Tracing Fake Domain Owners After GDPR WHOIS Redaction

You find a website selling counterfeits of your product. The branding is lifted directly from your site. The domain was registered three weeks ago. You run a WHOIS lookup and get back a privacy shield: a generic registrar address, a proxy email, and nothing useful.

This is the reality for most brand protection teams today. Since GDPR came into force, personal registrant data has been redacted from public WHOIS records as standard. For bad actors, this was a gift. For brand owners, it created a genuine investigative wall.

But the wall is not solid. There are legitimate routes to identifying who is behind a domain, and the regulatory landscape is shifting in brand owners' favour.

This article is for informational purposes only and does not constitute legal advice. Seek qualified legal counsel before taking formal enforcement action.

Why WHOIS Redaction Matters for Brand Protection

Before 2018, a WHOIS lookup returned the registrant's name, email, phone number, and physical address. Brand protection teams used this daily: to identify serial infringers, send cease and desist letters, and build cases for takedowns and legal proceedings.

GDPR changed that. Registrars responded by redacting all personal information by default, regardless of where the registrant was located. The result was a near-universal loss of publicly accessible ownership data.

The practical impact:

• Fake websites can be registered and operated with meaningful anonymity
• Repeat infringers are harder to connect across multiple domains
• Cease and desist letters have no verified recipient
• Enforcement actions requiring a named defendant become significantly more complex

Investigation is not impossible. It requires more steps, more tools, and a clearer understanding of what data is still accessible and through which channels.

Start With RDAP, Not WHOIS

Most investigators default to WHOIS out of habit. The better starting point is RDAP, the Registration Data Access Protocol, which replaced legacy WHOIS as the standard for querying domain registration data.

RDAP is structured, machine-readable, and in some cases returns more fields than a traditional WHOIS query. It is also the system through which formal data access requests are processed.

What RDAP can still surface publicly:

• Registrar name and IANA ID
• Domain creation, update, and expiry dates
• Domain status codes (locked, in transfer, under dispute)
• Nameserver information
• Registrant organisation name, where the registrant is a legal entity rather than a natural person

That last point matters. Legal entities do not benefit from the same GDPR protections as natural persons, so if the fake domain is registered to a business, the organisation name may still appear publicly.

Registrar Disclosure Requests

When public RDAP data is insufficient, submit a formal disclosure request directly to the registrar. Every accredited registrar holds the full registration record behind the privacy shield and is required to respond to lawful requests.

A credible disclosure request should include:

• Your legal basis (trademark rights, evidence of infringement, consumer harm)
• Documentation of the infringing activity (screenshots, URLs, dates)
• Your organisation's identity and its relationship to the affected brand
• A specific request for the registrant's name and contact details

Registrars vary in how they handle these. Some have dedicated abuse processes; others require a formal legal letter. Response times are inconsistent, but a well-evidenced request to a reputable registrar will often produce a result where the infringement is clear.

What NIS2 Article 28 Changes for Brand Owners

The regulatory picture is improving. NIS2 Article 28 introduces requirements around domain registration data that directly benefit brand protection teams.

Under Article 28, EU Member States must ensure that TLD registries and domain registration providers:

• Collect and maintain accurate, complete registration data
• Have verification procedures to confirm that data is correct
• Publish non-personal registration data without undue delay
• Respond to lawful access requests from legitimate requesters within 72 hours

That 72-hour window is significant. Previously, there was no binding timeline for registrars to respond. NIS2 creates one, at least for EU-regulated registries.

The key shift: NIS2 defines legitimate access seekers as any person making a request under EU or national law, and industry bodies are pushing member states to confirm this includes rights holders pursuing IP claims. A brand with documented evidence of infringement is in a stronger position than it was under GDPR alone, although the exact rules depend on how each country has implemented the directive. A brand with documented evidence of infringement now has a clearer legal footing than it did under GDPR alone.

NIS2 does not override GDPR. Personal data remains protected. But the directive creates a structured access framework that did not previously exist, and it requires registrars to verify the accuracy of the data they hold.

