who-owns-this-domain

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Who owns this domain

该域名归谁所有

Registration data tells you who bought the name; DNS tells you who runs the service. They are frequently different parties, and conflating them is the mistake that wrecks attribution. Everything here is passive except where flagged — but note that

dig

aimed at the target's own nameservers lands in the target's query logs, so resolve through a public recursive resolver or passive DNS when you care about being quiet.

注册数据会告诉你域名的购买者是谁；DNS数据则会告诉你服务的运营者是谁。二者往往分属不同主体，混淆二者会导致归属判定出错。除特别标注的内容外，本文介绍的所有方法均为被动式操作——但请注意，若直接向目标自身的域名服务器发送

dig

请求，会被记录到目标的查询日志中，因此如果需要保持隐蔽性，请通过公共递归解析器或被动DNS进行解析。

Which source first

优先选择哪种数据源

You hold	Reach for	Why
A domain, nothing else	RDAP, then registrar WHOIS	Structured, gives dates + registrar + status in one hit
Redacted WHOIS	Historical WHOIS + passive DNS	Redaction is not retroactive across archives
A domain you suspect is one of many	Nameserver pair + MX + reverse WHOIS	Infrastructure reuse outlives contact privacy
An IP	IP RDAP at the RIR, then ASN lookup	Tells you the netblock holder, not the site owner
A ccTLD	The registry's own WHOIS/web service	ccTLDs ignore gTLD policy; coverage swings wildly
A brand-new domain	Creation date + registrar + NS	Age plus a bulk-friendly registrar is the phishing tell

你掌握的信息	优先使用的工具/服务	原因
仅知道域名	RDAP，其次是注册商WHOIS	结构化呈现，可一次性获取日期、注册商及状态信息
已脱敏的WHOIS记录	历史WHOIS记录 + 被动DNS	脱敏操作不会追溯覆盖历史存档数据
怀疑该域名属于某个域名集群	域名服务器对 + MX记录 + 反向WHOIS	基础设施的复用周期长于联系人隐私保护期限
仅知道IP地址	区域互联网注册管理机构（RIR）的IP RDAP，其次是ASN查询	可获取网段持有者信息，而非站点所有者信息
国家顶级域名（ccTLD）	注册局官方的WHOIS/网页服务	ccTLD不受通用顶级域名（gTLD）政策约束，数据覆盖范围差异极大
全新注册的域名	创建日期 + 注册商 + 域名服务器	域名年龄加上批量友好型注册商是钓鱼域名的典型特征

WHOIS versus RDAP

WHOIS与RDAP对比

WHOIS is a plaintext protocol on TCP/43 with no schema. Every registry emits a different field layout, clients follow registry-to-registrar referrals inconsistently, and rate limiting is silent — you get truncation or a block, not an error you can parse.

RDAP is the same registration data over HTTPS as JSON, with real HTTP semantics: 404 for no such object, 429 when you are throttled, and per-object endpoints for domains, nameservers, entities, IPs, and AS numbers. Query it through the bootstrap redirector or the registry directly:

bash

curl -s https://rdap.org/domain/example.com | jq .
curl -s https://rdap.org/ip/203.0.113.10 | jq '.name, .handle, .country'
curl -s https://rdap.org/autnum/64500 | jq '.name, .entities'

Read these fields:

```
events
```
—
```
registration
```
,
```
expiration
```
,
```
last changed
```
,
```
transfer
```
. A
```
transfer
```
event long after registration means the current registrar's records start there; anything older lives only in historical WHOIS.

entities[].roles

—

registrant

technical

abuse

registrar

. The registrar entity carries its IANA ID in

publicIds

```
status
```
— EPP codes.
```
clientTransferProhibited
```
is routine.
```
clientHold
```
means the registrar pulled the domain from DNS (nonpayment or an abuse complaint).
```
serverHold
```
means the registry did — usually legal or law-enforcement action.
```
redemptionPeriod
```
and
```
pendingDelete
```
mean it is expiring and about to become available.
```
nameservers
```
and
```
secureDNS
```
— operator fingerprint plus DNSSEC posture.

Some servers also return a machine-readable list of which fields were redacted, which is more useful than guessing from

REDACTED FOR PRIVACY

strings.

For

.com

and

.net

the registry is thin: it returns only registrar, dates, status, and nameservers. The contact block, such as it is, comes from the registrar's own server. Query both when they disagree — the registry is authoritative on dates and transfers, the registrar on contacts.

