who-owns-this-domain

Who owns this domain Registration data tells you who bought the name; DNS tells you who runs the service. They are frequently different parties, and conflating them is the mistake that wrecks attribution. Everything here is passive except where flagged — but note that dig aimed at the target's own nameservers lands in the target's query logs, so resolve through a public recursive resolver or passive DNS when you care about being quiet. Which source first You hold Reach for Why A domain, nothing else RDAP, then registrar WHOIS Structured, gives dates + registrar + status in one hit Redacted WHOIS Historical WHOIS + passive DNS Redaction is not retroactive across archives A domain you suspect is one of many Nameserver pair + MX + reverse WHOIS Infrastructure reuse outlives contact privacy An IP IP RDAP at the RIR, then ASN lookup Tells you the netblock holder, not the site owner A ccTLD The registry's own WHOIS/web service ccTLDs ignore gTLD policy; coverage swings wildly A brand-new domain Creation date + registrar + NS Age plus a bulk-friendly registrar is the phishing tell Show more Installs 975 Repository useosint/osint-skills GitHub Stars 4 First Seen 4 days ago Security Audits Gen Agent Trust Hub Pass Socket Pass Snyk Pass