How to Find Out Who Owns a Website (WHOIS Made Simple)

Short answer: Run the domain through a WHOIS lookup tool (ICANN Lookup, who.is, or your registrar’s search), then confirm what the record leaves visible. For most .com and country-specific domains registered after 2018, the owner’s name and address are redacted for privacy, but you can still see the registrar, the creation date, and often a contact form or proxy email. Combining that with a trust signal check on Webwiki tells you in about two minutes whether the site is safe enough to interact with.

Why anyone would want to know who owns a website

A domain’s public record is one of the fastest ways to sanity-check a site. Before you enter card details on a shop you’ve never heard of, before you reply to a business proposal, before you install a plugin from a random developer, a 20-second WHOIS lookup can spare you weeks of headache. This guide walks through exactly what a WHOIS record shows in 2026, what changed after GDPR, and which free tools give you honest data instead of upselling you.

Ownership research also plays into a larger trust workflow. We covered the checklist in How to Tell If a Website Is Trustworthy, the specific scam patterns in 12 Warning Signs a Website Is a Scam, and the fastest possible check in Verifying a Website in Under 2 Minutes. WHOIS is the piece that answers one specific question the others can only guess at: who is legally responsible for this thing?

What a WHOIS record actually contains in 2026

WHOIS is not a single database. It’s a protocol that every domain registrar has to expose, and the record for any given domain lives with the registrar that sold it. In 2026 a typical record shows the following fields:

• Domain name and its status codes (e.g. clientTransferProhibited, which means the current owner has locked it against unauthorized transfer).
• Registrar: the company that sold the domain, e.g. GoDaddy, Namecheap, IONOS, Cloudflare Registrar.
• Creation date, updated date, and expiration date.
• Name servers: usually four to eight hostnames that point to whoever hosts the DNS.
• Registrant, Admin, and Tech contact: since GDPR took effect in May 2018 these are almost always redacted for individual owners in Europe. Business domains outside the EU often still show a company name and country. For .de domains, DENIC has redacted registrant details for private holders since 2018 too.
• DNSSEC status: whether the domain is cryptographically signed.

Three data points worth remembering because they surface repeatedly in trust decisions: ICANN’s 2024 transparency report showed that roughly 57 percent of gTLD WHOIS records now return redacted contact fields, up from about 20 percent in 2017. The Anti-Phishing Working Group’s Phishing Activity Trends Report H2 2024 recorded 1,003,924 phishing attacks in Q4 2024 alone, and analysis of the underlying domains showed a median age of under 30 days. That last figure is why the creation date is often more useful than the redacted name: a “boutique” clothing shop whose domain was registered nine days ago is a red flag no fancy landing page can hide.

Five free tools that give you an honest WHOIS lookup

1. ICANN Lookup (lookup.icann.org)

The neutral, ad-free option run by the body that oversees domain governance. It covers all generic TLDs and most country codes. Best for a clean, first-pass check when you don’t want a tool that immediately tries to sell you a domain or a security scan.

2. who.is

The workhorse for quick lookups. Clean output, decent history view, and it flags registrar-lock status prominently. It is ad-supported and pushes affiliate offers, so ignore the sidebars.

3. Your registrar’s own WHOIS search

GoDaddy, Namecheap, IONOS, and Cloudflare all run WHOIS interfaces that sometimes surface more historical data than third-party sites. Cloudflare’s is particularly clean for domains it manages.

4. DomainTools (limited free tier)

For .com history and reverse-WHOIS queries (finding all domains linked to one email or organization). The full product is enterprise-priced, but the free lookup will still show what a normal user needs.

5. Command-line whois

On macOS and Linux the built-in whois example.com command returns the raw record with zero interpretation. If you distrust web tools, this is the ground truth.

What to do when the owner is redacted (which is most of the time now)

GDPR and equivalent privacy rules have hidden the identifiable owner data for the majority of consumer domains. That’s not a wall, it’s a puzzle. Here is the sequence we run when the record is redacted:

1. Note the registrar and the age. A domain registered last month with a bargain-basement registrar behaves very differently from a domain registered in 2011 with a mainstream registrar. Combine this with the imprint or “About” page if the site claims to be an established business.
2. Follow the abuse contact. Every WHOIS record includes an abuse email at the registrar level (e.g. ab***@*******ar.com). If the site is defrauding people, that inbox is where complaints land.
3. Reverse-lookup the name servers. Some shady operators host dozens of scam shops on the same custom name servers. Free tools like ViewDNS.info’s reverse NS search will show you the neighbors.
4. Cross-check with a directory. Search the domain on Webwiki. If real customers have left reviews, that reveals more about the operator than any WHOIS field.
5. Use archive.org. Paste the domain into web.archive.org. A shop that claims a 2015 heritage but has no captures before this year is almost certainly rebranded from something else, often something you would rather not do business with.