WHOIS是基于TCP/43端口的明文协议，无统一数据结构。每个注册局输出的字段布局各不相同，客户端对注册局到注册商的跳转处理不一致，且速率限制无提示——你只会收到截断的结果或被封禁，而非可解析的错误信息。

RDAP则是通过HTTPS以JSON格式传输相同的注册数据，具备标准HTTP语义：查询不存在的对象返回404，请求被限流返回429，且针对域名、域名服务器、实体、IP地址和AS号设有独立的查询端点。可通过引导重定向器或直接向注册局发起查询：

bash

curl -s https://rdap.org/domain/example.com | jq .
curl -s https://rdap.org/ip/203.0.113.10 | jq '.name, .handle, .country'
curl -s https://rdap.org/autnum/64500 | jq '.name, .entities'

重点关注以下字段：

```
events
```
——
```
registration
```
（注册）、
```
expiration
```
（到期）、
```
last changed
```
（最后修改）、
```
transfer
```
（转移）。注册完成很久之后出现的
```
transfer
```
事件意味着当前注册商的记录从此处开始；更早的记录仅存在于历史WHOIS中。
```
entities[].roles
```
——
```
registrant
```
（注册者）、
```
technical
```
（技术联系人）、
```
abuse
```
（滥用投诉联系人）、
```
registrar
```
（注册商）。注册商实体的
```
publicIds
```
字段包含其IANA ID。
```
status
```
—— EPP状态码。
```
clientTransferProhibited
```
属于常规状态；
```
clientHold
```
表示注册商已将该域名从DNS中移除（原因可能是未付款或滥用投诉）；
```
serverHold
```
表示注册局已将该域名移除——通常是出于法律或执法行动；
```
redemptionPeriod
```
和
```
pendingDelete
```
表示域名即将到期，不久后将重新开放注册。
```
nameservers
```
和
```
secureDNS
```
—— 运营者特征标识及DNSSEC部署状态。

部分服务器还会返回机器可读的脱敏字段列表，这比从

REDACTED FOR PRIVACY

字符串中猜测要有用得多。

对于

.com

和

.net

域名，注册局仅提供精简数据：仅返回注册商、日期、状态和域名服务器。联系人信息（若存在）需从注册商自身的服务器获取。当二者数据不一致时，需同时查询——注册局的日期和转移记录具有权威性，注册商的联系人信息具有权威性。

What redaction actually removes

脱敏操作实际移除的内容

Under current gTLD registration-data policy, registrant name, street, phone and email are usually stripped and replaced with a forwarding address or a web form. What survives and still pivots hard: registrar of record and its IANA ID, the reseller field when present, creation/update/expiry/transfer dates, nameservers, DNSSEC status, EPP status codes, registrant state/province and country (many registrars keep these), registrant organization (some keep it for legal entities, on the argument that a company name is not personal data), and the registrar abuse contact, which is never redacted and is the correct route for reports.

Distinguish the registrar of record (the ICANN-accredited party, e.g. Tucows, PDR, Namecheap) from the reseller that actually sold the domain, and both from a privacy service, which appears in the registrant field under its own corporate name and jurisdiction. The privacy service's identity is itself a lead: it tells you which registrar ecosystem you are in and where a disclosure request would have to go.

根据当前gTLD注册数据政策，注册者的姓名、地址、电话和邮箱通常会被屏蔽，替换为转发地址或网页表单。但仍有一些关键信息得以保留，可用于关联分析：注册商及其IANA ID、转售商字段（若存在）、创建/修改/到期/转移日期、域名服务器、DNSSEC状态、EPP状态码、注册者所在州/省和国家（许多注册商会保留这些信息）、注册者组织（部分注册商会为法人实体保留该信息，理由是公司名称不属于个人数据），以及注册商的滥用投诉联系人（该信息从未被脱敏，是提交投诉的正确渠道）。

需区分注册商（ICANN认证的主体，如Tucows、PDR、Namecheap）、实际销售域名的转售商，以及隐私服务提供商（其公司名称和管辖地会出现在注册者字段中）。隐私服务提供商的身份本身就是一条线索：它会告诉你当前所处的注册商生态系统，以及披露请求需要提交至何处。

The DNS pass

DNS查询步骤

bash

dig +short example.com A; dig +short example.com NS
dig example.com MX +noall +answer
dig example.com SOA +noall +answer          # RNAME mailbox, serial often YYYYMMDDnn
dig example.com TXT +short                  # SPF and verification tokens
dig _dmarc.example.com TXT +short
dig google._domainkey.example.com TXT +short
dig example.com CAA +short
dig -x 203.0.113.10 +short

Do not build a workflow on

ANY

— most authoritative servers now answer it with a minimal or synthetic response instead of the full record set.

