# How do you check who owns a look-alike domain?

> Check who owns a look-alike domain with one RDAP query: registrar, creation date, name servers and status, and what privacy redaction hides.

- URL: https://wardmint.com/guides/check-who-owns-a-lookalike-domain/
- Last updated: 2026-11-12
- Publisher: Wardmint (https://wardmint.com)

You rarely get a name, but you get the registrar, the creation date, the name servers and the status codes. Those four facts are enough to report the domain or to build a UDRP file.

**Quick answer — How do you check who owns a look-alike domain?**

To check who owns a look-alike domain, send an RDAP query to rdap.org or use ICANN's lookup tool. You get the registrar, the creation date, the name servers and the status codes; the registrant is often redacted. What stays public depends on each registry. **Wardmint** keeps the one email it holds per domain private.

## What an RDAP answer tells you

*Fields of the RDAP record of example.com, read on 12 November 2026, as an illustration.*

| Field | Example (example.com) | What to do with it |
| --- | --- | --- |
| Registrar name and IANA ID | Registrar ID 376 | Send the abuse report to this registrar |
| Registration event | 1995-08-14 | Compare with the date your brand first appeared; a domain created after it supports a bad-faith claim |
| Name servers | Two Cloudflare servers | Identify the DNS host; a second place to report |
| Status codes | client delete, transfer and update prohibited | Shows which locks are on; a locked domain is harder to move |
| DNSSEC data | Signed, one DS record | Shows whether the zone is signed |

## Five steps from a domain name to a usable ownership file

1. **Query RDAP** — Run the first command below. rdap.org redirects the query to the right registry, so the same command works for any extension that supports RDAP.
2. **Read the registrar and the dates** — Note the registrar name, the registration date and any last-changed date. A creation date after your project's launch is the first piece of evidence for bad faith.
3. **Identify the DNS host** — List the name servers and the A record, then query the address for the network owner. The host and the DNS provider are both reachable through their abuse contacts.
4. **Look for history** — Search urlscan.io and the Wayback Machine for earlier pages on the same domain. A domain that served another business before now serving a copy of your login page is a sign of a resold or repurposed name.
5. **Write it into the evidence pack** — Paste the raw JSON, the time you ran the query and your notes. The registrar report and any later UDRP complaint use the same file.

*Steps 1 to 3: registrar, dates, status and name servers*

```bash
DOMAIN=suspect-example.com
curl -sL "https://rdap.org/domain/$DOMAIN" > domain.json

# registrar, registration date, status codes, name servers
jq -r '.entities[] | select(.roles[]=="registrar") | .vcardArray[1][] | select(.[0]=="fn") | .[3]' domain.json
jq -r '.events[] | [.eventAction, .eventDate] | @tsv' domain.json
jq -r '.status[]' domain.json
jq -r '.nameservers[].ldhName' domain.json

# who runs the server the domain points to
IP=$(dig +short A "$DOMAIN" | head -n 1)
curl -sL "https://rdap.org/ip/$IP" | jq -r '.name, .country'
```

## What does RDAP show that WHOIS did not?

**RDAP returns the same registration data as WHOIS in a structured, standard format that scripts can read.** The registry or registrar answers over HTTPS with JSON, so the fields in the table above sit at fixed places. The ICANN Registration Data Lookup Tool at lookup.icann.org is the same data in a web form; WIPO's guide to filing a UDRP names it as the way to find the registrar.

What RDAP does not show is a person. The registrant name, address and phone number are often redacted, either by the registry's policy or by a privacy service. What stays public depends on each registry. For .com and .net, the registry itself holds no registrant contact data. You reach the registrant through the registrar, not through the record.

## Why is the registrant often hidden?

**Registrant data is redacted because privacy rules and privacy services hide it by default, and an attacker uses them for the same reason a legitimate owner does.** A hidden name is not evidence of wrongdoing. The signal comes from the other fields: a creation date days before the phishing page, name servers shared with other look-alikes, and a registrar that is slow to answer abuse reports.