Country-specific quirks worth knowing

• .de domains: The DENIC WHOIS at whois.denic.de returns nearly no personal data for private holders, but the technical status field is exhaustive. For business holders, the imprint on the site itself is legally required under German law and usually more complete than the WHOIS.
• .uk domains: Nominet redacts personal registrants but shows organization names by default. Their public WHOIS is at lookup.nominet.uk.
• .eu domains: EURid uses a captcha-gated web WHOIS. Personal registrants are hidden; organizations appear if they consented.
• .io, .ai, .co and other trendy TLDs: These sit under their respective national registries but are usually resold via mainstream registrars. Data quality varies, so cross-check with a second tool.
• Privacy proxies: Services like Domains By Proxy, Withheld for Privacy (Namecheap), and Contact Privacy Inc. (Google Domains legacy, now Squarespace) replace the real owner with a proxy contact. That’s not the same as GDPR redaction, but the practical effect is similar.

The unique-POV bit: three trust signals a WHOIS lookup will never give you

Most guides stop at “look up WHOIS.” Here’s what six years of running trust workflows across hundreds of consumer complaints have taught us that a WHOIS record alone will not tell you:

1. Reputation is behavioral, not registered. A domain registered in 2003 that changed hands twice, was parked for four years, and now sells health supplements is functionally a brand-new site. WHOIS shows the age, not the continuity. Cross-check with the Wayback Machine.
2. The registrar matters more than most people think. Fraudulent operations gravitate toward a small set of registrars that are slow to enforce abuse complaints. If a shop’s WHOIS lists a registrar you’ve never heard of and the site is asking for card details, add friction and pay with a virtual card or a service like PayPal instead.
3. Consistency across sources is the real signal. A legitimate business will have consistent names across the WHOIS (where visible), the imprint, the SSL certificate’s issued-to field, and the payment descriptor on your bank statement. Scam shops usually break down at one of those handoffs. Running the domain through our 2-minute verification workflow will surface those inconsistencies faster than reading a WHOIS record ever will.

Frequently asked questions

Is WHOIS still legal to use after GDPR?

Yes. WHOIS itself is required by ICANN’s Registration Data Access Protocol (RDAP) mandate, which took effect fully in January 2025. What GDPR restricts is how much personal data can be shown by default to anonymous queries. Law enforcement and legitimate researchers can still request full records through the registrar with proper cause.

Can I hide my own website’s WHOIS data?

For personal registrations you don’t need to: most registrars redact it automatically for EU customers, and many now do it worldwide. For businesses in Germany and much of the EU, the imprint on your site is a separate legal requirement, so hiding WHOIS won’t hide you.

What does “clientTransferProhibited” mean in a WHOIS record?

It means the current owner has locked the domain against unauthorized transfers to another registrar. It is normal on healthy domains, and it’s a mild positive signal because scam operators sometimes leave the lock off to allow quick moves.

Why do some domains show contact details and others don’t?

Business registrants outside the EU, older domains registered before privacy protections became widespread, and domains explicitly registered with public contact info still show data. Everything else is now redacted by default in most gTLDs.

Is a hidden WHOIS a red flag?

No. Redaction is now the default for private individuals almost everywhere. It only becomes a warning sign when combined with other issues: a very young domain, no imprint, an unresponsive contact form, mismatched SSL certificate details, or negative reviews on a directory like Webwiki.

How much history can I see about a domain?

ICANN’s public WHOIS shows only the current record. For history you need DomainTools’ paid product, the Wayback Machine (web.archive.org) for how the site looked over time, or a Google cache search for older snapshots.

Sources and further reading

• ICANN Lookup (RDAP): https://lookup.icann.org/
• APWG Phishing Activity Trends Report H2 2024: https://apwg.org/trendsreports/
• ICANN Contractual Compliance & Registration Data Reports: https://www.icann.org/resources/pages/compliance-en
• Wayback Machine for domain history: https://web.archive.org/
• Related on Webwiki: How to Tell If a Website Is Trustworthy, The Most Common Online Scams in 2026, What Makes a Website Secure.