Identifying a registrant when the WHOIS record is redacted

On 28 January 2025, ICANN formally retired the WHOIS protocol as the required standard for registration data. RDAP – the Registration Data Access Protocol – replaced it. For anyone trying to find domain owner redacted whois lookups had already made difficult, the shift matters in ways that are not obvious from the headlines.

When a WHOIS or RDAP query returns redacted contact fields, identifying the registrant requires a structured sequence: an RDAP lookup to confirm what the registry exposes, a disclosure request through ICANN's Registration Data Request Service (RDRS), and – where that fails – a formal legal process such as a UDRP complaint, a court subpoena, or a registrar escalation. Each route has time costs and limits that directly affect whether a dispute can proceed. No single step is automatic.

This page states what changed, what the practical sequence looks like today, and what happens when identification still fails – including how panels handle an unidentified or unresponsive respondent.

What changed, and when did it change?

The retirement of WHOIS as a mandatory protocol took effect on 28 January 2025, when ICANN's updated requirements formally made RDAP the baseline for registration data access. Registrars are no longer required to operate a WHOIS service; those that still run one do so voluntarily. The registration data itself did not disappear. It shifted.

For individuals, data-protection law – applied across many jurisdictions – means the registrant name, email address, postal address, and telephone number are redacted from public output by default. What typically remains visible is the registrar name, the creation and expiry dates, the registry status codes, and – usually – the name servers. For an entity registrant, some jurisdictions permit more disclosure, but practice varies considerably by registrar and by the registrant's location.

The change compounded a problem that had been growing since 2018, when GDPR came into force in the European Union and registrars across the industry moved to redact personal data globally rather than by geography. By the time ICANN officially retired WHOIS, the public lookup that once revealed a registrant's name and email had already been hollow for several years in most cases.

Who is affected by redacted registration data?

Anyone who needs to identify a domain registrant before or during a dispute is affected. The populations are distinct, and the urgency differs for each.

Brand owners filing a UDRP complaint must name the registrant as the respondent. A complaint that misstates the respondent's identity or that targets only a privacy proxy rather than the underlying registrant can result in procedural complications – and in some cases a complaint that does not formally commence. Identifying the actual holder before filing is a material step, not a formality.

Victims of domain theft face a more immediate pressure. If a domain was transferred without the registrant's consent – through account compromise, social engineering of a registrar's support team, or unauthorized push – the window for reversing the transfer under the registrar's own transfer policy is short. The registered contact data for the new holder, often immediately redacted, is exactly what the original registrant needs to confirm who now controls the name and to route a recovery demand correctly.

Litigants in anticybersquatting proceedings need an identified defendant to serve process. A US anticybersquatting action, for example, permits an in rem claim against the domain itself where the owner cannot be found or is outside the jurisdiction – but that route still requires the court to be satisfied that the owner cannot be identified through reasonable means. Documenting what you tried matters.

How do you find a domain owner when the record is redacted?

The practical sequence runs in roughly four steps, and each one can terminate the process or pass it forward.

Step one: run the RDAP lookup. RDAP replaced WHOIS as the authoritative protocol. The output is structured JSON and is queried through the registrar's or registry's RDAP endpoint. In many cases the result for a gTLD domain shows the same redacted fields as a WHOIS query – but RDAP also exposes whether a privacy proxy service is holding the registration, rather than the real person. That distinction matters: the underlying registrant is the party you need.

Step two: use ICANN's Registration Data Request Service. The RDRS is the channel for requesting non-public registration data from participating registrars. As of 20 November 2025, ICANN extended the RDRS pilot beyond its original two-year window while next steps are decided – confirm the current status before relying on it for timing. Each request is assessed by the registrar individually. Disclosure is not guaranteed. The registrar's response time is entirely outside the requester's control, and some registrars participate in the RDRS only minimally. In our practice, we treat the RDRS as a necessary step to document, not a reliable source of timely information.

Step three: file the UDRP complaint or initiate the ccTLD procedure. Where identification through RDRS fails or is too slow, filing a UDRP complaint – or the applicable ccTLD procedure – is often the next step. The forum (WIPO, the Forum, CAC, or ADNDRC for gTLDs) formally commences the case and notifies the respondent through the registrar, the registered email address, and any other contact detail available in the record. If the registrant defaults – receives notice and does not file a response within the 20-day response window – the panel proceeds on the complaint alone. A respondent default is not an automatic win; the complainant still bears the burden on all three UDRP elements. But panels regularly decide cases where the registrant never identifies themselves, relying entirely on what the complaint and the public record establish.

