A WHOIS record showing a privacy-protected email address like [email protected] tells you very little about who owns the domain — but the registrar name, creation date, expiry date, and nameservers are still there and still tell a story
The previous articles on this site covered WHOIS basics, domain due diligence, typosquatting detection, and the shift to RDAP and GDPR-driven redaction. This article addresses what you can still learn from WHOIS in the post-GDPR era — reading the fields that remain public, and what patterns in those fields reveal about domain ownership, intent, and risk.
The WHOIS fields that remain visible despite privacy protection
GDPR and similar regulations changed which contact fields WHOIS displays — email addresses, phone numbers, and often registrant name/organization are now commonly redacted. But technical and administrative fields remain because they're operationally necessary for internet infrastructure:
Registrar name and IANA ID: which company manages this domain registration. The registrar's choice can be informative — some registrars are preferred by legitimate businesses, others are more commonly associated with bulk-registered domains, spam operations, or low-cost registrations prioritized for brand protection purposes.
Creation date: when the domain was first registered. A domain registered last week claiming to have "10 years of experience" is immediately suspicious. A domain registered in 1998 has a fundamentally different risk profile than one registered last month.
Updated date: the last time any registration information changed. A domain that was registered years ago but "updated" in the last few days may indicate the domain was recently acquired or its technical configuration changed.
Expiry date: when the registration expires if not renewed. Domains expiring in the next few months are potentially at risk of being acquired by others if not renewed (domain hijacking via non-renewal, related to the domain due diligence article). Domains expiring today or tomorrow may be actively expiring.
Name servers: which DNS provider the domain uses. Name servers are often shared across all domains managed by the same organization — if you know another domain is operated by a company and both domains share the same unusual nameservers, that's evidence of common ownership. Alternatively, nameservers associated with known bulletproof hosting or anonymizing services are a risk indicator.
Domain status codes: clientTransferProhibited, clientDeleteProhibited, serverHold, redemptionPeriod, pendingDelete — these WHOIS status flags indicate the domain's current administrative state, including whether it's locked against transfer (expected for legitimate, actively managed domains) or in various stages of deletion/expiry.
Reading creation date patterns: the mass-registration signal
Legitimate businesses typically register one or a small number of relevant domains. A WHOIS lookup on a suspicious domain that was created on the same date as dozens of similarly-structured domains (same registrar, same day, same name server pattern) suggests bulk registration — commonly associated with:
Domain squatting campaigns: registering many variations of valuable domain names to sell them.
Phishing infrastructure: registering many similar-looking domains to use in parallel phishing campaigns, with the expectation that some will be blocked but others will remain active.
Affiliate spam networks: bulk-registering domains for low-quality SEO or spam purposes.
How to detect this: the WHOIS creation date alone shows the registration date for this domain; looking at other domains registered on the same day from the same registrar with similar naming patterns requires active investigation — tools like DomainTools (a commercial service) index registration data and can surface these patterns.
Nameserver analysis: tracing common ownership
If two domains share identical nameservers, and those nameservers use an unusual or distinctive configuration, that's strong evidence of shared hosting or management — even if all contact information is redacted.
Example pattern: ns1.specific-hosting-company.com and ns2.specific-hosting-company.com are nameservers for domain-A.com. A different domain-B.com uses the same nameservers. If domain A belongs to a company you're investigating, domain B likely does too.
This technique has legitimate uses (competitive research, vendor due diligence) and investigative uses (tracing connected entities in fraud investigations). It's a standard technique in OSINT (Open Source Intelligence) work.
Domain status codes: what they reveal about a domain's health
clientTransferProhibited: the registrar has locked the domain against transfer to another registrar. Present on virtually all actively managed, legitimately-used domains — its absence would be unusual and potentially indicate a recently-registered or poorly-managed domain.
serverHold: the registry (not the registrar) has suspended the domain — it won't resolve. Often indicates the domain has been flagged for abuse, non-payment, or legal disputes. A domain with serverHold returns no DNS results despite having nameservers configured.
redemptionPeriod: the domain has expired and is in a grace period before permanent deletion. Can be renewed by the original registrant at a premium price; not yet available for public re-registration but close.
pendingDelete: about to be deleted and returned to the public pool for re-registration. Once a domain enters pendingDelete, it typically completes deletion within 5 days, after which it becomes available for anyone to register.
RDAP vs WHOIS: the successor protocol and what changes
RDAP (Registration Data Access Protocol) is the modern replacement for the decades-old WHOIS protocol — structured JSON responses rather than free-text, standardized field names, proper authentication for accredited requesters to access more complete data.
For everyday lookups: RDAP returns similar publicly-visible information to WHOIS (same fields visible under GDPR constraints). The difference is in how the data is structured — JSON is machine-readable, enabling automated analysis without text parsing.
Access tiers: RDAP is designed for tiered access — public requests see the redacted data; accredited requesters (law enforcement, intellectual property practitioners with proper credentials) can access contact information. This model replaces the previous all-or-nothing WHOIS, where any anonymous requester could access full registrant data (before GDPR changed the defaults).
How to use the WHOIS Lookup on sadiqbd.com
- Always check creation date first — for due diligence on any domain: a recently-created domain claiming established history is a red flag; an old domain with consistent registration history suggests legitimacy
- Compare expiry date to today's date — if a domain you depend on (a vendor, a partner) expires soon, this warrants investigation; legitimate organizations rarely let important domains expire accidentally, but it does happen
- Cross-reference nameservers — if investigating a potentially fraudulent site, comparing its nameservers against nameservers of known domains can reveal connected infrastructure
- Don't expect contact information for most registrations post-2018 — GDPR-driven redaction is the norm; the operational fields (dates, registrar, nameservers, status) remain the primary informational content of a modern WHOIS lookup
Frequently Asked Questions
Can I contact a domain owner if all contact information is redacted? Through the registrar. Most privacy-protection services provide a forwarding mechanism — you submit a message or contact request to the registrar's privacy service, which forwards it to the registrant on your behalf. The registrant can then choose to respond (or not) without revealing their direct contact information. For legitimate business inquiries (partnership proposals, purchase offers, trademark disputes), this forwarding mechanism is the intended path. For legal/law enforcement purposes, formal legal process (subpoena, court order) can compel the registrar to reveal the registrant's actual identity.
Is the WHOIS Lookup free? Yes — completely free, no sign-up required.
Try the WHOIS Lookup free at sadiqbd.com — check domain registration details, creation date, expiry, and nameservers instantly.
