--- title: Who owns this domain? How to find out with the Whois Lookup description: A link in an email, a lookalike of your brand, a name you want to buy: first you want to know who is behind the domain. To find who owns a domain, run a Whois (RDAP) lookup: it shows the registrar, when the domain was registered, when it expires and how it is locked, while the owner's personal details are usually redacted. Here's how to read a real lookup, how to reach a hidden owner, and the curl commands that go one step further. canonical: https://watchfor.io/blog/how-to-find-who-owns-a-domain --- # Who owns this domain? How to find out with the Whois Lookup 2026-10-04 · WatchFor Team · Guides · guides, dns, security A link in an email, a lookalike of your brand, a name you want to buy: first you want to know who is behind the domain. To find who owns a domain, run a Whois (RDAP) lookup: it shows the registrar, when the domain was registered, when it expires and how it is locked, while the owner's personal details are usually redacted. Here's how to read a real lookup, how to reach a hidden owner, and the curl commands that go one step further. To find who owns a domain, look up its registration data with a Whois or RDAP lookup. You get the registrar it is registered through, the date it was created, its expiry date, its status locks and its nameservers. The owner's name, email and address are usually redacted for privacy, so the registrar is your route to the owner: you contact them through the registrar, or ask the registrar for the data. The free [Whois Lookup](/whois-lookup) asks the registry's RDAP service directly, with no cache in between, and shows the answer in a second. No signup. ## What this tool answers *Who is this domain registered through, how old is it, and is it locked?* Reach for it when an email links to a domain you don't recognise, when someone registers a lookalike of your brand, before you try to buy a name, or when you need the registrar to send an abuse report. Age and registrar settle most of these questions on their own: a well-known brand's domain is usually years old and sits at a brand-protection registrar, while a phishing domain is often only days or weeks old. ## A real example ### Finding who owns a domain when a link looks suspicious A frequent situation: an email says it's from GitHub and links to a GitHub address, and you want to confirm the domain really belongs to GitHub before you sign in. We checked the real one to show what a long-established, legitimate registration looks like. In the [Whois Lookup](/whois-lookup) we typed `github.com` and pressed **Run lookup**: ![The Whois Lookup result for github.com: 736 days until expiry from RDAP, registrar MarkMonitor Inc., expires Mon 09 Oct 2028, created 2007-10-09, updated 2026-09-07, eight nameservers (four at nsone.net and four at awsdns) and the status flags client delete, transfer and update prohibited](/blog/how-to-find-who-owns-a-domain-result.webp) The registry answered over RDAP in 587 ms: - **Registrar: MarkMonitor Inc.**, a registrar that specialises in large brands' domains. - **Created 2007-10-09**, so the registration is almost 19 years old. - **Expires 2028-10-09**, 736 days away, shown green. - **Three client locks**: delete, transfer and update prohibited. - **Eight nameservers**, four at NS1 and four at Amazon Route 53. No owner name appears, because the `.com` registry only holds the registrar's part of the record. The owner's details live at the registrar, and MarkMonitor's own RDAP service (see the command line section) shows the registrant organisation as **GitHub, Inc.** with the person's name and address redacted. **The answer:** `github.com` is a 19-year-old registration at a brand-protection registrar, locked against transfer and deletion, and the registrar names GitHub, Inc. as the registrant. That's the domain you want to see. A lookalike in the same email that was created last week at a budget registrar is a strong phishing signal; report it to that registrar's abuse contact. ## How to read the results | Field | What it means | | --- | --- | | **Days until expiry** | Days left before the registration expires. Green at 45 or more, amber from 14 to 44, red under 14. A dash means the registry didn't publish an expiry date. | | **RDAP / WHOIS chip** | Where the data came from. RDAP is the structured, modern protocol; WHOIS is the fallback for registries without RDAP. | | **Registrar** | The company the domain is registered through. This is who you contact for abuse reports, transfers or data requests. | | **Expires** | The expiry date and time in UTC, as the registry holds it. | | **Created** | When the domain was first registered. It survives transfers between registrars, but not a drop and re-registration. | | **Updated** | The last change to the registration: a renewal, new nameservers, a status change. | | **Nameservers** | The servers the registry delegates DNS to. They tell you which DNS provider hosts the zone. | | **Status flags** | EPP status codes. `client … prohibited` locks are set by the registrar; `server … prohibited` locks are set by the registry and need extra verification to lift. | The tool doesn't show registrant contacts. Even where a registrar publishes them, they're usually redacted, so the lookup focuses on the fields that are reliably public. ## More ways to use it - **Checking a lookalike of your brand.