To find out who owns a website domain, start with ICANN’s free lookup tool at lookup.icann.org, which queries the registrar’s live database and returns the registration record. Since 2018, privacy regulations have required registrars to redact the registrant’s name, address, phone, and email from most public records, so a lookup today usually tells you the registrar, the dates, and the hosting setup but not the person behind the domain.1ICANN. Registration Data Policy When the name is hidden, you can still reach the owner through the registrar’s forwarding system, pull their identity from the site’s own disclosures and public business filings, or compel disclosure through a subpoena if you have a legal claim.
What It Means to Own a Domain
A domain name is a licensed asset, not property you hold outright. The person or organization listed in the registrant field of the registration record is treated as the owner and controls transfers, modifications, and renewal. Whoever appears there holds the rights, regardless of who paid for the domain or who built the site. If you hired a developer to register a domain for you and their name went into the registrant field, they are the legal holder until the record is corrected.
Registrars operate under ICANN’s Registrar Accreditation Agreement, which requires registrants to supply accurate contact details and update them within seven days of any change. Willfully false information, or ignoring a registrar’s inquiry about accuracy for more than 15 days, is a material breach that can lead to suspension or cancellation of the domain.2Internet Corporation for Assigned Names and Numbers. 2013 Registrar Accreditation Agreement
Start With a Lookup at ICANN
ICANN’s lookup tool is the most reliable starting point because it pulls data directly from the registry operator or registrar in real time. Type the domain into the search box and the tool returns whatever registration data the registrar is willing to publish.3ICANN Lookup. ICANN Lookup
You’ll sometimes see this called a WHOIS lookup. As of January 2025, ICANN officially replaced the older WHOIS protocol with the Registration Data Access Protocol, or RDAP, which returns the same information in a more structured form.4ICANN. ICANN Update: Launching RDAP; Sunsetting WHOIS The tool at lookup.icann.org handles the switch for you and falls back to any remaining WHOIS service if RDAP data isn’t available for a particular domain.
What a Lookup Shows and What Stays Hidden
Under ICANN’s Registration Data Policy, certain fields are always public: the domain itself, the sponsoring registrar’s name and contact information, the creation and expiration dates, the current status codes, and the nameservers pointing to the site’s host. The registrant’s country and state or province are also typically shown.1ICANN. Registration Data Policy
Personal identifying details are a different matter. When GDPR took effect in 2018, ICANN introduced a temporary specification allowing redaction of personal data from public records. That temporary measure has since been replaced by the permanent Registration Data Policy, which requires registrars to redact registrant names, street addresses, phone numbers, and email addresses unless the registrant consents to publication or the registrar determines disclosure is appropriate under applicable law.1ICANN. Registration Data Policy Where the registrant’s name once appeared, you’ll see a notice like “REDACTED FOR PRIVACY.” The registrant’s organization name may still appear if one was provided, but it’s also subject to redaction depending on the registrar’s privacy practices.
So in practice: a lookup today reliably tells you which registrar manages the domain, when it was registered and when it expires, where the site is hosted, and what country the registrant is in. It rarely gives you a name without additional steps.
Why the Name Is Often Missing: Privacy and Proxy Services
Even before GDPR, many registrants paid for privacy or proxy services to keep their identities out of the public record. Both still exist, usually costing $5 to $15 per year on top of the registration fee, and they work differently.
A privacy service keeps the registrant as the legal domain holder but replaces their personal contact details with those of a masking company. The real name stays in the registrant field behind the scenes; the public record shows a forwarding email and the privacy company’s mailing address. A proxy service goes further: the proxy company itself becomes the registrant of record and licenses the domain back to the customer through a separate agreement. Under ICANN’s definitions, the proxy provider holds the registrant’s rights and responsibilities, so even the registrant field points to someone other than the real controller.5Internet Corporation for Assigned Names and Numbers. Information for Privacy and Proxy Service Providers, Customers and Registrars
For someone trying to identify who’s behind a domain, the practical result is the same in both cases: the public record won’t give you a name.
Reaching the Owner Through the Registrar
When a lookup returns redacted data, the registrar is your best route to the person behind the domain. Every lookup result identifies the sponsoring registrar and includes an abuse contact email and phone number. Many registrars also maintain web forms or anonymized email forwarding that relays your message to the registrant without revealing their identity to you.
This channel is designed for legitimate purposes: business inquiries, intellectual property concerns, or technical coordination. The registrar won’t hand over the owner’s name or contact details just because you ask. But the forwarding mechanism means the domain holder remains reachable even when they’ve chosen maximum privacy. If a registrar doesn’t provide a working communication path, you can file a complaint with ICANN, since maintaining reliable contact channels is part of their accreditation obligations.