Every record type leaks something different: the interpretation table is in reference/dns-record-types.md and the mapping from SPF include hosts, DKIM selectors and TXT tokens to named vendors is in reference/vendor-fingerprints.md. The short version: TXT is a public inventory of the org's SaaS estate, MX names the mail security vendor, DMARC

rua

names their DMARC-reporting vendor, and CAA names the CA they standardized on.

bash

dig +short example.com A; dig +short example.com NS
dig example.com MX +noall +answer
dig example.com SOA +noall +answer          # RNAME邮箱，序列号通常格式为YYYYMMDDnn
dig example.com TXT +short                  # SPF记录和验证令牌
dig _dmarc.example.com TXT +short
dig google._domainkey.example.com TXT +short
dig example.com CAA +short
dig -x 203.0.113.10 +short

不要基于

ANY

类型构建工作流——大多数权威服务器现在会返回极简或合成响应，而非完整的记录集。

每种记录类型都会泄露不同的信息：解读对照表请参考reference/dns-record-types.md，SPF包含主机、DKIM选择器和TXT令牌与知名厂商的映射关系请参考reference/vendor-fingerprints.md。简而言之：TXT记录是组织SaaS资产的公开清单，MX记录会暴露邮件安全厂商，DMARC的

rua

字段会暴露其DMARC报告厂商，CAA记录会暴露其标准化使用的证书颁发机构（CA）。

IP, ASN, and what shared hosting costs you

IP、ASN及共享主机的局限性

bash

whois -h whois.cymru.com " -v 203.0.113.10"        # ASN, prefix, country, AS name
whois -h whois.radb.net -- '-i origin AS64500'     # prefixes routed by that AS

The RIR record gives the netblock holder. If that is a hosting provider or cloud region you have learned nothing about ownership — a shared IP couples a domain to thousands of unrelated tenants, so "same IP" is worthless as attribution evidence. It becomes evidence when the RIR record shows a reassignment or sub-allocation to a named customer, or when the block is small and the org name is the target's.

PTRs are set by whoever controls the IP, not the domain owner. Clouds generate them mechanically from the address, which tells you only the platform. Colocation and enterprise blocks often carry customer names, and walking the PTRs of a /24 around a known host can hand you the org's whole rack.

bash

whois -h whois.cymru.com " -v 203.0.113.10"        # ASN、前缀、国家、AS名称
whois -h whois.radb.net -- '-i origin AS64500'     # 该AS路由的前缀

RIR记录会提供网段持有者信息。如果持有者是托管提供商或云区域，那么你无法获取任何所有权相关信息——共享IP会将一个域名与数千个无关租户关联在一起，因此“同一IP”作为归属判定证据毫无价值。只有当RIR记录显示网段已重新分配或子分配给特定客户，或者网段范围较小且组织名称与目标一致时，该信息才具备证据效力。

PTR记录由IP的控制者设置，而非域名所有者。云平台会根据IP地址自动生成PTR记录，这只能告诉你平台信息。托管和企业网段通常包含客户名称，通过遍历已知主机所在/24网段的PTR记录，你可以获取该组织的整个机架信息。

Historical WHOIS and passive DNS

历史WHOIS记录与被动DNS

This is where the real pivots are. Redaction started at a point in time, so databases that captured records before it still hold names, emails and phone numbers; passive DNS keeps every observed answer, so you get IPs and hostnames the zone no longer serves. Ask three questions: what did the registrant field say before it went private, what other domains share that registrant email or name (reverse WHOIS), and what IPs has this name resolved to over time. DomainTools, SecurityTrails, WhoisXML, Validin, Silent Push and VirusTotal's domain reports carry some mix of the two — most gate the useful depth behind a paid key.

这才是真正的关联分析突破口。脱敏操作是从某个时间点开始实施的，因此在此之前捕获记录的数据库仍保留姓名、邮箱和电话号码；被动DNS会保留所有观测到的响应，因此你可以获取该域名不再解析的IP和主机名。需提出三个问题：注册者字段在脱敏前显示的是什么内容？还有哪些域名共享该注册者邮箱或姓名（反向WHOIS）？该域名随时间推移解析过哪些IP？DomainTools、SecurityTrails、WhoisXML、Validin、Silent Push和VirusTotal的域名报告均包含部分此类数据——大多数有用的深度数据需要付费密钥才能访问。

