Reverse WHOIS Lookup: Find Linked Domain Names

Reverse WHOIS is the process of starting with a person, company, email address, postal address, or another clue, then finding other domains that appear to be connected to the same owner or operator. In simple terms, it flips the usual domain lookup on its head. Instead of asking, “Who is behind this one domain?”, you ask, “What else might this person or business control?”

The important caveat is that reverse whois is no longer as direct as it once was. Since personal registration data has been heavily redacted in many cases, modern reverse whois work often relies on a mix of current registration records, historic records, DNS evidence, website clues, and infrastructure patterns. That means results can be very useful, but they are often partial rather than complete. If you need to map a portfolio accurately, the best approach is to combine several signals rather than rely on a single lookup.

What Is Reverse WHOIS Lookup?

A reverse WHOIS lookup is a way to discover multiple domain names linked to the same person or company. Traditionally, a normal WHOIS search began with one domain and returned whatever registration details were available for that name. Reverse whois does the opposite. You begin with a known detail and search for other domains that share it.

That detail might be a registrant name, an organisation name, an email address, a phone number, a street address, or a technical clue such as shared name servers. If several domains reuse the same identifier, they may belong to the same portfolio, brand group, affiliate operation, or technical administrator.

In practice, reverse whois is now a broad research method rather than a single database trick. Today, investigators often combine:

• registration data where it is still visible
• historic records that captured older disclosure
• DNS and hosting patterns
• website content and branding clues

The phrase “every domain a person or company owns” should be treated carefully. Reverse whois can help uncover many connected names, sometimes enough to map a meaningful portfolio, but rarely guarantees a complete list. Privacy services, redacted records, separate registrars, and different technical setups can all hide links that once would have been obvious. It is best used as an evidence-gathering method, not as proof that no other domains exist.

How Reverse WHOIS Works After RDAP Replaced WHOIS

Searchers still commonly say reverse whois, but for many gTLDs the underlying data landscape changed on 28 January 2025. On that date, ICANN’s RDAP became the definitive source for gTLD registration data, and the old WHOIS port 43 obligations for gTLD registries and registrars ended. In practical terms, the name of the task stayed familiar, but the core source for current gTLD registration records shifted.

RDAP is more structured than older WHOIS output. It is designed to return registration information in a standardised format, which can help with cleaner parsing and better automation. For reverse whois research, that matters because investigators often need to compare many records across many domains and look for repeated fields or patterns.

The difficulty is that reverse matching still depends on what data is actually disclosed. RDAP can present current registration data clearly, but it cannot reveal personal details that are not published. So modern reverse whois work often follows a layered approach:

• query current RDAP records for visible ownership or contact clues
• compare technical fields such as name servers and status patterns
• supplement with historic archives and DNS evidence
• verify findings against website and brand signals

For many gTLDs, reverse whois now really means reverse domain ownership research using RDAP-era data. The terminology persists because the investigative goal is the same, even though the transport and publication model has evolved.

Why Reverse WHOIS Became Harder After GDPR

Reverse whois became significantly harder after 25 May 2018, when GDPR took effect. Before that point, many WHOIS records routinely exposed personal registrant details such as names, email addresses, phone numbers, and street addresses. Those fields made direct matching straightforward. If the same email address appeared on multiple domains, for example, the connection was often obvious.

After GDPR, most personal registrant data in WHOIS became redacted. That sharply reduced the usefulness of classic reverse whois searches based on individual identity fields. In many cases, the most valuable matching points simply stopped being visible in public registration records.

The effect was especially strong for domains registered by individuals. Searches by person name or personal email address often now return little or nothing in current public records. That does not mean the domains are unrelated. It usually means the public data no longer exposes the link.

Useful results may still come from:

• company-owned domains where an organisation name is disclosed
• older or historic records captured before redaction
• non-personal identifiers such as name servers or DNS infrastructure
• website evidence such as branding, contact pages, or legal notices

This is why expectations matter. Modern reverse whois is less about one perfect query and more about assembling a picture from partial signals. You may still find strong portfolio connections, but complete certainty is rarer, and negative results are not conclusive proof that no relationship exists.

What Data Points Can Still Link Domains to the Same Owner?

