MyRecon OSINTWHOIS and RDAP Explained: Who Owns a Domain?
Every domain name has a paper trail: when it was registered, through which company, when it expires, and what locks are on it. Since 2018 that record no longer names a person, and investigators who go looking for a name miss the parts that are still there and still useful.
What the registration record actually is
When you register a domain you are buying an entry in a registry's database. The registry runs the top-level domain: Verisign for .com, Nominet for .uk, DENIC for .de. You never deal with the registry directly. You deal with a registrar, which sells the registration and writes it into the registry on your behalf.
WHOIS is the protocol that lets anyone read that entry back. It dates to 1982, it runs on port 43, and it answers in free-form text that every registry formats a little differently. That format is the root of most of its problems: there is no schema, so every tool that reads WHOIS is really a pile of regular expressions guessing at labels that change between registries.
The fields that still matter
Names and addresses are mostly gone. These are not, and they carry more investigative weight than the contact block ever did.
- Creation date. The single most useful field. A domain registered eleven days ago that presents itself as an established retailer is telling you something the website is trying not to. Read the caveat below before you lean on it too hard.
- Registrar. Who sold the registration. Corporate brands tend to sit with corporate registrars, MarkMonitor, CSC, Com Laude, which handle portfolios rather than individuals. A genuine bank is not registered through a promotional reseller.
- Expiry date. Serious owners renew years out. A domain registered for exactly one year, expiring in eleven months, cost the minimum and was meant to.
- Updated date. The last time anything in the record changed. A change days before the site started behaving strangely usually means a transfer, a nameserver change, or a hijack.
- Nameservers. Who answers DNS for the domain. These name the hosting or DNS provider, and they are how you link a domain to infrastructure you have already seen elsewhere in an investigation.
- Status codes. Machine-readable states in the EPP vocabulary, covered in their own section below, because most people skim past the one field that tells you a registry has already intervened.
- DNSSEC. Whether the domain's DNS answers are cryptographically signed. Rare enough outside finance and government that its presence tells you somebody thought about it.
- Registrar abuse contact. Still published, always, even when everything else is redacted, ICANN requires it. It is the address you report a phishing domain to, and almost nobody uses it.
Reading the status codes
Status codes are the most misread part of a registration record. They come in two families: client* codes set by the registrar, and server* codes set by the registry itself. The second family is the interesting one, because a registry does not act on a domain casually.
- clientTransferProhibited, completely normal. Most registrars set it by default to stop unauthorised transfers. Its absence is mildly more interesting than its presence.
- clientHold, the registrar has asked the registry to stop the domain resolving. This is not a technical fault. It usually means an abuse complaint was upheld, or the bill was not paid.
- serverHold, the same thing, imposed by the registry rather than the registrar. Court orders and registry-level enforcement land here.
- pendingDelete and redemptionPeriod, the end of the lifecycle. The registration lapsed and the domain is on its way back to the available pool.
- addPeriod, registered within the last five days. On a domain that is already sending mail or serving a login page, that combination deserves attention.
- ok, no restrictions at all. Fine on a personal site; unusual on anything valuable.
An old creation date is not a clean bill of health. Transferring a domain to a new owner does not reset its creation date, and there is an entire market in aged domains sold precisely because they look established. A 2009 creation date, a nameserver change three weeks ago and a website that has existed for a fortnight is a bought history, not a real one. Check the updated date and the site's archived history against the age before you treat age as trust.
Why the owner's name is missing
Until 2018, WHOIS published the registrant's name, postal address, email and phone number for most domains, and a good deal of the security industry was built on that assumption. The GDPR made publishing that data for European registrants unlawful without a basis for it, and ICANN's response, a Temporary Specification adopted in May 2018, applied redaction broadly rather than trying to sort registrants by geography at query time.
What you generally still get is the organisation name where the registrant is a company rather than a person, the country and sometimes the state, and a forwarding address that relays to the real registrant without revealing them. What you no longer get is an individual.
Separately, and predating all of this, privacy services replace the registrant block with the provider's own details. Seeing one is not a red flag by itself, it is the default at several large registrars, and plenty of ordinary people use it so that their home address is not on a public list. It becomes a signal only in combination: a privacy service on a domain claiming to be a regulated financial institution is a contradiction, because regulated institutions are required to be identifiable.
RDAP: the replacement, and it has already happened
RDAP: the Registration Data Access Protocol, standardised across RFCs 7480 to 7484 in 2015, is what WHOIS became. It is an HTTPS API returning JSON with defined field names, which removes the guesswork: events carry registration and expiry as real timestamps, status carries the EPP codes as an array, and secureDNS states the DNSSEC position outright.
It also solves problems WHOIS never could. Clients find the right server through IANA's bootstrap registry rather than a hardcoded list. Internationalised data has a defined encoding. Access control is possible, so a registry can in principle show more to an authenticated requester with a legitimate interest than to the public, the mechanism that makes redaction something other than a dead end.
ICANN required gTLD registries and registrars to run RDAP from 2019, and in January 2025 the obligation to keep port-43 WHOIS running ended. For .com, .org, .net and the rest of the gTLDs, RDAP is now the record and WHOIS is a courtesy that some providers still offer.
Country-code domains are their own countries in every sense. Many ccTLD registries offer RDAP, some do not, and several restrict lookups or rate-limit them heavily. MyRecon's domain tool queries RDAP first and reports plainly when a registry does not answer, rather than filling the gap with a guess.
WHOIS is not DNS. The registration record tells you about the contract: who registered the name, when, through whom, and what state it is in. DNS tells you how the name currently resolves: its servers, its mail, its verification records. A domain can have an immaculate registration and point at a server that went up yesterday. Read both; our guide to DNS records covers the other half.
A practical reading order
Given a domain you do not trust, this sequence gets you to a judgement in a couple of minutes.
- Creation date against the claim. Does the age of the registration match the age the site claims for itself? Note the gap, in either direction.
- Updated date. Did anything change recently, and does that change line up with when the site appeared?
- Registrar and registration length. The cheapest option for the shortest term is the profile of something disposable.
- Status codes. Any serverHold or clientHold means somebody has already complained and been believed.
- Nameservers. Do they match the hosting the site actually uses, and have you seen them on other domains in the same investigation?
- Then leave the record. Registration data narrows the question; it does not answer it. Pair it with DNS, certificate history and the content itself.
What the record cannot tell you
It cannot tell you who is behind a domain, in almost every case, and treating a privacy service or a redaction as evasion will make you wrong regularly. It cannot tell you whether a site is malicious: plenty of criminal infrastructure sits on clean, aged, fully locked registrations, and plenty of legitimate small businesses look exactly like something disposable because they registered a domain for a year and never thought about it again.
What it gives you is a set of facts with dates attached, which is worth more than it sounds. Most fraudulent infrastructure is new, cheap and in a hurry, and the registration record is where being new, cheap and in a hurry shows up first.
Look up any domain's live RDAP record with the MyRecon domain tool: registrar, dates, status codes, DNSSEC state and nameservers, returned as the registry reports them.