Find the owner of a website with privacy protection: what RDAP shows, how to send a registrar disclosure request or use RDRS, and when UDRP or a court helps.
Quick answer: You usually cannot see the owner of a website with privacy protection in a public lookup, but there are lawful ways to reach or identify them. Run an RDAP lookup to find the registrar and any relay contact, message the owner through that relay, then send a formal disclosure request to the registrar or through ICANN's Registration Data Request Service (RDRS). Since 21 August 2025, gTLD registrars must acknowledge such requests within two business days and respond within 30 days. If they refuse, a UDRP complaint or a court order can make the registrar reveal the registrant.
Whether you get the data depends on who you are and why you need it. A trademark owner with evidence of abuse, a victim of fraud with a police report or a lawyer with a court order has a much stronger case than someone who is simply curious. This guide is general information, not legal advice.
What privacy protection actually hides
Two different things show up as "privacy" in a lookup:
- Redaction. Since the GDPR took effect in 2018, registrars have redacted most personal contact details from public results. The registrar still holds the real data. ICANN's Registration Data Policy, in effect since 21 August 2025, governs what is published and how disclosure works.
- A privacy or proxy service. Here the record shows the name of a service instead of the customer. With a proxy service, the service itself is the registrant of record and licenses the domain to its customer.
For generic top-level domains, RDAP replaced the old WHOIS service as the authoritative source of registration data on 28 January 2025 (ICANN). Country-code domains such as .de or .uk follow their own registry's rules.
Step 1: Run an RDAP lookup and note what is visible
Enter the domain in ICANN Lookup. Even a heavily redacted record tells you a lot:
- Registrar and IANA ID: who holds the real data and where to send a request.
- Registrar abuse contact: the right channel if the site is used for phishing or malware.
- Registrant fields: "REDACTED FOR PRIVACY", the name of a privacy service, sometimes an organization name or a country.
- Contact link: many records show a web form or relay email for reaching the registrant.
- Creation date, name servers and status: useful context, and the name servers often point to the DNS or hosting provider.
To find the company hosting the site rather than the domain owner, see who is hosting this website.
Step 2: Contact the owner through the relay
Often you do not need the owner's identity, only a way to reach them, for example to make an offer for the domain or ask them to stop using your content. Use the contact form or relay address in the record. Under ICANN's Registrar Accreditation Agreement, privacy and proxy services must publish when they relay third-party messages to their customers and when they will reveal or publish a customer's identity, along with a way to report abuse or infringement. Read those terms before you write; they tell you what evidence the service expects.
Keep the message factual and save a copy. If the owner answers, you may not need anything further.
Step 3: Send a formal disclosure request
Under section 10 of the Registration Data Policy, every gTLD registrar must link from its homepage to its process for disclosure requests. It must acknowledge a properly formatted request within two business days and respond within 30 calendar days of acknowledgement, absent exceptional circumstances. A refusal must give specific reasons and explain how the registrant's rights were weighed against your interest.
A request is more likely to succeed when it includes:
- who you are and your authority, such as a trademark registration or a letter of authorization from the brand;
- the domain and the exact data you need, usually the registrant's name, organization and email;
- your legal basis and legitimate interest, for example a planned UDRP complaint or a fraud report;
- evidence: screenshots, URLs, dates and copies of any communications;
- how you will use and protect the data.
ICANN's RDRS offers a free, standardized form for the same request. Registrar participation is voluntary, the registrar alone decides whether to disclose, and any data is sent to you outside the system (ICANN FAQ). If the registrar does not take part, you can still fill in the form and send it to them yourself. In November 2025, ICANN's Board extended the service for up to two years after the pilot (ICANN).
If a gTLD registrar ignores you, follow up, then file a complaint with ICANN Contractual Compliance. For EU country-code domains, the NIS2 Directive requires registries and registrars to reply to lawful and duly substantiated requests from legitimate access seekers without undue delay and within 72 hours (Article 28), as implemented in national law.
Step 4: Legal routes that compel disclosure
When voluntary disclosure fails, two routes reliably produce the registrant's details:
- A UDRP complaint. If the domain infringes your trademark, file a UDRP complaint naming the respondent as the record shows it. The provider asks the registrar to confirm the underlying registrant, and you can amend the complaint once you see those details (WIPO). See how to file a UDRP complaint.
- A court order. Depending on the country, a lawsuit against an unknown defendant can let you ask the court to order the registrar, privacy service or host to disclose the customer's identity. In the US, the ACPA even allows an action against the domain itself when the owner cannot be found (15 U.S.C. § 1125(d)(2)).
Victims of fraud should report to the police. Law enforcement has its own channels to registrars and hosts and can often obtain data that private requesters cannot.
Other clues, and when you don't need the owner
The site itself may name a company in its imprint, terms or payment pages, and older records sometimes predate privacy redaction. Treat these clues with care: scam sites copy real company details, and an old record may belong to a previous holder. Never pose as someone else or try to break into accounts to obtain data; that can be a crime and will undermine any later case.
If the site is phishing or impersonating your brand, you rarely need the owner's name to stop it. Registrars and hosts act on evidence of abuse, not on the identity of the registrant, and cybersquatting disputes can proceed against a hidden registrant. Phishvoid verifies such sites and reports them to registrars, hosts, CDNs and blocklists, so the takedown does not wait for a disclosure request.
FAQ
Is it legal to find out who owns a website with privacy protection?
Yes, through lawful channels: public lookups, relay messages, disclosure requests to the registrar and court orders. The registrar decides whether your interest outweighs the registrant's privacy. Pretexting or hacking is not lawful.
Will the registrar tell me who owns the domain?
Only if your request shows a legitimate interest and the registrar finds that it outweighs the registrant's privacy. Expect refusals for vague requests. A trademark owner with evidence, or a court order, has the best chance.
How long does a disclosure request take?
Under ICANN's Registration Data Policy, a gTLD registrar must acknowledge within two business days and respond within 30 calendar days, absent exceptional circumstances. Country-code domains follow their registry's rules.
What if the website is a scam?
Report it to the registrar's abuse contact, the host and the police. You do not need the owner's identity for a takedown, and law enforcement can request the data through its own channels.
Is someone impersonating your brand?
We find lookalike domains and cloned pages and take them down. Start with a free exposure scan.