Getting a Name Through Legal Process
If you need the actual identity behind a privacy-protected or proxy-registered domain for a legal matter, the standard route is a subpoena served on the registrar or privacy service provider. Courts regularly issue these in trademark disputes, fraud investigations, and defamation cases. The subpoena can request billing records, account holder names, and other identifying documents the registrar collected during registration.
Registrars generally notify the affected customer before disclosing anything, giving them an opportunity to object. The process isn’t instant. Expect roughly 30 days for a response from major providers once a valid subpoena is served. If the registrant objects, a court may need to weigh the competing interests before ordering disclosure.
Finding the Owner Through the Site Itself
When lookup data is redacted and you don’t have grounds for a subpoena, the website itself often reveals who runs it. Commercial sites in particular tend to identify their operators somewhere, because they want customers to find them.
- Privacy policies and terms of service often name the legal entity operating the site and the jurisdiction where it’s incorporated. Many businesses identify themselves in these documents either voluntarily or to comply with disclosure rules about data collection practices.
- Footer and “About” pages carry copyright notices, company names, and parent organizations.
- Trademark filings can connect a site’s distinctive logo or brand name to the individual or corporation that filed the application. The U.S. Patent and Trademark Office’s database at uspto.gov is searchable for free.
- State business registrations let you verify a named company’s owners, officers, and registered agent through the Secretary of State’s office in most states.
- Reverse IP lookups, through tools such as DomainTools’ Reverse IP Lookup, show other domains hosted on the same server. If the target domain shares an IP with sites that do have unredacted records or identifiable operators, you may find a connection back to the person you’re looking for.
If the Domain Infringes Your Trademark
Finding the owner is a different problem from doing something about a domain that infringes your rights. If someone has registered a name that trades on your trademark, two mechanisms are built for this situation.
The Uniform Domain-Name Dispute-Resolution Policy, or UDRP, is a faster and cheaper alternative to federal litigation. UDRP proceedings are mandatory for all registrants of generic top-level domains, because the registrant agreed to participate as a condition of registration.6ICANN. Uniform Domain Name Dispute Resolution Policy To win, the complainant must prove all three of the following:
- The domain is identical or confusingly similar to a trademark in which the complainant has rights.
- The current registrant has no rights or legitimate interests in the domain name.
- The domain was registered and is being used in bad faith.
A domain confusingly similar to your trademark but registered by someone with a plausible independent reason to use it will likely survive a UDRP challenge.6ICANN. Uniform Domain Name Dispute Resolution Policy Cases are handled by approved dispute-resolution providers, with the World Intellectual Property Organization the most widely used. WIPO filing fees for a single-panelist decision on one to five domain names run $1,500; a three-member panel costs $4,000.7World Intellectual Property Organization. Schedule of Fees under the UDRP The proceeding is conducted online and typically resolved within about two months. If the panel rules for the complainant, the registrar will cancel or transfer the domain.
For bad-faith registrations where you want money as well as the domain, the Anticybersquatting Consumer Protection Act gives a federal cause of action. Under 15 U.S.C. ยง 1125(d), a trademark owner can sue someone who registers, traffics in, or uses a domain identical or confusingly similar to their mark with bad faith intent to profit.8Office of the Law Revision Counsel. 15 U.S. Code 1125 – False Designations of Origin, False Descriptions, and Dilution Forbidden Courts weigh factors including whether the registrant has any trademark rights of their own, offered to sell the domain for a profit, provided false contact information during registration, or built a pattern of registering domains that match other people’s marks. A plaintiff can elect statutory damages instead of proving actual losses, ranging from $1,000 to $100,000 per domain name at the court’s discretion.9Office of the Law Revision Counsel. 15 USC 1117 – Recovery for Violation of Rights The ACPA requires federal court filing, higher legal costs, and more time. Most trademark holders start with a UDRP complaint and escalate only if the conduct warrants it or the UDRP panel rules against them.
If You Want to Buy the Domain
Once you’ve identified who owns a domain and you want to acquire it, the transaction is a negotiation, not a purchase at a listed price. Values range from a few hundred dollars for generic names to millions for premium short keywords.
Reach out through the registrar’s contact forwarding system or any email address listed on the site itself. If the owner is interested in selling, the standard process uses an escrow service. Escrow.com is the most widely used platform for domain transactions and follows a straightforward sequence: buyer and seller agree on a price, the buyer deposits funds with the escrow service, the seller transfers the domain, the buyer verifies receipt, and the escrow service releases payment.
Escrow matters because domain transfers are irreversible once completed. The service verifies ownership and identities, holds funds during the transfer window, and gives the buyer an inspection period to confirm the domain is working correctly before money changes hands. A written purchase agreement should spell out exactly what’s included: just the domain, the domain plus website content, or associated trademarks and social media accounts.