WHOIS Is Dead, Long Live WHOIS: Investigating Domains After GDPR

The day the registrant field went dark

Before May 2018, WHOIS was the closest thing OSINT had to a cheat code. Query a domain, read the registrant's name, email, phone, and address. Pivot on the email, find fifty more domains, map the operation before lunch. Sloppy attackers reused registration details constantly, and entire campaigns were unmasked from a single admin@ address.

Then the GDPR entered into application on May 25, 2018. Registrant contact details are personal data, publishing them to anyone who asks is processing without a lawful basis, and registrars faced fines of up to 4% of global turnover. ICANN scrambled out a Temporary Specification, and within weeks most gTLD WHOIS output collapsed to this:

Registrant Name:  REDACTED FOR PRIVACY
Registrant Org:   REDACTED FOR PRIVACY
Registrant Email: Please query the RDDS provider of the registrar

The redaction is global in practice. Registrars cannot reliably tell EU registrants from others, so most redact everyone. The classic email pivot died overnight for new registrations.

What did not die: the technical record. Registrar, registration and expiry dates, name servers, statuses, and DNSSEC data were never personal data and remain public. Attribution shifted from reading identities to correlating patterns.

RDAP: the protocol that replaced port 43

WHOIS the protocol was always a mess: no schema, no encoding guarantee, a different text format per registry. Its successor, RDAP (Registration Data Access Protocol, RFCs 7480-7484), is HTTP plus JSON with a defined schema, proper internationalization, and a bootstrap registry that tells you which server is authoritative for which TLD. It has been mandatory for gTLD registrars since 2019, and ICANN formally sunset the WHOIS port 43 obligation in January 2025.

# One request, structured output
curl -s https://rdap.org/domain/suspicious-domain.com | jq '{
  handle,
  registrar: .entities[0].vcardArray,
  events: [.events[] | {eventAction, eventDate}],
  nameservers: [.nameservers[].ldhName],
  status
}'

RDAP gives you clean registration, expiration, and last changed events, registrar identity with IANA ID, and name servers, all parseable without regex archaeology. The registrant contact is still redacted; RDAP standardizes the format of the data, not access to it. Tiered access for vetted parties (the ICANN RDRS system) exists but is slow, discretionary, and rarely useful mid-incident.

For investigators the practical rule is: script against RDAP, stop parsing port 43 text.

One caveat on scope: ICANN policy binds gTLDs (.com, .net, .org and friends), not country-code TLDs. Each ccTLD registry sets its own rules, so output varies wildly: some ccTLDs redacted registrant data years before GDPR, a few still publish more than you would expect, and several never offered public registration data at all. Check the specific registry's policy before assuming a ccTLD record is complete or trustworthy.

The pivots that still work

Registration metadata patterns

Redacted does not mean featureless. Campaign infrastructure is usually registered in batches, and batches share fingerprints:

• Registrar choice. Bulk-abuse operations concentrate at a handful of cheap, low-friction registrars. A cluster of lookalike domains at the same niche registrar is signal.
• Creation dates. Twenty domains registered within the same hour tell you more than any contact field ever did.
• Registration length. Legitimate businesses renew; throwaway domains are registered for exactly one year and abandoned.
• TLD selection. Waves of .top, .shop, .icu lookalikes reflect price, not branding.

Name servers

NS records survive redaction and change rarely. Attackers who run their own name servers (ns1.some-bulletproof-host.net) hand you a pivot: every domain delegated there is worth a look. Even attackers using commodity DNS often keep the same provider across a whole campaign, which combines well with creation-date clustering.

Certificate transparency

Every TLS certificate issued by a public CA is published to append-only Certificate Transparency logs. That makes CT a registration-independent discovery channel:

# All certificates ever issued for a domain and its subdomains
curl -s "https://crt.sh/?q=%25.suspicious-domain.com&output=json" \
  | jq -r '.[].name_value' | sort -u

CT pivots earn their keep three ways. Certificates enumerate subdomains the attacker never expected you to find. A certificate's NotBefore timestamp dates when infrastructure was being prepared, often days before first use. And multi-SAN certificates covering several domains at once are an operator explicitly linking their own infrastructure for you.

Privacy proxies: sometimes a pivot themselves

Privacy and proxy services (Domains By Proxy, WhoisGuard and friends) predate GDPR and remain visible in the record as the registrant organization. Ironically, the choice of proxy service is weak signal: it narrows the registrar, and some proxy services still expose a per-domain forwarding email like [email protected]. Those forwarding addresses are unique per domain at most services, but a few implementations reuse them, and a reused one is a clean pivot. Always check.

Historical WHOIS

Records collected before May 2018 were never redacted, and commercial archives keep them. If your target domain (or its operator) was active before GDPR, historical WHOIS can still produce a name or email, which then pivots into present-day infrastructure through reverse-WHOIS on the archive. Domains registered after 2018 have no such shadow, which is exactly why the other pivots above matter more every year.

A practical pivot workflow

Given one suspicious domain, run the sequence:

No single step attributes anything. Confidence comes from stacking independent weak signals: a shared registrar means little, but a shared registrar plus a two-hour creation window plus identical name servers plus sequential hosting on the same VPS range is a cluster you can defend. Write down which pivots produced each link; a cluster you cannot replay is a cluster you cannot trust.

Steps 1 and 2 do not require leaving your enrichment tool: a domain lookup on mlab.sh returns registration data alongside passive DNS history and reputation in one view, which keeps the mechanical part of the workflow fast. The judgment part, deciding which overlaps mean ownership, stays yours.

Living with the redaction

GDPR did not end domain investigations; it ended lazy ones. The registrant field was always the easiest data to fake, and serious actors faked it long before 2018. What redaction actually removed was the free wins against careless operators, and what it left behind (dates, delegation, certificates, hosting history) is harder to forge precisely because it is generated by infrastructure rather than typed into a form.

WHOIS used to hand you answers. Now it hands you threads. Pull enough of them in the same direction and the answer is still there.