Who Owns This Website? A Three-Layer Ownership Check

Ownership questions come up before an account signup, a payment, a partnership or a takedown request. The answer rarely sits in one place. The check splits into three layers: the domain record, the legal data the site publishes about itself, and the public register that lists the company behind it. Each layer answers a different question, and a mismatch between two of them says more than any single lookup.

The domain record

Why whois stopped answering

Two things changed. GDPR came into force in 2018, and registrars began redacting registrant name, address and email from public output. What remains is the registrar, the dates and the status codes — useful, but no longer an owner.

The second change is less discussed and causes more confusion. A command-line whois client picks its server by the top-level domain. For a number of newer gTLDs the client finds no match in its own table and falls back to IANA, which answers with the record for the TLD delegation rather than for the domain. The output has the shape of a valid answer: a domain name, an organisation, dates. Read quickly, it suggests the domain is registered to someone else entirely, or that the query failed silently.

A check across several .casino domains reproduces this: every query returns the same IANA record, and the actual registration status of each domain stays invisible.

RDAP

RDAP is the protocol ICANN mandated as the whois replacement. It runs over HTTPS, returns JSON instead of free-form text, and has a bootstrap service that routes a query to the correct registry without a local server list.

curl -s https://rdap.org/domain/example.com | jq

The fields worth reading:

The registrant contact usually stays redacted here too. RDAP does not restore the data GDPR removed — it restores the ability to get a reliable answer about the domain itself.

Reading the creation date

A domain registered a few weeks ago carries no verdict on its own. New projects exist, and rebrands move to new domains regularly. The date becomes meaningful in combination: a domain a month old, a company name that returns nothing in any register, and claims that imply years of operation.

The expiration date carries its own signal. A domain renewed for a single year costs less and commits to nothing; multi-year registration indicates the owner expects the project to outlive the current quarter.

What the site publishes about itself

Regulated services are required to identify themselves, and the required details sit in predictable places: the footer, the Terms and Conditions, the About us page and the contact page.

The details worth extracting:

• The legal entity name, including its suffix — LTD, LLC, B.V.
• The company registration number and the jurisdiction of incorporation.
• The licence number, where the industry is licensed.
• The registered address and the contact addresses for complaints.

A site that publishes none of this ends the check early. The absence is itself the finding.

Where the details are present, they still prove nothing on their own. Any text can be typed into a footer. The value of this layer is that it produces the search terms for the next one.

The public register

Licensing bodies publish registers of their holders, and those registers are searchable by anyone. This is the layer where a claim either confirms or falls apart.

To verify an operator against a register, follow these steps:

1. Copy the licence number and the company name from the Terms page.
2. Open the register of the regulator named on the site.
3. Search by licence number, and repeat the search by company name.
4. Compare the holder name in the register with the entity named on the site.
5. Check the validity dates and the licence type.
6. Check which domains are attached to the licence.

A worked example makes the sequence concrete. The site 777seven.casino names Anjouan Gaming Authority as its regulator. The licence number, the operator name and the validity period are set out together in one table on uk-seven.casino, which is convenient for copying into the register search. Running that search returns:

Three of those fields matter most. The holder name has to match the entity named on the site, otherwise the site is quoting someone else's licence. The type has to match the activity — a B2B licence quoted by a consumer-facing service is a mismatch. The validity period has to cover today's date, since expired licences stay in registers as historical records.

Mirrors and discrepancies

One result comes up often enough to expect it: the register lists fewer domains than the brand actually runs.

Operators register mirror domains in batches and add them to the licence on their own schedule, so a domain absent from the register is not automatically operating outside it. The question to ask is narrower — does the operator named on that domain match the holder in the register, and is the licence current? A mirror run by the licensed entity is an administrative gap. A mirror naming a different company is a different situation entirely.

The same applies in reverse. A licence listing domains that no longer resolve usually means an old project, not a live one.

The checklist

Five steps cover the whole check:

1. Query the domain over RDAP and record the registrar, the creation date and the nameservers.
2. Treat a domain younger than a year as a reason to weight the remaining layers more heavily.
3. Pull the legal entity, the registration number and the licence number from the footer and the Terms page.
4. Search the regulator's register by licence number and by company name.
5. Compare holder, licence type and validity dates against what the site claims.

A site that passes all five is not thereby trustworthy — the check confirms identity, not conduct. What it rules out is the cheapest category of misrepresentation: a service claiming a licence it does not hold, a company name that exists nowhere, or a domain registered last week behind a decade-old story.