Zone transfers and zone walking

区域传输与区域遍历

dig AXFR example.com @ns1.example.com

asks a nameserver for the whole zone. It is an interactive TCP request to target-controlled infrastructure, it is logged, and it is out of scope for passive work — only inside an authorized engagement, and expect a refusal. A zone signed with NSEC rather than NSEC3 can likewise be walked to enumerate every name, and NSEC3 hashes can be cracked offline; both need direct queries to the authoritative servers. Treat both as active and use

find-hidden-subdomains

when you need to stay passive.

dig AXFR example.com @ns1.example.com

会向域名服务器请求整个区域数据。这是针对目标控制基础设施的交互式TCP请求，会被记录日志，且不属于被动操作范畴——仅适用于授权范围内的测试，且大概率会被拒绝。使用NSEC而非NSEC3签名的区域同样可以被遍历以枚举所有域名，NSEC3哈希值可离线破解；这两种操作都需要直接向权威服务器发起查询。请将这两种操作视为主动操作，若需要保持隐蔽性，请使用

find-hidden-subdomains

工具。

Where this goes wrong

常见误区

Registrant is a placeholder. Bulk registrars, resellers, privacy services and corporate registrars all write their own details into contact fields. A matching registrant string across domains can mean one owner or one reseller.
Dates lie about age. Expired-and-reregistered domains reset their creation date at the registry, so a long archive history plus a recent creation date means the name changed hands through a drop.
Cached and cloaked DNS. Answers are TTL-scoped snapshots, and providers serve different records by geography, by resolver, and via split-horizon views you will never see. One resolver is one vantage point.
SPF and TXT records rot. Present in SPF means "was configured", not "in use now"; verification tokens are almost never cleaned up at all.
MX and NS are outsourced. They identify the vendor. They become an ownership signal only when the specific assigned nameserver pair or mail tenant label recurs across domains.
Parked domains show registrar DNS and a marketplace IP. No owner infrastructure to find. Squatters copy the target's SPF and MX wholesale to look legitimate, so mirrored records are not a relationship.

注册者是占位符：批量注册商、转售商、隐私服务提供商和企业注册商都会将自身信息写入联系人字段。多个域名的注册者字符串匹配可能意味着同一所有者，也可能意味着同一转售商。
日期无法准确反映域名年龄：过期后重新注册的域名会在注册局重置创建日期，因此较长的存档历史加上较新的创建日期意味着该域名是通过抢注获得的。
DNS缓存与伪装：查询结果是基于TTL的快照，提供商可能会根据地理位置、解析器类型提供不同的记录，甚至通过分割视图返回你永远无法看到的结果。单个解析器仅代表一个观测视角。
SPF和TXT记录过时：SPF记录中的内容仅表示“曾配置过”，而非“当前正在使用”；验证令牌几乎从未被清理。
MX和NS记录外包：这些记录仅能标识厂商。只有当特定的域名服务器对或邮件租户标签在多个域名中重复出现时，它们才会成为所有权信号。
停放域名：显示注册商DNS和市场IP，无法找到所有者基础设施。域名抢注者会完全复制目标的SPF和MX记录以伪装成合法域名，因此镜像记录并不意味着存在关联关系。

Confidence grading

可信度分级

Confirmed — the registry or RIR states it directly and it is not a contact field: creation date, registrar, EPP status, nameservers, netblock holder. Or: an unredacted registrant corroborated by a second independent source (a corporate filing, a historical snapshot, an archived page).
Probable — a distinctive shared fingerprint across domains: the same assigned nameserver pair, the same mail tenant label, the same DKIM key, the same CAA
```
accounturi
```
, the same unusual TXT token. Same operator, probably same owner.
Unconfirmed — shared IP on shared hosting, shared registrar, shared public DNS provider, or a registrant string that could be a reseller. Also anything from a historical database you have not seen the raw record for.

Always record the lookup timestamp and which server answered. A WHOIS record without a retrieval time is not evidence.

已确认：注册局或RIR直接声明的非联系人字段信息：创建日期、注册商、EPP状态、域名服务器、网段持有者。或者：未脱敏的注册者信息得到第二个独立来源（企业备案、历史快照、存档页面）的佐证。
大概率：多个域名存在独特的共享特征：相同的域名服务器对、相同的邮件租户标签、相同的DKIM密钥、相同的CAA
```
accounturi
```
、相同的特殊TXT令牌。表明为同一运营者，大概率为同一所有者。
未确认：共享主机上的共享IP、共享注册商、共享公共DNS提供商，或可能是转售商的注册者字符串。还包括未查看原始记录的历史数据库中的任何信息。

请始终记录查询时间戳和响应服务器。没有检索时间的WHOIS记录不具备证据效力。

Worked example

实战示例

Target:

northwind-logistics.example

, referred by a fraud team.

