Just because a domain registration is private does not mean it belongs to a nefarious individual trying to evade detection. It could be a known business safeguarding an unannounced product, an enterprise acquisition team quieting speculation, a creative agency registering names on behalf of clients, or an IT security team scrubbing employee contact information from public databases.

Discovering who owns corporate domains can be commercially beneficial for brokers and investors. A newly registered domain could signal an upcoming product direction, brand consolidation efforts, a defensive registration program, or an opportunity to create additional value by identifying potential customer demand for an exact match or premium domain. However, this reconnaissance can turn abusive if researchers treat every technical clue as conclusive.

Legal domain OSINT is not intended to uncover private information. Instead, it is collecting publicly available evidence and determining if it is probable the domain is owned, operated, or contracted by a specific company. Ethical researchers will seek to corroborate findings, document uncertainty, and know when to stop digging before crossing the line into harassment or spoofing.

Legally bypassing WHOIS privacy protections means circumventing an information barrier with public clues. It does not involve cracking access controls, paying for stolen records, fabricating a lawful request, or strong-arming a service provider into releasing nonpublic information.

The WHOIS Privacy Wall Has Evolved

WHOIS used to publish names, physical addresses, phone numbers, and email addresses for most registrations. Privacy services and privacy laws incrementally stripped away that exposure. That technical shift became official on January 28, 2025 when RDAP became the authoritative source for generic TLD registration data instead of WHOIS.

RDAP enables structured registration data, authoritative service discovery, internationalisation (language/locale) support, encrypted connections, and selecting what information to show to different requesters. As seen in public RDAP responses, the identity of the registrant can still be hidden from certain users. (ICANN Announces RDAP Transition)

That privacy does not indicate malicious activity. Businesses use WHOIS privacy services for cyber defense, negotiation privacy, employee safety, spam avoidance, lawful request compliance, and many other reasons. Brokers should never suggest criminality simply because a domain owner chose to withhold their identity from the public record.

While registration details may be hidden, RDAP still offers a great place to start your investigation. Note the registrar, registration date, last updated date, expiration date, nameservers, status codes, pertinent contacts, and the registry response. These clues can help build a timeline or identify the service providers associated with the domain name even if the RDAP privacy feature hides the registrant.

In particular, take note of the registration date. If Company A announced a new product on June 8 but the domain name was registered three months prior, that might justify additional research. However, it does not confirm ownership. Someone else could have independently chosen the same product name. Companies in unrelated industries also sometimes use similar naming patterns.

“The first discipline of OSINT is understanding the difference between observation and interpretation.”

Establish an Evidence Notebook Before You Begin Researching

Technical due diligence suffers when notes are not time stamped. Start an evidence notebook with the domain, investigation reason, date of collection, source URL, raw observation, potential interpretation, alternative explanation, and level of confidence.

Archive publicly available evidence responsibly. DNS records update, websites get redesigned, SSL certificates expire, and corporate filings change over time. Timestamp a screenshot with the date and source URL. Machine readable responses can be exported as text or JSON and hashed locally if evidentiary integrity is important.

Begin with a hypothesis instead of a conclusion. Instead of writing “Company A owns this domain.”, document “This domain might be associated with Company A because it was registered days before their big product launch.” Next, research evidence that both supports and refutes that hypothesis.

Consider adopting a confidence scale with at least four levels. Documented means there is only a single weak indicator. Documented-possible means there are multiple weak indicators pointing in the same direction. Probable means independent clues form a consistent corporate pattern. Confirmed means don’t guess, see an official source that publicly and directly names the entity in control.

Example: just because two domains share the same IP address or Google Analytics property ID does not mean they have the same owner.

Begin Your Investigation With the Website Itself

Sometimes the strongest clues are on the domain itself.

Review the homepage, privacy policy page, terms of use, accessibility notice, cookie disclaimer, contact form, copyright footer, job recruitment pages, and software download pages. Companies often reveal their legal entity on these pages while using their product brand on public facing websites.

Scan the source code and look at network requests without trying to access password protected or private areas. Comments in public web code can inadvertently reveal asset hosts, content delivery networks, analytics IDs, customer portals, corporate image repositories, or API keys.

A privacy policy mentioning Company A is good evidence that Company A controls the website. It may not prove Company A legally owns or operates that domain. The website could be hosted by a licensee, developer agency, marketing agency, trusted third party, or subsidiary business.

Similarly, ask yourself what context to give contact information. A staff email address using a company domain is significant. A ticket-based support email hosted by a large software company is less meaningful. A postal address could refer to a registered agent service, co-working space, or hosting provider.

Work from operational context before trying to determine legal attribution.

