How do I find out who registered a look-alike domain?

What does a lookup show?

Today, ICANN is launching an updated version of its lookup tool that makes use of the Registration Data Access Protocol, known as RDAP, to query, parse, and display registration data in a human-friendly format.

Under ICANN's Registration Data Policy, effective 21 August 2025, registrars and registries must publish the domain name, the registrar's web address and the creation date.

The creation date tells you how new the look-alike is. A name registered last week deserves more attention than one held for ten years.

Why is the owner's name often missing?

Due to applicable law and ICANN policies, results containing personal data associated with the queried domain name may be redacted for privacy.

ICANN says results containing personal data may be redacted for privacy. For many names you will see the registrar and the dates, but not who the owner is.

How does the lookup work?

9.1.1. In responses to RDDS queries, Registrar and Registry Operator MUST Publish the following data elements: 9.1.1.1. Domain Name 9.1.1.2. Registrar URL 9.1.1.3. Creation Date

RDAP replaced the older WHOIS service for most domain endings. RFC 9082, published in June 2021, sets the web address patterns that RDAP queries use. The lookup tool does this for you.

What do I do with the result?

This document describes uniform patterns to construct HTTP URLs that may be used to retrieve registration information from registries

1. Note the creation date, the registrar and the registrar's abuse contact.
2. If the look-alike is sending mail in your name, report it to that abuse contact with a copy of the message and its headers.
3. Keep a record of the lookup with the date, in case you need it later.