From WHOIS to What Now? Infrastructure Tracking in the Privacy Era

Introduction

I gave a version of this article as a presentation at the 2026 OSMOSISCon in Florida. The talk was titled “From WHOIS to What Now? Investigating Domains in the Privacy Era” and was delivered to a room full of OSINT investigators facing a starkly different reality than the one I encountered when I first started investigating online fraud and abuse in 2012.

This article is a written adaptation of that talk, with additional context and examples to help investigators understand how to pivot their investigative strategies in the modern era of domain privacy and redacted WHOIS data. It might feel a little familiar if you have read my other articles on domain investigations, but I promise there are new insights and techniques here that will help you adapt to the current landscape.

The Era of the Easy Button

Back in 2012, domain name intelligence was a straightforward game. If a malicious site popped up, you ran a standard WHOIS query via Port 43 or dropped the URL into a tool like CentralOps. Within seconds, you had the physical address, a real phone number or email address, and a name of the individual who registered it. If you needed to track ownership over time, buying a historical report from DomainTools for $49 could blow case wide open.

Fast forward to today. You run that same query on a malicious domain now, and you are slapped with a concrete wall of REDACTED FOR PRIVACY. To add insult to injury, instead of this answer costing you $49 when you want the historic records, it is now $99.

The old playbooks are obsolete. The privacy wall is permanent, and trying to brute-force your way through it by purchasing legacy, stale data reports is mostly just burning cash.

But here is the open secret from my years in online fraud investigations and domain anti-abuse operations: the data behind the redaction wall was usually garbage anyway. Professional threat actors have spent years using stolen PII, burner emails, throwaway accounts, and VPN proxies to fill out those forms.

If you want to track bad actors in the modern digital landscape, you have to shift your entire mindset. Stop looking for people. Start fingerprinting infrastructure.

The Great Redaction: Why the Lights Went Out

The shift from an open directory to a total public blackout did not happen by accident. It was driven by the collision of global privacy legislation and the tight economics of the domain industry.

When the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) came online, they mandated strict protections for citizen data. The ICANN community struggled to produce a timely, unified consensus on how to handle domain registration data under these laws. To avoid catastrophic financial penalties, ICANN implemented a “Temporary Specification,” which effectively turned the lights off on public WHOIS data overnight.

From an economic standpoint, registrars operate on razor-thin margins. Manually verifying whether a registrant is an individual citizen protected by GDPR or a commercial entity that should be public is an incredibly expensive operational hurdle. For a registrar, the cheapest and safest compliance move is to hide everything by default.

As legacy WHOIS fades, the industry is transitioning to RDAP (Registration Data Access Protocol). Unlike the inconsistent text formatting of Port 43 WHOIS, RDAP is web-based, standardized in JSON, and mandated for all generic top-level domains (gTLDs). Crucially, RDAP supports “Tiered Access”. This provides the secure, authenticated infrastructure that will eventually allow law enforcement and verified intellectual property attorneys to systematically request unredacted historical registration data. In theory, at least.

The Counterfeit Identities of the Domain World

Before you can manipulate infrastructure data, you have to know who holds the keys. The domain ecosystem operates in a strict hierarchy consisting of ICANN, registry operators, registrars, third-party resellers, and end registrants.

Your investigative strategy must pivot based on the type of extension you are targeting:

• gTLDs (.com, .xyz, .app): Regulated heavily by ICANN. They are strictly redacted but highly standardized across the board.
• ccTLDs (.de, .uk, .su): Sovereign territory. Country-code operators set their own rules. Some ccTLDs are completely transparent and open, while others are total black boxes that refuse to cooperate with foreign investigators without a local court order. Always review the specific registry policy first.

Stop Hunting Names, Start Fingerprinting Infrastructure

If threat actors can easily fake their identity, they cannot easily fake how their data routes across the web. Every malicious domain must interact with the plumbing of the internet to function.

The Golden Rule of Routing: Every domain and hostname you find in a DNS record—whether it is a CNAME, an MX, or a Nameserver—must eventually resolve to a physical IP address to route traffic on the internet.

When a live WHOIS query gives you nothing, look for these foundational technical markers.

MX (Mail) Records

Threat actors frequently protect their main web traffic behind a proxy like Cloudflare, hiding their true web hosting IP. However, they often forget to protect their mail servers. Check the MX records. Even if the website is proxied, the MX record might expose a custom mail server or pointing infrastructure that leads directly to the true origin host.

TXT Records

To use third-party tools, track analytics, or verify site ownership, actors must add unique verification strings into their DNS zones (e.g., google-site-verification=xyz). These unique strings act as excellent infrastructure fingerprints. Pivot on these values across the web to find connected campaigns.

