who-owns-this-domainlisted

# Who owns this domain Registration data tells you who bought the name; DNS tells you who runs the service. They are frequently different parties, and conflating them is the mistake that wrecks attribution. Everything here is passive except where flagged — but note that `dig` aimed at the target's own nameservers lands in the target's query logs, so resolve through a public recursive resolver or passive DNS when you care about being quiet. ## Which source first | You hold | Reach for | Why | |---|---|---| | A domain, nothing else | RDAP, then registrar WHOIS | Structured, gives dates + registrar + status in one hit | | Redacted WHOIS | Historical WHOIS + passive DNS | Redaction is not retroactive across archives | | A domain you suspect is one of many | Nameserver pair + MX + reverse WHOIS | Infrastructure reuse outlives contact privacy | | An IP | IP RDAP at the RIR, then ASN lookup | Tells you the netblock holder, not the site owner | | A ccTLD | The registry's own WHOIS/web service | ccTLDs ignore gTLD policy; coverage swings wildly | | A brand-new domain | Creation date + registrar + NS | Age plus a bulk-friendly registrar is the phishing tell | ## WHOIS versus RDAP WHOIS is a plaintext protocol on TCP/43 with no schema. Every registry emits a different field layout, clients follow registry-to-registrar referrals inconsistently, and rate limiting is silent — you get truncation or a block, not an error you can parse. RDAP is the same registration data over HTTPS as J