Even with redacted records, domains often leave traces that can be compared. The best reverse whois work looks for repeated identifiers across registration data, DNS, hosting, and website presentation. A single clue may be weak on its own, but several clues together can be persuasive.

Current registration records may still reveal a registrant organisation, admin contact, or abuse contact. These are especially useful when a business uses the same operational details across a portfolio. Historic registration records can also show older names, emails, or addresses that are no longer public.

Technical patterns are often just as important. Investigators commonly compare:

• name servers
• registrar choices and registration timing patterns
• hosting overlap and IP history
• DNS records such as MX or TXT configuration
• SSL certificate details where available
• privacy service reuse across related names

Website-level evidence can be surprisingly strong. Shared branding, identical page templates, repeated copyright notices, the same contact forms, or linked social profiles may all suggest common control. Search engine indexing and cached pages can sometimes reveal relationships that current registration records do not.

No single data point should be treated as definitive in every case. Name servers can be shared by unrelated customers, and the same privacy service may cover many registrants. The strongest conclusions usually come from convergence, where registration clues, infrastructure patterns, and on-site branding all point in the same direction.

Reverse WHOIS Lookup Tools and Data Sources

There is no single source that will reliably reveal every domain connected to an owner. Good reverse whois research uses several categories of tools and data, each with different strengths and blind spots.

Current RDAP queries are the starting point for many gTLD investigations because they provide the definitive current registration record for those spaces. Where registry or registrar records expose useful fields, they can still support direct matching. Their limitation is obvious: if the relevant data is redacted or omitted, matching power drops sharply.

Historic archives can be extremely valuable because they preserve earlier WHOIS or RDAP-era disclosures. Passive DNS and ordinary DNS lookups help uncover technical overlap, such as shared name servers, MX records, or infrastructure changes over time. Web crawling and search engine operators can surface contact pages, repeated text, legal notices, and cross-links between sites.

Common source categories include:

• current RDAP records
• registry and registrar records where available
• historic WHOIS or RDAP archives
• passive DNS and direct DNS lookups
• web crawling and search engine research
• internal portfolio research and analyst review

Each source answers a different question. RDAP tells you what is visible now. Historic archives show what used to be visible. DNS and passive DNS show operational overlap. Web evidence shows how domains present themselves publicly. The most reliable reverse whois results come from combining these sources, then checking whether the same pattern appears in more than one place.

How to Do a Reverse WHOIS Search Step by Step

A useful reverse whois workflow starts with one known domain and builds outward carefully. The aim is not to guess, but to document links strong enough to survive scrutiny.

1. Start with the known domain. Pull the current RDAP record. Since 28 January 2025, RDAP is the definitive source for gTLD registration data, after WHOIS port 43 obligations ended for gTLD registries and registrars.

2. Record every disclosed identifier. That may include registrant organisation, contact email, reseller references, registrar, name servers, status codes, and any visible technical contacts. If personal data is missing, that is normal. GDPR took effect on 25 May 2018, after which most registrant personal data in WHOIS became redacted.

3. Expand through technical clues. Review DNS, mail setup, hosting patterns, SSL certificate clues, redirects, and the website itself. Footer notices, legal pages, and contact forms often reveal operating entities.

4. Check historic records. Historic WHOIS and DNS snapshots can surface older contact details, previous name servers, and migration patterns that current records no longer show.

5. Validate common control. Look for multiple matching signals, not just one.

• Same organisation name plus matching contact channel
• Repeated DNS patterns plus consistent branding
• Shared legal notices or linked customer support details

6. Separate strong matches from weak correlations. A shared hosting provider is weak. A shared registrant organisation and consistent site ownership signals are stronger.

Keep notes, dates, screenshots, and URLs. Good reverse whois work is as much about documentation as discovery.

Can You Find Every Domain a Person or Company Owns?

Usually, no. A reverse whois search can uncover a meaningful part of a portfolio, but no public method guarantees every domain owned by a person or company.

That is the core reality behind the phrase reverse whois. It is powerful for mapping likely ownership, but it is not an all-seeing register of every asset tied to one owner.

There are several reasons for this. Some are technical, some are procedural, and some are deliberate.