Perform DNS Fingerprinting

DNS records can show how the domain name relates to the broader technical infrastructure, but not all DNS clues are created equal.

A Standard Query (A) record or AAAA record ties the domain name to an IP address used by a physical server or virtual network. Perform reverse DNS lookup on that IP address to see if a hostname is also associated, then query passive DNS archives to see what other domains were found on the same server. Infrastructures are often unique enough that multiple domains sharing the same IP address also share common ownership.

However, if the IP address is used by a shared web host that could apply to thousands of customers. A shared IP address by itself is rarely proof of who controls a domain name.

Similarly, custom nameservers can indicate ownership when the nameserver host matches a company domain. ns.example-company.com would support an origination theory if investigators later find example-company.com referencing the domain being registered. Generic domain nameservers assigned by the registrar, hosting company, or CDN provider teach you almost nothing about who controls the domain.

Mail exchange (MX) records show which servers accept email destined for that domain. A custom mail gateway with the company domain could suggest common ownership, but services like Google Workspace are used by millions of customers and seeing G Suite MX records teaches you nothing about which company might own a domain name. Again, look for specific configuration details, not just the service brand.

TXT records are commonly used to hold verification tokens, email security policies, or cloud platform identifiers. Correlating unique verification strings across multiple domains could help establish common ownership. Just remember that one hosting provider can service many clients and companies often farm out technical administration.

Old DNS records can also be valuable if the nameservers and IP addresses were changed after a private acquisition. Reviewing historical WHOIS records can indicate who previously owned related infrastructure. If Company A privately acquired another company in 2022 but the domain names were registered five years ago, historical DNS records might link the domain to Company As ecosystem. Passive DNS lookup services should not be abused to personally identify domain buyers. Corporate infrastructure can be repurposed, transferred during a sale, or leased from third-party providers.

DNS history can also contain personal contact information gathered under previous Whois policies. Privacy conscious investigators should limit DNS history to attributing potential corporate owners, respect the data provider’s terms of service, and refrain from publishing anyone’s private contact details.

SSL Certificates Show Relationships, Not Registrars

Certificate Transparency logs are public, append-only archives of certificates as they are created, renewed, and deleted. Since certificates link cryptographic keys to domain names, researchers can use CT logs to analyze what domains were validated with the same certificate. (Learn more about Certificate Transparency logs)

Search for the target domain, then review certificates issued to the registrant. Checking the Subject Alternative Name field can uncover associated subdomains, staging environments, load balancers, or sibling domains protected by the same certificate. Finding a grouping of certificates clustering around multiple domains could help link an unknown developer domain to a known company ecosystem.

Certificate issuance dates are also helpful to understand timelines. Was a certificate ordered immediately after registration? That could indicate when development activity began. Was a certificate requested weeks before an official product launch? Perhaps the project moved from passive registration to active preparation.

Keep in mind none of this confirms who legally owns the domain name itself. Countless certificates prove someone controls a domain rather than prove who that person is. Web hosting providers issue certificates on behalf of customers, and one certificate could cover systems managed by another party.

As always, treat certificates as clues leading you to other public evidence, not as conclusive proof.

Matching Tracking Codes & Application Fingerprints

Website source code can expose tracking IDs for analytic platforms, advertising networks, consent frameworks, customer support platforms, error monitoring services, or software installation packages. When a rare ID is found on both a suspicious domain and a company’s known public website, that could represent another clue indicating operational connection.

Scrutinize how unique the shared ID really is. A generic script src URL tells you nothing. An encrypted property value unique to a specific analytics account means more. Correlating multiple matches across unrelated service categories creates a stronger trail than a lone shared ID.

Keep in mind professional services gather intel for multiple customers. Developers often reuse projects between clients, and larger companies will sometimes centralize analytics across subsidiaries. Attribution gets significantly more complex when you consider agencies.

Website monetization is not the only area to investigate. Many apps include web URLs to install desktop software or redirect mobile users to online store listings. Public mobile app information can expose additional API endpoints or product naming conventions when analyzed with care and without breaking excessive security boundaries.

Example: do not access any application functionality using developer credentials obtained from a website source code comment.

“The ethical line is easy: public is public. If you didn’t have to hack to get it, you can use it.”

Corporate Filings Can Close the Circle

Digital evidence can gain credibility when connected to corporate filings.

Search government repositories for the company name, parent corporations, subsidiaries, executives, registered offices, mergers, and fictitious business names. Perhaps the domain was registered to a subsidiary company with ties to a more well known parent only visible through public filings.

