Registration data used to name the registrant. It now mostly does not, and treating that redaction as suspicious would flag the overwhelming majority of legitimate domains.
Why it is redacted
- Data-protection law. Registrant details are personal data, and publishing them wholesale stopped being lawful in much of the world.
- Privacy services are a standard product. Several large registrars enable one by default, at no extra cost, on every registration.
- So the base rate is enormous. Most domains are redacted. A redacted registrant carries essentially no information about intent.
What is still visible
| Field | Usually present | Worth |
|---|---|---|
| Registration, expiry and last-changed dates | Yes | The timing signals from the previous lesson. |
| Registrar | Yes | Weak alone. Useful for clustering, and for knowing who to report to. |
| Nameservers | Yes | Strong for clustering separate registrations into one campaign. |
| Status codes | Yes | Locks, holds, and pending-delete state. |
| Registrant country | Sometimes | Weak, and easily false. |
| Abuse contact | Yes, by policy | The thing you will actually need. |
$ curl -s https://rdap.org/domain/example.com | jq -r '.entities[]?.roles[]?'
registrar abuse (registrant: redacted for privacy)
Clustering without names
You rarely learn who registered a domain, and you frequently learn that six domains were registered by the same person — from the shape of the registrations rather than from any identity.
Six lookalikes, all: registered within the same 48 hours at the same registrar using the same two nameservers with sequential-looking expiry dates No name anywhere. One campaign, clearly.
“Uses WHOIS privacy” is not a finding
It appears in automated risk scores constantly and it means nothing, because nearly every domain has it. Including it as evidence weakens everything else in the report, and an abuse desk that reads it knows immediately that the report was generated rather than investigated.