who-owns-this-domain

Who owns this domain

Registration data tells you who bought the name; DNS tells you who runs the service. They are frequently different parties, and conflating them is the mistake that wrecks attribution. Everything here is passive except where flagged — but note that dig aimed at the target's own nameservers lands in the target's query logs, so resolve through a public recursive resolver or passive DNS when you care about being quiet.

Which source first

WHOIS versus RDAP

WHOIS is a plaintext protocol on TCP/43 with no schema. Every registry emits a different field layout, clients follow registry-to-registrar referrals inconsistently, and rate limiting is silent — you get truncation or a block, not an error you can parse.

RDAP is the same registration data over HTTPS as JSON, with real HTTP semantics: 404 for no such object, 429 when you are throttled, and per-object endpoints for domains, nameservers, entities, IPs, and AS numbers. Query it through the bootstrap redirector or the registry directly:

curl -s https://rdap.org/domain/example.com | jq .
curl -s https://rdap.org/ip/203.0.113.10 | jq '.name, .handle, .country'
curl -s https://rdap.org/autnum/64500 | jq '.name, .entities'

Read these fields:

• events — registration, expiration, last changed, transfer. A transfer event long after registration means the current registrar's records start there; anything older lives only in historical WHOIS.
• entities[].roles — registrant, technical, abuse, registrar. The registrar entity carries its IANA ID in publicIds.
• status — EPP codes. clientTransferProhibited is routine. clientHold means the registrar pulled the domain from DNS (nonpayment or an abuse complaint). serverHold means the registry did — usually legal or law-enforcement action. redemptionPeriod and pendingDelete mean it is expiring and about to become available.
• nameservers and secureDNS — operator fingerprint plus DNSSEC posture.