHOIS/RDAP tool. It is free and shows the registrar and dates; the owner appears only if not redacted.

How do I unmask a hidden domain owner? You usually can't see the name directly. Instead, look for the owner's other traces: the site's legal pages, archived versions, shared tracking codes and certificates (steps 1, 3, 4 and 5). Law enforcement and rights holders can request the data from the registrar.

Is a new domain always a scam? No. Every site was new once. A new domain is a warning sign when the site claims a long history or shows other red flags.

Can two sites on the same IP address have the same owner? Sometimes, but shared hosting puts thousands of unrelated sites on one address. Treat it as a weak clue unless only a few sites share the server.

Written by Debunk.org. Updated October 2026. Tools tested on 23 October 2026. Debunk.org is an independent non-profit that researches disinformation and FIMI and an EU Digital Services Act trusted flagger.

Sources

ICANN, Updated lookup tool for domain name registration data now available, 29 July 2019. https://www.icann.org/en/blogs/details/updated-lookup-tool-for-domain-name-registration-data-now-available-29-7-2019-en; ICANN Lookup. https://lookup.icann.org (page loads, checked 23 Oct 2026)
ICANN, Registration Data Access Protocol (RDAP), registry operator resources. https://www.icann.org/en/contracted-parties/registry-operators/resources/registration-data-access-protocol (accessed 23 Oct 2026)
ICANN, ICANN Launches Registration Data Request Service, press release, 28 November 2023. https://www.icann.org/resources/press-material/release-2023-11-28-en; RDRS site https://rdrs.icann.org (online, checked 23 Oct 2026)
Internet Archive, Wayback Machine. https://web.archive.org/; Bellingcat, wayback-google-analytics (free tool). https://github.com/bellingcat/wayback-google-analytics (both checked 23 Oct 2026)
Debunk.org, WeRedirect APT: the large-scale scam attack exposing the elaborate tactics of online scams (Part III), 29 December 2023. https://www.debunk.org/weredirect-apt-the-large-scale-scam-attack-exposing-the-elaborate-tactics-of-online-scams-part-iii
Debunk.org, Bust-AD: Russian-backed deepfake of a Lithuanian 3 Plus news reporter appears on Facebook…, 2 June 2025. https://www.debunk.org/bust-ad-russian-backed-deepfake-of-a-lithuanian-3-plus-news-reporter-appears-on-facebook-urging-s; Debunk.org, Bust-AD: Crypto Ads Scam in Montenegro, 2 December 2024. https://www.debunk.org/bust-ad-crypto-ads-scam-in-montenegro
Certificate Transparency search: crt.sh. https://crt.sh/ (checked 23 Oct 2026)
ICANN Board, resolutions adopting the Temporary Specification for gTLD Registration Data (effective 25 May 2018), special meeting of 21 August 2018 (reaffirmation). https://www.icann.org/en/board-activities-and-meetings/materials/approved-resolutions-special-meeting-of-the-icann-board-21-08-2018-en (accessed 23 Oct 2026)
Google, Google Analytics 4 has replaced Universal Analytics (Analytics Help). https://support.google.com/analytics/answer/11583528 (accessed 23 Oct 2026)
ICANN, Advisory: registrars' use of communication web forms in RDDS, May 2026, quoting the Registration Data Policy (effective 21 August 2025), Section 9.2.3. https://www.icann.org/en/contracted-parties/advisories/advisory-registrars-use-of-communication-web-forms-in-rdds-25-05-2026-en (accessed 23 Oct 2026)
SIDN, Whois conditions of use. https://www.sidn.nl/en/about-sidn/whois-terms-and-conditions-of-use (accessed 23 Oct 2026)