SOA (Start of Authority) Records

Every DNS zone has an SOA record. Pay close attention to the RNAME field. This field is supposed to list the email address of the zone administrator. In many automated or poorly configured setups, this field leaks internal naming conventions, staging domains, or even the unredacted personal email address of the developer.

The Russian Nesting Doll Strategy

To uncover hidden infrastructure, you need to look past the first layer of data. Treat DNS like a Russian nesting doll.

Imagine a standard phishing scenario where an investigator queries scam-site.com for an A (IP) record and sees only generic Cloudflare proxy IP addresses. Many stop there, assuming the trail is dead. Instead, look deeper:

1. Query scam-site.com for its MX (Mail) records.
2. The result returns a custom mail hostname: mail.sneaky-host-provider.net.
3. Perform a recursive dig: query the A record for mail.sneaky-host-provider.net.
4. The result yields a raw, dedicated IP address: 198.51.100.42.

By recursively tracking the auxiliary mail infrastructure, you have successfully bypassed the main website’s proxy shield and uncovered the true host destination.

Reverse IP and Nameserver Pivots

Once you peel back the proxy layer and locate a true origin IP address, run a Reverse IP lookup to see what else lives on that machine. If the IP is a massive shared server hosting 20,000 corporate blogs, it is an investigative dead end. But if it is an offshore Virtual Private Server (VPS) hosting exactly six high-abuse domains, you have found a dedicated actor cluster.

Apply the same logic to Nameservers (NS). If an actor runs their own DNS infrastructure (e.g., ns1.actor-infra.xyz), perform a Reverse NS lookup to pull down a comprehensive list of every other domain delegating its routing to that specific server.

Client-Side Leaks and Unredacted Goldmines

When the live server environment is locked down, look to historical data and client-side code leaks.

Passive DNS and Web Archives

Current DNS is merely a snapshot of right now. Use Passive DNS engines (like SecurityTrails or DNSDumpster) to view what the domain’s IP address was before the threat actor toggled the proxy switch.

Complement this by pulling up the target domain on the Wayback Machine or archive.is. Actors frequently make configuration mistakes during the first 48 hours of setting up a campaign—such as leaving default server directories open or leaving their real contact details on a testing page—before scrubbing the site a week later.

Source Code Review & Tracking IDs

Right-click on the target site and select View Page Source. Look for embedded marketing, tracking, or advertising identifiers like Google Analytics tags (UA- or G-), AdSense publisher tags (pub-), or Facebook Pixel IDs. Scammers regularly copy-paste their phishing code kits without removing these tracking identifiers. Plug these unique strings into platforms like BuiltWith or SpyOnWeb to map out every other site utilizing the same analytics account.

Certificate Transparency Logs

SSL/TLS certificates are publicly logged to prevent fraud, and threat actors love free certificates (like Let’s Encrypt). By querying a root domain in Certificate Transparency (CT) logs using tools like crt.sh, you can reveal hidden subdomains (e.g., c2-server.malware.com or dev-test.phishing.net) that the actor thought were secret.

As I explored in my previous article on diagnostic OSINT, Are You Down?, understanding these response types—whether you are dealing with a 401 Unauthorized, a 404, or an active server hold—tells you exactly how alive the underlying infrastructure is.

The Tactical Fork: Disruption vs. Investigation

Once you successfully pull back the layers of a threat actor’s infrastructure, you arrive at a critical fork in the road. Your next move cannot be automated because it depends entirely on your operational mandate: are you looking for immediate disruption, or are you building a case for criminal prosecution? Confusing these two paths is one of the most common mistakes beginners make, and it can either destroy a legal case or leave a malicious site active for far too long.

Path A: The Disruption Playbook

If you are working in corporate brand protection or incident response, your primary objective is mitigation. You need to break the attack chain and get the malicious content offline as quickly as possible to protect users and limit intellectual property exposure.

Your targets for this path are the Registrar Abuse Desk or the Hosting Provider. Because these desks are flooded with thousands of automated tickets a day, your abuse report needs to be clean, undeniable, and easy to process. Do not write an emotional narrative. Instead, focus on the anatomy of a perfect request:

• The Violation: Explicitly cite the exact Terms of Service (ToS) or Acceptable Use Policy (AUP) being broken, such as phishing or malware hosting.
• The Evidence: Provide clean, standalone screenshots and full, un-truncated URL paths. Never make the abuse analyst dig through your data to find the exploit.
• The Action: Conclude with an unambiguous request: “Please suspend this domain for violation of your anti-phishing policy.”

Path B: The Investigative Strategy

For law enforcement and investigators looking for true attribution, the playbook is completely reversed. In an investigation, pushing for an immediate takedown is an unforced error. It alerts the threat actor, prompts them to wipe their servers, and destroys volatile digital evidence.

