Field notes on
domain intelligence
How to correlate operators, read WHOIS after GDPR, and turn scattered domain signals into an answer you can defend.
- #whois
How to find out who owns a website: programmatic owner identification
Who owns this website? We ran 26 real domains through the WhoisGenius API to answer it live: redacted German newspapers, Meta's subsidiaries, a seven-site media network, a Twitter typosquat, and a parked premium domain. Every result is real, and you can rerun every command.
- #case-study
Work it, caveat it, review it, drop it: triaging the domains your visitor tool hands you
Your visitor-identification tool produces a weekly list of company domains. Nobody checks whether those rows are real, mailable, or the right legal entity before they bill a rep-hour. Here's how domain verification classifies every row into one of four treatments — with the results from a 500-domain test list, and three ways to run your own list today.
- #case-study
From analytics to pipeline: qualifying the companies that visit your site
A BizDev service processing hundreds of visitor domains a week doesn't need more names. It needs to know which rows are real, which account owns them, and which to delete. A technical walkthrough with a full 50-domain run, real verdicts, and the integration that ships it.
- #signals
What a screenshot tells you about who runs a domain
When the registry is blank and the network points at a CDN, the page itself is often the clearest signal left. How WhoisGenius reads a site's screenshot to name the operator, shown on two real domains.
- #case-study
The domain says Facebook. The company is Meta.
The name in the domain is often not the entity that operates it. Real examples (Facebook, Xfinity, npm, Twitter) where the right answer is a parent, a subsidiary, or a company that renamed itself, and why a good attribution tool tells you which.
- #case-study
One operator, many domains: unmasking a portfolio
Tumblr, WooCommerce, Gravatar, Jetpack — four brands that look independent and share one operator. A worked example of portfolio correlation using a publicly documented case, and how the same method surfaces links that aren't public.
- #correlation
How to tell if two domains are run by the same operator
Registrant fields are redacted, but operators still leave fingerprints across their infrastructure. How to correlate two domains to one owner, and how to avoid the shared-infrastructure trap that produces confident, wrong answers.
- #case-study
WHOIS said REDACTED. We found the operator anyway.
Four real domains where the registration record gives you nothing (GDPR-redacted, privacy-shielded, or hidden behind a CDN) and WhoisGenius still names the operator, with the confidence and the signal that carried it.
- #whois
Reading a WHOIS record: what actually matters for investigations
Most contact fields in a modern WHOIS record are redacted noise. A field-by-field guide to the ones that still carry signal (creation dates, nameservers, EPP status codes) and how to read through redaction with RDAP and historical records.
- #signals
Beyond WHOIS: what domain signals reveal about intent
Registration data is redacted, but a live domain still broadcasts dozens of signals about who runs it and why. A working tour of the categories that survive redaction, why fusing them beats any single field, and where a strong signal points at the wrong owner.
Try it on a domain you're investigating
75 free credits to start, no card required.
Get started free