Infrastructure Clues: What the Domain Itself Can Tell You

Formal disclosure requests take time. While you wait, the domain's own infrastructure often reveals useful information. Fake websites are rarely built from scratch. They reuse hosting environments, certificate providers, and analytics accounts that can connect multiple domains to a single operator.

Hosting and IP Address Analysis

Every domain resolves to an IP address belonging to a hosting provider. Running a reverse IP lookup can show other domains hosted on the same server, sometimes revealing a cluster of fake sites operated by the same party.

Steps to take:

• Use a DNS lookup tool to identify the hosting provider and nameservers
• Submit an abuse report with evidence of infringement
• Request account information disclosure or direct content removal

Hosting providers are not bound by the same GDPR constraints as domain registrars, and many will act on well-evidenced abuse reports.

SSL Certificates

Certificate Transparency logs, searchable via crt.sh, record every certificate issued for a domain. They can reveal:

• Other domains on the same certificate (Subject Alternative Names)
• The certificate authority used
• The exact issuance date, which helps establish a timeline

A fraudster who registered ten fake domains and secured them with a single wildcard certificate has linked all ten together in a public log.

Analytics and Tracking IDs

Many fake sites retain the same Google Analytics ID or tracking pixel across multiple domains. Viewing the page source and identifying a shared measurement ID can reveal the full network of sites operated by the same person. This type of infrastructure fingerprinting is one of the most reliable ways to connect repeat infringers operating under different domain names.

When Ownership Identification Actually Matters for Enforcement

Not every fake domain investigation requires identifying the owner. In many cases, the more effective route is to remove the content or de-index the domain without ever knowing who registered it.

Remove.tech's fake website removal service operates on this basis: eliminate the threat, not necessarily prosecute the person behind it. For most brands, a fake site that has been taken down and de-indexed from Google has been neutralised.

Ownership identification becomes critical in specific circumstances:

• Repeat infringement: The same operator keeps registering new domains after each takedown
• Significant financial harm: Counterfeit sales or phishing has caused material damage and civil recovery is being pursued
• Criminal referral: The activity crosses into fraud or organised counterfeiting requiring law enforcement
• UDRP proceedings: The Uniform Domain-Name Dispute-Resolution Policy requires a named registrant as respondent

For isolated incidents, a well-documented takedown request is usually the fastest path. For coordinated, persistent domain abuse, the investigative steps above become part of a longer enforcement strategy.

Remove.tech monitors across 100,000+ websites and platforms continuously, flags fake domains as they appear, and supports enforcement from detection through to removal.

FAQ

Can I find out who owns a domain if WHOIS data is hidden?

Yes, in many cases. RDAP queries can still return organisation names for business registrants, domain dates, nameserver data, and registrar information. For personal registrant data, submit a formal disclosure request with evidence of infringement. Under NIS2 Article 28, EU-regulated registrars must respond within 72 hours.

What is the difference between WHOIS and RDAP?

WHOIS is the legacy protocol. RDAP is its structured replacement, introduced by ICANN. It returns data in a standardised format, supports tiered access, and is the system through which formal disclosure requests are managed.

Does NIS2 force registrars to share personal registrant data with brands?

Not automatically. NIS2 creates a structured access framework and a 72-hour response obligation. It does not guarantee disclosure in every case, and personal data remains protected under GDPR.

What can I investigate without contacting the registrar?

Certificate Transparency logs (via crt.sh) can reveal other domains on the same certificate. Reverse IP lookups can identify other sites on the same server. Page source inspection may reveal analytics IDs shared across multiple fake domains.

Is it always necessary to identify the domain owner to take a site down?

No. Fake websites can often be de-indexed and removed from hosting without identifying the registrant. Ownership identification matters when pursuing repeat infringers, civil claims, or UDRP proceedings.

How does Remove.tech help with fake domain enforcement?

Remove.tech monitors over 100,000 websites and platforms continuously, identifying fake domains and counterfeit sites as they appear. The platform supports enforcement through legal notices, de-indexing requests, and direct removal actions.

‍