Field notes on
domain intelligence
How to correlate operators, read WHOIS after GDPR, and turn scattered domain signals into an answer you can defend.
- #correlation
How to tell if two domains are run by the same operator
Registrant fields are redacted, but operators still leave fingerprints across their infrastructure. How to correlate two domains to one owner, and how to avoid the shared-infrastructure trap that produces confident, wrong answers.
- #whois
Reading a WHOIS record: what actually matters for investigations
Most contact fields in a modern WHOIS record are redacted noise. A field-by-field guide to the ones that still carry signal — creation dates, nameservers, EPP status codes — and how to read through redaction with RDAP and historical records.
- #signals
Beyond WHOIS: what domain signals reveal about intent
Registration data is redacted, but a live domain still broadcasts dozens of signals about who runs it and why. A working tour of the categories that survive redaction, why fusing them beats any single field, and where a strong signal points at the wrong owner.