Your target here is the registrar’s Legal and Compliance Department, not the public abuse queue.

Pick Up the Phone

When your goal is attribution, do not simply submit a report through a standard web form. Many registrars use automated backend scripts to process those forms, meaning a standard report might accidentally trigger an automatic suspension of the domain. If that happens, your evidence trail is gone. Find the direct contact number for the compliance department and speak to a human. But they will only entertain you if you are law enforcement in a place that has jurisdiction over the registrar. If you are a private investigator, you will need to work through a law enforcement partner to get the right contact.

The Legal Toolkit

To bridge the gap between discovering a threat and securing a formal subpoena, you rely on two main mechanisms:

• Preservation Letters: This is your immediate defensive tool. A preservation letter formally instructs the registrar to freeze the account logs, subscriber details, billing records, and transaction histories. It ensures the threat actor cannot delete their footprint while you work through the legal chain to obtain a subpoena.
• ICANN’s RDRS: Investigators can leverage the Registration Data Request Service (RDRS) portal. The RDRS acts as a centralized, official gateway to submit formalized requests for the unredacted WHOIS data hidden behind the privacy wall.

Ultimately, takedowns and investigations require absolute precision. If your goal is to clear the board, bring ironclad proof of ToS violations to the host or registrar. If your goal is a legal case, use preservation holds to lock down the infrastructure before the adversary realizes you are watching.

Looking Forward: The 2026 TLD Expansion

The digital landscape isn’t static, and the strategies we use today will have to evolve rapidly as we move through the rest of this year. We are currently standing at the precipice of ICANN’s “Next Round” (also known as the 2026 Round) of new generic top-level domains (gTLDs), which is actively introducing a massive wave of new extensions to the root zone. The internet is about to get much larger, and with that expansion comes a mixed bag for digital investigators.

The Good News: Mandated RDAP

For those of us tracking infrastructure, the best piece of news is that every single new registry and registrar participating in this new round will be contractually mandated to support RDAP from day one. This means no more dealing with the chaotic, non-standardized text outputs of legacy Port 43 WHOIS. Instead, we get programmatic, structured JSON data right out of the gate. This consistent architecture makes automated querying significantly cleaner and sets up a predictable framework for the eventual rollout of tiered access for law enforcement and intellectual property investigators.

The Bad News: More Places to Hide

However, the flip side of this expansion is a massive operational hurdle for brand protection and investigators. The introduction of hundreds of new top-level domains means new voices creating policy and new places to hide. Threat actors will have an unprecedented number of choices for spinning up cheap, highly automated, and disposable domains. If an adversary can buy a batch of domains for pennies on an obscure new registrar and registry that has lax compliance enforcement, they will take advantage of it immediately. As the volume of disposable domains skyrockets, relying on legacy historical records will continue to lose its efficacy. Your ability to fingerprint live infrastructure, run recursive pivots, and analyze real-time routing signals is about to become your most valuable skill set. The core game isn’t changing, but the playing field is getting infinitely bigger.

Thoughts on Using AI in Investigations

If some of the technical steps in this playbook feel a bit overwhelming, remember that you do not need to be a full-stack developer or a regex wizard to execute them. If you pull down a messy wall of raw page source code or an unfamiliar zone file and it looks like a foreign language, leverage an AI model to break it down. You can drop the code directly into a prompt and ask the AI to extract hidden tracking IDs, interpret complex MX routing patterns, or even help you write a basic script to query Shodan hashes. AI acts as a massive technical equalizer for modern OSINT investigators, allowing you to bypass a lack of coding experience so you can focus entirely on the actual logic of the investigation.

But be careful! AI is a tool, not a replacement for critical thinking. It can help you parse and analyze data, but it cannot replace the nuanced judgment required to interpret that data in the context of an investigation. Always verify AI-generated insights with your own analysis and cross-reference with reliable sources. AI can sometimes struggle with domain names, IP addresses, and other technical identifiers, so always verify what it is claiming before proceeding. Use AI to augment your capabilities, not to replace them.

Conclusion

The ultimate lesson from this look at the modern DNS landscape is that while the old easy buttons are completely gone, the trail itself is far from dead. Redacted WHOIS records are a permanent fixture of the internet, but threat actors still have to use physical machines and routing protocols to run their operations. By shifting your mindset away from hunting for names and toward fingerprinting infrastructure, you take back control of the narrative. Stop mourning the past, dig recursively, and treat every technical record as a potential roadmap to the origin server. The digital world is expanding rapidly, but the path to true attribution will always be found hidden within the core pieces of the internet.