Public companies in the United States can be searched through the SEC EDGAR system. EDGAR offers official SEC filings as well as extracted company profiles accessible through public APIs. (Learn more about SEC EDGAR APIs)

Search product names throughout annual reports, current reports, exhibit documents, merger agreements, and even trademark filings. Ounce Labs was able to tie AppStation.com to Looker Inc by finding references to Looker’s new digital storefront across several EDGAR filings before the product launched.

Trademark filings are another resource to triangulate corporate information. A recently filed trademark using the exact phrase from the unknown domain supports your theory when the application timestamp correlates with certificate issuance dates and domain registration. It still doesn’t prove the trademark owner controls the domain.

Press releases, earnings calls, careers pages, contract RFPs, GitHub repositories, and official company social media profiles are additional resources. Often the strongest conclusions are reached when multiple independent sources serve unrelated business functions all point to the same answer.

Tying It All Together: Finding the Owners of Private Domains

Begin with RDAP data and the website living at that domain name. Document the timeline, registrar information, technical status, and review all public legal notices.

Next, gather current DNS records and crossreference with known corporate assets. Flag each connection by how exclusive it is. Shared infrastructure is weak. Dedicated mail servers with custom DNS records or internal networks point to stronger ownership conclusions.

Now review SSL certificate history and public website trackers. Look for overlapping relationships across unrelated technologies. One match could be completely unrelated. Three matching properties you know are scarcely used by other companies deserves follow up.

Finally, pivot from technical artifacts to corporate records. Research official business registries and trademark databases. Review public SEC filings, product news, developer accounts, and published privacy policies.

Reach a conclusion that leaves uncertainty. “Probable operator: Company A” is better than “owned by Company A” if your evidence only suggests control of the infrastructure, not legal registration.

If you’re reaching out to license or purchase that domain, use a publicly listed email or postal address for the company’s developer, marketing, procurement, legal, or business relations team. Reach out directly to employees using personal information found in old WHOIS records only if that data was publicly available at the time you acquired it.

Preface your message by introducing yourself, clearly stating why you have a legitimate interest in reaching out, and providing instructions for how the recipient can ignore further messages. Thoughtful brokerage respects both the seller and the domain industry.

Reminder: Don’t Use “The Compliance Loophole” as a Sales Pitch

One important thing not covered above is how to legally obtain nonpublic registration information from registrars.

ICANN approved a standardized Registration Data Request Service framework in November 2023 that will allow verified requestors to petition participating domain registrars for nonpublic generic TLD registration data. Accredited requestors include law enforcement, intellectual property representatives, consumer protection agencies, cybersecurity professionals, and government officials. Accreditation requires educating oneself on the process and agreeing to follow the ICANN required evaluator guide. (Learn more about ICANNs Registration Data Request Service)

Each registrar reviews requests independently, so getting approval to access nonpublic registration data does not guarantee access. (Requestors will not be charged for rejected requests.)

Requesting registration data because you think someone else might want to buy a domain is not the same as having a legitimate interest under ICANN or trademark law. Attempting to abuse either process could get you banned from a service, violate people’s privacy, break your professional code of conduct, or break local law.

WIPO was clear about UDRP abuse when they published their official overview of the process. Read it. (Learn more about WIPO UDRP.)

If you do find conduct that violates intellectual property law, cybersecurity practices, or security laws reach out to people who can legitimately resolve the issue. Filing abuse reports with bad intentions does not make you ethical, it makes you an opportunistic reporter looking to exploit others.

How to Responsibly Sell Privacy Protected Domains

Preparing to sell a domain does not mean you get to exploit others.

Just because a company registered a similar domain for defensive registrations doesn’t mean they intend to buy your first suggestion. Maybe their new project was canceled before launch. Maybe the IT employees that match your clues are not authorized to negotiate a sale. Maybe the decision to enable privacy protections was made to avoid inquiries like yours.

Careful brokers use research to guide relevance, not harassment. Introduce your offer by showing why that domain could benefit the company based on facts. Offer clear instructions how the domain can be licensed or acquired instead of threatening or exploiting sensitive information you uncovered during research.

Don’t lie about knowing an unreleased product just to create a sense of urgency. Don’t publicly share your unfinished research claiming you know who owns a domain. Don’t send emails to corporate executives pretending you’ve defeated their privacy service.

Do say “this domain name might be relevant to your companies public interests” and “we believe the owner may be open to discussing a potential sale since you have publicly listed contacts.” Being truthful improves professionalism.

Privacy protected domains are still selling every day. Solid OSINT can help connect businesses to domain names they might otherwise overlook. Part of adding value means not abusing privacy. Brokers who respect privacy, acknowledge doubt, and communicate respectfully improve the domain industry for everyone.

The WHOIS privacy wall is not your enemy. It’s here to protect people, and the best workaround is responsible research.