RDAP: created eleven months ago, registrar Namecheap, registrant redacted but country

PA

, status

clientTransferProhibited

, nameservers a Cloudflare pair (

dana

rex

). Young, cheap, proxied, origin hidden.

DNS: no MX at all, which kills the "they invoice from this domain" theory outright. TXT holds one

google-site-verification

token and an SPF record whose only include is a transactional-email vendor. DMARC is

p=none

with no

rua

, so there is no reporting vendor to pivot to. Dead end on the mail side.

Historical WHOIS is the break: a snapshot from two months after registration, pre-privacy-service, carries a Gmail address and a name. Reverse WHOIS on that address returns six more domains, four sharing the same

dana

rex

pair — and Cloudflare assigns that pair per account, so this is one operator, not chance.

Grade: registrant identity probable (one snapshot, corroborated by the nameserver cluster, not yet by a filing). Seven-domain cluster confirmed as one operator.

目标：

northwind-logistics.example

，由欺诈团队提交。

RDAP查询结果：11个月前注册，注册商为Namecheap，注册者已脱敏但显示国家为

PA

，状态为

clientTransferProhibited

，域名服务器为Cloudflare的一对服务器（

dana

、

rex

）。域名较新、成本低、已代理、源站隐藏。

DNS查询结果：无MX记录，直接推翻“该域名用于开具发票”的假设。TXT记录包含一个

google-site-verification

令牌和一条仅包含事务性邮件厂商的SPF记录。DMARC设置为

p=none

且无

rua

字段，因此无法通过报告厂商进行关联分析。邮件侧线索中断。

历史WHOIS记录是突破口：注册两个月后的快照（脱敏前）包含一个Gmail地址和姓名。基于该地址的反向WHOIS查询返回另外6个域名，其中4个共享相同的

dana

rex

服务器对——而Cloudflare是按账户分配服务器对的，因此这属于同一运营者，而非巧合。

可信度分级：注册者身份大概率（仅一个快照，得到域名服务器集群佐证，但尚未得到备案信息支持）。7个域名集群已确认为同一运营者。

Pivots

关联分析方向

New selector	Goes to
Subdomains, siblings on shared certs	`find-hidden-subdomains`
IPs, netblocks, ASNs	`find-exposed-servers`
Registrant email, mail vendor, forwarding address	`what-an-email-reveals`
Registrant org, privacy-service jurisdiction	`who-really-owns-it` , `x-ray-a-company`
Registrant phone from a pre-redaction snapshot	`whose-number-is-this`
Historical content at recovered IPs and hostnames	`read-deleted-pages`
Indexed files on discovered hostnames	`google-like-a-spy`
A cluster of domains, IPs and registrants to lay out	`graph-the-network`

新的查询线索	关联工具/方法
子域名、共享证书的兄弟域名	`find-hidden-subdomains`
IP、网段、ASN	`find-exposed-servers`
注册者邮箱、邮件厂商、转发地址	`what-an-email-reveals`
注册者组织、隐私服务提供商管辖地	`who-really-owns-it` , `x-ray-a-company`
脱敏前快照中的注册者电话	`whose-number-is-this`
已恢复IP和主机名的历史内容	`read-deleted-pages`
已发现主机名上的索引文件	`google-like-a-spy`
需要梳理的域名、IP和注册者集群	`graph-the-network`

Legal and ToS notes

法律与服务条款说明

Bulk WHOIS access is contractually restricted: registries and registrars forbid using it for marketing or for building redistributable databases, and enforce with rate limits and blocks. RDAP supports differentiated access, where a vetted authenticated requester sees more than an anonymous one — that vetting exists precisely so personal data cannot be bulk-collected anonymously. Pre-redaction registrant data pulled from a historical database is still personal data under GDPR: you need a lawful basis, and the minimization rules in ../../ETHICS.md apply. AXFR without written authorization can constitute unauthorized access.

批量访问WHOIS数据受合同限制：注册局和注册商禁止将其用于营销或构建可再分发的数据库，并通过速率限制和封禁进行管控。RDAP支持差异化访问，经过审核的认证请求者可查看比匿名请求者更多的信息——这种审核机制正是为了防止匿名批量收集个人数据。从历史数据库中获取的脱敏前注册者数据仍受GDPR约束：你需要具备合法依据，且需遵守../../ETHICS.md中的最小化规则。未经书面授权的AXFR请求可能构成未授权访问。