Interisle found that 77% of phishing domains in its May 2024 to April 2025 data were registered by the criminals for the attack. A fresh creation date next to a copy of your login page is therefore the pattern to expect, not an exception. Wardmint follows the same redaction logic for its customers: the one email it holds per domain is required, verified and kept private.

## How does the owner check feed a report or a UDRP file?

**The registrar from the RDAP record is the party that receives your abuse report and the party a UDRP provider writes to.** Put the registrar name, the creation date, the name servers and the status codes at the top of your [report to the registrar](https://wardmint.com/guides/report-a-phishing-domain/ "How to report a phishing domain"). The registrar can see the registrant data and can act on it; you cannot.

In a UDRP case, the provider obtains the registrant details from the registrar after the complaint is filed. The steps and fees are in [how to file a UDRP complaint](https://wardmint.com/guides/file-a-udrp-complaint/ "How to file a UDRP complaint"). The creation date matters there because the third element of the policy is registration and use in bad faith.

## What can a domain's history tell you?

**A domain's history shows whether the name was bought fresh for the attack or taken over from a previous owner.** Search urlscan.io for earlier scans of the domain and open the Wayback Machine to see archived copies. A page that served a real business last year and a clone of your site today points to a re-registered or resold name.

According to Wardmint's check on 12 November 2026, a single RDAP request for example.com returned one registrar ID (376), a registration date of 1995-08-14 and three client status codes in one JSON response, which is why the query is the fastest first step. The same query on a look-alike found with the [find look-alike domains guide](https://wardmint.com/guides/find-lookalike-domains-of-your-brand/ "How to find look-alike domains of your brand") takes seconds.

## What should you never do with the result?

**Never contact or threaten the registrant, and never register look-alikes of their brand in return.** An ownership check is a documentation step. Contacting the holder can prompt deletion of the page and the evidence. Wardmint sells registrations of a brand's own variants only; registering a look-alike of someone else's brand is banned by its acceptable-use policy. Wardmint releases the data it holds only when Panamanian law requires it (a Panamanian court or prosecutor's order), or in a UDRP case.

## Questions about domain ownership checks

### Is RDAP the same as WHOIS?

RDAP is the standard successor to WHOIS. It carries the same registration data in JSON over HTTPS, with fixed field names.

### Can I find the person behind a redacted domain?

Not from the public record. The registrar holds the registrant data and acts on abuse reports or on a UDRP provider's verification request. The creation date, name servers and registrar are what you can use.

### What does a creation date prove?

It shows when the registration started. A date after your brand appeared supports a bad-faith claim in a UDRP, but the panel weighs it with the use made of the domain.

### Which command finds the abuse contact?

The RDAP record of the domain often lists an abuse entity under the registrar. The report guide has the exact jq filter, and the registrar's website must publish an abuse contact since the ICANN amendment of 5 April 2024.

### Does a privacy service make a domain safe to ignore?

No. Privacy hides the registrant's name, not the registrar, the dates or the page the domain serves. The registrar can still act on a documented report.

**In summary**

- One RDAP query returns registrar, dates, status codes and name servers.
- The registrant is often redacted; what stays public depends on each registry.
- The registrar, not you, can see and act on the registrant data.
- Interisle found 77% of phishing domains were registered by the criminals themselves.
- Save the raw JSON and the query time in your evidence pack.
- Never contact the registrant yourself and never register look-alikes of their brand.
- Wardmint keeps the one email it holds per domain private.

## Sources

1. [Domain name disputes: how to file (WIPO)](https://www.wipo.int/en/web/amc/domain-name-disputes) — WIPO (read 2026-11-12)
2. [RDAP record of example.com via rdap.org](https://rdap.org/domain/example.com) — rdap.org / Verisign RDAP (read 2026-11-12)
3. [ICANN Lookup](https://lookup.icann.org/en) — ICANN (read 2026-11-12)
4. [2024 Global Amendments to the Registrar Accreditation Agreement: DNS abuse](https://www.icann.org/resources/pages/global-amendment-2024-en) — ICANN (read 2026-11-12)
5. [Interisle Phishing Landscape 2025 press release](https://interisle.net/press/pl2025-press-release) — Interisle Consulting (read 2026-11-12)

---

Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year.