The pitch for a domain-intelligence tool is easy to make and hard to keep: we find the operator even when WHOIS won’t tell you. Anyone can claim that. So here are four real domains where the registration record is a dead end, run through WhoisGenius, with the actual result and the signal that got there. None of them are cherry-picked easy wins. Look each one up the normal way and you get REDACTED, a privacy proxy, or a CDN’s front door.
ecosia.org, GDPR-redacted, solved at 96.5%
Look up ecosia.org and the registrant fields are blank. It’s redacted under GDPR through DENIC, the German registry. No organization name, no email, no country. The TLS certificate is a domain-validated one with no company in it. The site sits behind a CDN. Every traditional attribution signal is either empty or points at infrastructure.
WhoisGenius returns Ecosia GmbH at 96.5% confidence, carried almost entirely by content signals: the structured data and copyright markers on the page itself. The registry told us nothing. The site told us everything.
curl -X POST https://api.whoisgeni.us/analyze \
-H "X-API-Key: YOUR_KEY" -H "Content-Type: application/json" \
-d '{"domain": "ecosia.org"}'The reveal in one line: WHOIS: REDACTED FOR PRIVACY becomes Ecosia GmbH.
grammarly.com, the double blind
grammarly.com is the harder case, because two signals fail at once. The WHOIS record is redacted behind a privacy service, and the site is behind Cloudflare, so the network layer resolves to the CDN rather than the company. The two signals investigators lean on most, registration and hosting, are both useless here.
WhoisGenius still lands on Grammarly. It doesn’t stop at those two. When registration and network go dark, content and certificate signals carry the weight. No single signal is magic. The point is that the ones which survive redaction are enough.
protonmail.com, when the network gives it away
protonmail.com shows a fully redacted WHOIS (“Redacted for Privacy”). But Proton is large enough to run its own network, its own autonomous system, and that ownership shows in the routing. The answer comes back Proton AG, anchored by the network rather than the registration.
That’s a useful contrast with Ecosia. Same blank WHOIS, completely different signal doing the work: content for Ecosia, network ownership for Proton. A tool that only knew one trick would miss one of them. Reading everything together is what covers both.
abuse.ch, the blank record
abuse.ch is the extreme version. Swiss .ch WHOIS returns essentially nothing, often no usable record at all, and the site presents only a domain-validated certificate. There’s no registration signal to redact, because there’s barely a registration signal to begin with.
WhoisGenius returns abuse.ch, the threat-intelligence project run out of a Swiss university, from content and certificate evidence. Confidence is lower here, and that’s correct. When the signal is genuinely thin, an honest tool reports moderate confidence instead of false certainty. Which is the whole point of the next section.
The honest part
None of this means WHOIS is useless. It means WHOIS is one signal, and increasingly a blank one. The domains above resolve because WhoisGenius reads the registration record, the certificate, the DNS, the network, and the page, then weighs them together. When the loudest signal is silent, the quieter ones decide.
And when all of them are quiet, a parked domain with no content, no certificate, no distinguishing infrastructure, the right answer is “we don’t know,” reported as low confidence rather than a confident guess. Our published benchmark tracks exactly that. On the privacy-redacted and CDN-hidden categories, top-1 accuracy is 100%, and the confidence scores are calibrated: when it says 91%, it’s right about that often. We publish where we’re wrong, too.
Want to check one of these yourself, or a domain of your own? Start free with 75 credits. No card, and the four domains above are in the interactive demo on the home page.