** Look up `yourbrand-login.com` or a misspelling. A fresh creation date and an unfamiliar registrar tell you it's worth a takedown request; the registrar is who you send it to. - **Before buying a domain.** A domain that expires soon, or shows `pending delete`, may come free; one with years left and locks won't. The [domain expiry guide](/blog/how-to-check-when-a-domain-expires) covers the lifecycle. - **Finding the DNS provider.** The nameservers tell you whether a site's DNS sits at Cloudflare, Route 53, Akamai or the registrar itself, which is where to look when records misbehave. - **Vetting a vendor or a cold email.** A company that claims ten years in business but whose domain is two months old deserves a second look. - **Confirming your own registration.** Check that your domains carry transfer locks and the right nameservers, and sit at the registrar you think they do. ## Tips and gotchas - **Redaction is the norm.** Since ICANN's 2018 rules, registrars redact personal data for most generic TLDs. To reach a hidden owner, use the registrar's contact form or anonymised email, or file a request through ICANN's [Registration Data Request Service](https://rdrs.icann.org/). - **WHOIS is being retired.** Since 28 January 2025, RDAP has been the [definitive source](https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en) for generic TLD registration data. Some old port-43 WHOIS servers return less, or nothing at all. - **Country-code domains differ.** Each ccTLD registry sets its own rules. Some publish no expiry date, which the tool shows as a dash instead of a made-up number. - **The registrant isn't always the operator.** Agencies, resellers and privacy services register domains on others' behalf. Treat the registrant organisation as a clue, not proof. - **Creation date resets on re-registration.** A domain that expired and was bought again shows the new date, so an old name can look brand new. - **Lookups are rate-limited at the source.** Registries throttle RDAP queries, so don't script hundreds of lookups through any tool. ## Check it from the command line too The registry's RDAP answer is plain JSON. For `.com` it comes from Verisign: ```bash curl -s https://rdap.verisign.com/com/v1/domain/github.com \ | jq -r '.events[] | "\(.eventAction) \(.eventDate)"' ``` ```text registration 2007-10-09T18:20:50Z expiration 2028-10-09T18:20:50Z last changed 2026-09-07T09:22:52Z last update of RDAP database 2026-10-03T22:21:44Z ``` The registry response links to the registrar's own RDAP record, which is where the registrant data lives: ```bash curl -s https://rdap.verisign.com/com/v1/domain/github.com \ | jq -r '.links[] | select(.rel=="related") | .href' curl -s https://rdap.markmonitor.com/rdap/domain/GITHUB.COM \ | jq -r '.entities[] | select(.roles|index("registrant")) | .vcardArray[1][] | select(.[0]=="org" or .[0]=="fn") | "\(.[0]): \(.[3])"' ``` ```text https://rdap.markmonitor.com/rdap/domain/GITHUB.COM fn: REDACTED REGISTRANT org: GitHub, Inc. ``` For any TLD, `https://rdap.org/domain/` redirects to the right registry, and ICANN's [lookup page](https://lookup.icann.org/) does the same in a browser. ## Keep watching it A lookup is a snapshot. A [domain expiry monitor](/domain-expiry-monitoring) re-reads the registration from RDAP (with a WHOIS fallback) on a schedule, shows the registrar, nameservers and status codes, and opens an incident before the expiry date, 30 days out by default, with optional reminders closer to the day. That covers the domains you own; for a lookalike of your brand, re-run this lookup when you file the report, since the registrar's answer is what counts. ## FAQ **Can I find out who owns a domain for free?** Yes. Any Whois or RDAP lookup is free and shows the registrar, dates, status and nameservers. The owner's name and contact details are usually redacted, so the next step is the registrar's contact form or a data request. **Why does the Whois say "redacted for privacy"?** Registrars hide personal data for most generic domains under ICANN's registration data rules, introduced with the GDPR in 2018. Organisations sometimes stay visible, as GitHub, Inc. does at MarkMonitor. **How do I contact the owner of a domain?** Use the registrar shown in the lookup: most offer a contact form or an anonymised email that forwards to the registrant. For legal or abuse matters, write to the registrar's abuse contact or use ICANN's Registration Data Request Service. The [domain spoofing guide](/blog/domain-spoofing) covers what to do about lookalikes. --- Canonical page: https://watchfor.io/blog/how-to-find-who-owns-a-domain · All articles: https://watchfor.io/blog/all.md · Site guide: https://watchfor.io/llms.txt