• Personal data has often been redacted since GDPR took effect on 25 May 2018
• Different domains may sit with different registrars
• Privacy services can obscure contact details
• Separate companies or shell entities may hold different names
• Distinct DNS, hosting, and email setups can hide common control
• Historic links may disappear after updates or transfers

Individuals are particularly hard to map completely. A private person using privacy services, separate email addresses, and unconnected technical providers may leave little public evidence. Companies are often easier, especially where branding, legal notices, support channels, and infrastructure overlap.

In practice, the goal should be completeness where possible, not certainty where impossible. For due diligence, dispute preparation, or acquisition planning, finding the core portfolio and the strategically relevant names is often enough to make good decisions.

So the honest answer is this: reverse whois can reveal a lot, sometimes a great deal, but it cannot promise every domain.

How to Verify Reverse WHOIS Results Before You Rely on Them

Reverse whois results are only as good as the evidence behind them. The biggest risk is treating a weak correlation as proof of common ownership.

False positives are common. Unrelated domains can look connected because they use the same agency, hosting company, DNS provider, privacy service, or reseller. A shared name server alone often proves very little. The same applies to common website themes, parked pages, or mass-market infrastructure.

False negatives happen too. A genuine portfolio may appear fragmented because different entities, registrars, or privacy layers are used across names.

Before relying on a match, test it from several angles.

• Compare branding across websites, not just logos but tone, support channels, and product overlap
• Check legal notices, terms pages, and privacy pages for company names or addresses
• Review redirect behaviour between domains
• Compare DNS history and hosting changes over time
• Look for repeated contact details such as email aliases or phone numbers where disclosed
• Check relevant business records if the domain appears tied to a trading company

Think in terms of evidence weight. One clue is a lead. Several consistent clues are an attribution case.

Documentation matters here as well. Save the RDAP record, the DNS snapshots, website captures, and any business record references. If a conclusion matters commercially, you should be able to explain exactly why you reached it, and which facts are direct evidence rather than inference.

Reverse WHOIS for Due Diligence, Brand Protection, and Acquisitions

Reverse whois is most useful when it supports a concrete commercial objective. In buyer-side work, that often means understanding the shape of a seller’s portfolio before making an approach.

For acquisitions, it helps you map related names that may matter to value. A seller offering one domain may also control obvious defensive registrations, typo variants, or adjacent brand terms. Seeing that wider picture can change pricing strategy, bundling options, and negotiation sequencing.

It also helps identify the best negotiation path. The name you want may sit with one entity, while support pages, redirects, or linked domains point to the actual operating business behind it. That distinction matters when deciding whom to contact and how to frame a serious enquiry.

For brand protection, reverse whois can reveal patterns across registrations that suggest coordinated cybersquatting or repeat targeting. One domain in isolation may look minor. A cluster of related names can show a broader pattern worth monitoring.

Expiry and transfer timing matter too. A domain usually cannot be transferred to another registrar for 60 days after registration or a registrar transfer. That can affect transaction planning, especially if the preferred completion route depends on an immediate registrar move.

Used properly, reverse whois is less about curiosity and more about leverage: better intelligence, cleaner outreach, and fewer surprises in diligence.

What Happens If a Linked Domain Expires?

If a linked domain expires, do not assume it is immediately available. For many gTLDs, the path after expiry follows a staged lifecycle, and each stage affects what you can do next.

A common sequence is:

• Auto-renew grace period, up to 45 days
• Redemption period, 30 days
• Pending delete, 5 days

During the auto-renew grace period, the registrar may still allow the current registrant to renew at the standard renewal path. The website may go offline, resolve inconsistently, or show parking or registrar hold pages, but the domain is not necessarily lost.

If it moves into redemption, recovery is usually harder and handled through a distinct restore process. A watcher should treat this as a warning sign, not as proof that the name is close to capture.

Pending delete is the final short stage before the domain drops from the registry and may become available again. At that point, the original registrant generally has very limited room to act.

Timing is not universal. Registry rules, registrar policies, and account status can alter the exact path. That is why status checking matters more than guesswork. Confirm the current RDAP status, review the registrar’s lifecycle rules, and watch DNS and website behaviour for changes.

If an expiring linked domain matters to an acquisition or enforcement strategy, a confidential Westmore review can clarify the real options.