To check who owns a website, run the domain through ICANN’s free lookup tool at lookup.icann.org. Type in the full domain name, and the tool pulls the registration record from the domain’s registrar, showing the owner’s name, contact details, and registration dates when that information is publicly available. Many domains now hide those details behind privacy services, so if the first lookup comes back redacted, you have several other ways to identify the person or company behind the site.
Start With the ICANN Lookup Tool
The most reliable starting point is lookup.icann.org. It queries registrar databases in real time using the Registration Data Access Protocol (RDAP), and if RDAP data isn’t available for a particular domain, the tool automatically falls back to a WHOIS lookup.1ICANN. Registration Data Lookup Tool Frequently Asked Questions Type the full domain name (like “example.com”) into the search field and hit enter. Results appear almost instantly.
As of January 28, 2025, ICANN officially replaced WHOIS with RDAP as the standard way to look up domain registration data for generic top-level domains.2ICANN. ICANN Update: Launching RDAP; Sunsetting WHOIS You don’t need to care about the plumbing; the lookup tool handles both. Most domain registrars also offer their own lookup pages that pull from the same underlying data, so the results will match in substance.
One boundary worth knowing: these tools cover generic top-level domains like .com, .org, .net, and newer extensions like .shop or .io. Country-code domains such as .uk, .de, or .ca have their own separate registries with different lookup tools and disclosure rules.
What the Record Shows
A full registration record lists the registrant (the actual owner), along with administrative, technical, and sometimes billing contacts. Each contact can include a name, physical address, email, and phone number. The record also shows when the domain was first registered, when it was last updated, and when it expires. Those dates help you judge how long a site has been around and whether the owner is actively maintaining it. Name servers at the bottom of the record tell you which hosting provider is directing traffic to the site.
When the Record Says “Redacted for Privacy”
If your lookup returns “Redacted for Privacy” instead of a name and address, the domain owner is using a privacy or proxy service. The General Data Protection Regulation (GDPR), which took effect in the EU in 2018, restricts the public display of personal data in registration records.3World Intellectual Property Organization. Q&A: Domain Name Registrant Data and the UDRP ICANN responded by allowing registrars to redact personal information from public view and requiring anyone who needs that data to request it through specific channels.4ICANN. ICANN Board Approves Temporary Specification for gTLD Registration Data
The practical result: most domain records now show redacted details. Many registrars include privacy protection free with every registration, and those that charge separately typically price it under $15 per year. Domain owners can opt to make their contact information public, but few do. This is the single biggest obstacle to identifying a website owner, and it’s why the methods below matter.
Request Non-Public Data Through RDRS
If you have a legitimate legal reason to know who owns a privacy-protected domain, ICANN operates the Registration Data Request Service (RDRS) at rdrs.icann.org. It’s designed for intellectual property professionals, cybersecurity researchers, and others with a valid legal basis for accessing non-public registration data.5ICANN. Frequently Asked Questions for the Registration Data Request Service (RDRS) for Requestors
Check the ICANN Lookup tool first to confirm the data you need isn’t already public.6ICANN. Registration Data Request Service If it’s not, submit a ticket through the RDRS explaining who you are and why you need the data. The registrar then decides whether to disclose based on applicable law. Participation in RDRS is voluntary for registrars, so not all of them use it. For non-participating registrars, you’d need to contact them directly or pursue a legal subpoena. Access to registration data remains a core investigative tool for law enforcement in fraud and cybercrime cases.7Federal Bureau of Investigation. The Whois Database and Cybercrime Investigation
Look for Ownership Clues on the Site Itself
When the registration data is locked down, the website’s own pages often reveal who’s running it. Worth checking, roughly in order of reliability:
- Terms of Service and Privacy Policy pages frequently name the legal entity operating the site, often with a registered business address and jurisdiction.
- Footer and copyright notices like “© 2026 Acme Corp” identify the company claiming ownership of the content.
- Contact and About pages may list a physical office address, a registered agent, or company officers by name.
- Sites based in Germany, Austria, or Switzerland are legally required to publish an Impressum identifying the owner’s name, business address, registration number, and contact information. If one exists, it’s the most direct disclosure you’ll find.
These clues are most useful for established businesses that want customers to find them. Fly-by-night operations and fraudulent sites will typically have sparse or fabricated information in these sections, which is itself a red flag.
Check the SSL Certificate
A site’s SSL certificate can sometimes reveal ownership, depending on the type. Domain Validation (DV) certificates confirm only the domain itself and won’t tell you anything about the owner. Organization Validation (OV) and Extended Validation (EV) certificates require the certificate authority to verify the company’s legal name, location, and phone number before issuing.
To view certificate details in most browsers, click the padlock or tune icon near the URL bar, then look for a “Certificate” or “Connection is secure” option. In the certificate’s details or subject field, an OV or EV certificate will display the organization name and location. If you see only a domain name with no organization listed, the site is using a DV certificate and this approach won’t help. Most small websites use DV because it’s cheaper and easier, so this method works best for larger businesses and government sites.
Trace a Company Name Through Business Records
When a lookup reveals a company name rather than an individual, you can dig deeper through public business records. Every state maintains a Secretary of State (or equivalent) database where corporations, LLCs, and limited partnerships file formation documents. A search by company name typically returns the registered agent, principal office address, and sometimes the names of officers or directors. Most of these searches are free online.
The trick is knowing which state to search. Start with the state listed in the domain’s registration record or on the site’s legal pages. Delaware LLCs are common across businesses of all sizes, so the Delaware Division of Corporations database is often a good second check. Many companies also file in the state where they physically operate, so checking both the formation state and the headquarters state can fill in gaps.
Reverse Lookups and Historical Records
A standard lookup starts with the domain and returns the owner. A reverse lookup works the other direction: you enter a person’s name, email address, or company name, and the tool returns all domains associated with that information. It’s useful when you’ve identified an owner and want to see what else they control, or when you suspect the same entity is behind multiple sites. Several commercial services offer reverse domain lookups, though most require a paid subscription for full results.
Historical records can also reveal past owners. Commercial investigation platforms have archived registration data going back to the mid-1990s, capturing ownership details that existed before privacy services became standard. Cybersecurity investigators and trademark professionals use historical lookups to trace ownership changes or to identify who originally held a domain before privacy was applied. This archived data often gives the clearest picture of who registered a domain in the first place, even when current records are redacted.
Report Registration Data That Looks Fake
If a domain’s registration data is clearly false or intentionally misleading, the registrar can act. Under ICANN policy, providing false registration information is grounds for the domain’s suspension or cancellation.8ICANN. FAQs: Domain Name Registrant Contact Information and ICANN’s Registration Data Reminder Policy (RDRP) You can report suspected inaccurate data by contacting the sponsoring registrar directly; the registrar’s name appears in every ICANN lookup result. If the registrar doesn’t act, ICANN itself has a complaint process for registration data accuracy. Fraudulent registration data is common on phishing sites and scam domains, and reporting it can lead to the domain being taken offline.