skills.rest
UseOSINT
UseOSINTOFFICIAL
Explore all skills by this author →
GitHub

who-owns-this-domain

Identify domain registrants and operators using WHOIS, RDAP, and DNS record analysis.

38|2|Updated Aug 2, 2026
Search Tags:#investigation#dns#threat intelligence#osint#whois#rdap#domain attribution
One-click install
npx skills add https://github.com/UseOSINT/Skills --skill who-owns-this-domain-useosint
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: who-owns-this-domain
Source: https://github.com/UseOSINT/Skills/tree/main/skills/who-owns-this-domain
Command: npx skills add https://github.com/UseOSINT/Skills --skill who-owns-this-domain-useosint

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Determining who actually owns and operates a domain is harder than it looks: WHOIS data is redacted, registration and operation are often different parties, and shared hosting makes IP-based attribution worthless. This Skill provides the tradecraft to attribute domains correctly using passive sources. ## Core Features & Use Cases - WHOIS and RDAP Lookups: Query registration data via RDAP and registrar WHOIS, interpret EPP status codes, redaction patterns, and transfer events. - DNS Fingerprinting: Analyze A, MX, NS, TXT, SPF, DKIM, DMARC, and CAA records to identify hosting providers, mail vendors, and SaaS tenants, with vendor fingerprint tables in the reference files. - Historical and Reverse Pivots: Use historical WHOIS, passive DNS, and reverse WHOIS to pierce privacy redaction and cluster related domains by shared infrastructure. - Use Case: A fraud team refers a suspicious domain. You pull RDAP for creation date and registrar, read DNS for mail and hosting vendors, find a pre-redaction WHOIS snapshot with a registrant email, and reverse-WHOIS it to uncover a seven-domain cluster operated by one actor. ## Quick Start Use the who-owns-this-domain skill to investigate example.com and tell me who registered it and who operates its infrastructure.

Frequently Asked Questions about who-owns-this-domain

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find out who owns a domain name?▼

Query RDAP at rdap.org for structured registration data including registrar, creation date, and status codes, then check DNS records for the operator. If WHOIS is redacted, use historical WHOIS databases and passive DNS, since redaction is not retroactive across archives.

What is the difference between WHOIS and RDAP?▼

WHOIS is a plaintext protocol on TCP/43 with no schema and silent rate limiting, while RDAP returns the same registration data as JSON over HTTPS with real HTTP status codes. RDAP gives 404 for missing objects and 429 when throttled, making it far easier to script against.

How can I find domain owner when WHOIS is private?▼

Check historical WHOIS databases like DomainTools or SecurityTrails for pre-redaction snapshots, then run reverse WHOIS on any recovered email or name. Also pivot on nameserver pairs, DKIM keys, and CAA accounturi values, which often survive redaction and cluster domains by operator.

What do DNS TXT records reveal about a company?▼

TXT records are a public inventory of an organization's SaaS estate: SPF includes name authorized mail vendors, and verification tokens prove accounts with Google, Microsoft, Meta, Slack, Atlassian, and others. Identical token values across two domains indicate the same vendor account.

Can I use a shared IP address to attribute a domain?▼

No, a shared hosting IP couples a domain to thousands of unrelated tenants and is worthless as attribution evidence alone. It becomes evidence only when the RIR record shows a reassignment to a named customer or the block is small and org-specific.

Is it legal to query historical WHOIS data?▼

Pre-redaction registrant data from historical databases is still personal data under GDPR, so you need a lawful basis and must follow data minimization. Bulk WHOIS access is also contractually restricted against marketing use and redistribution.

Related Skills

Explore More Legal & Compliance Skills→
tomtoto757tomtoto757
14

referral-program

Generate and track refer-a-friend referrals with unique codes and cookie-based attribution.

Community
Intermediate
phatblatphatblat
12

Recon

Automate infrastructure and network reconnaissance for domains, IPs, and netblocks.

Community
Advanced
dslsdzcdslsdzc
64

re-attribution

Attributes cyber threat activity using diamond model analysis, infrastructure graphing, and confidence grading.

Community
Advanced
salmanabdurrahmansalmanabdurrahman

proto-dns

Enumerate DNS records and analyze security configurations for authorized domains.

Community
Advanced