Step four: court process and compelled disclosure. Where arbitration is unavailable or insufficient – for a .de domain, for example, where there is no UDRP equivalent and disputes go to German courts, or where the brand owner wants damages – a court action is the route. Courts can issue subpoenas or disclosure orders directed at registrars or registries to identify registrants. This route is slower than UDRP by a material margin, and cost is substantially higher. The myth that court is always faster than arbitration does not survive contact with a domain dispute; for most .com or .net cases the UDRP timeline of roughly two months is far shorter than any court proceeding.

What happens when a respondent cannot be identified or defaults?

The UDRP and most ccTLD procedures anticipate precisely this situation. A registrant who cannot be found, or who receives notice and ignores it, does not thereby defeat the complaint.

When a complaint is filed, the selected forum – WIPO, for the largest share of proceedings – sends notice to the respondent through every contact channel the registration record contains: the registered email address, the registrar's abuse contact, and in some cases physical address if one appears. The registrar is separately notified and places a registrar lock on the domain, freezing transfers while the case runs. That lock is a critical protection: it prevents the registrant from transferring the name to a new holder to frustrate the proceeding.

If the respondent does not file a response within the response period, the panel treats the case as a default. The panel appoints on the complaint alone and decides whether the complainant has met its burden. In a defaulted case, panels scrutinize the complaint evidence carefully – a weak complaint does not become strong simply because no one answers. The complainant must still demonstrate confusing similarity to a mark it holds, the absence of the registrant's legitimate interest, and bad-faith registration and use.

Where the registrant is a privacy proxy – a service that holds the registration on behalf of the real person – panels have developed a consistent approach: both the proxy service and the underlying registrant may be treated as the respondent, and the panel addresses the merits without resolving the precise identity question. This is a practical accommodation; it means a complaint is not defeated by the proxy's refusal to reveal the underlying person's name.

In domain theft situations the dynamic is different. The domain has typically already moved to a new registrant, and the immediate goal is reversal of the transfer, not a panel decision on abuse. Registrars have their own transfer dispute policies and escalation channels. Where the registrar's process is exhausted without resolution, anticybersquatting litigation with compelled disclosure is the next step. We have handled matters in which a stolen domain passed through multiple registrars in quick succession – a tactic designed to complicate recovery – and the documentation of each transfer event, drawn from RDAP query histories and registrar logs, became the evidentiary spine of the court filing.

What practical limits apply to every identification route?

Each step above has an honest ceiling. It is worth stating them plainly.

RDAP and RDRS together cannot guarantee disclosure. A registrar that participates formally may still decline a specific request on data-protection grounds. A registrar that does not participate at all has no obligation to respond through that channel. And the RDRS pilot extension, as of November 2025, leaves the program's long-term form unresolved – the current mechanism may change.

Privacy proxy services that are affiliated with the registrar are often required under ICANN's contracts to reveal the underlying registrant when properly served with a dispute notice. But a proxy service operated independently – or one in a jurisdiction with restrictive data laws – may be slower to comply or may itself be subject to local proceedings before it discloses anything.

UDRP default decisions transfer or cancel the domain. They do not identify the registrant for any other purpose; the panel's authority ends with the domain name. If the brand owner also needs to identify the person – for a cease-and-desist campaign, a broader enforcement program, or a damages claim – the UDRP result does not supply that information.

Court subpoenas work when the registrar is within the court's jurisdiction or is willing to accept service voluntarily. For a registrar headquartered outside the United States – and many are – a US subpoena may require letters rogatory or mutual legal assistance procedures, adding months to what already is not a fast route.

For ccTLD disputes, the position depends entirely on the governing national procedure. The Nominet DRS for .uk has its own notification mechanism, now administered by WIPO since 7 July 2026. The EURid ADR procedure for .eu has its own rules. The .de DENIC dispute entry blocks transfer while a German court claim proceeds, but DENIC does not adjudicate identity. For any ccTLD not addressed above, confirm the current registry rules with counsel before assuming a particular channel applies.

For an assessment of your domain dispute and the identification steps that apply to it, contact info@cognomenlaw.com.

About COGNOMEN

COGNOMEN is an independent boutique focused exclusively on domain-name disputes. We recover, defend, and transact internet domains across generic and country-code zones, before WIPO, the Forum, CAC, ADNDRC, and national procedures, and in court where arbitration cannot reach. We act for brand owners, domain investors, and registrants – including respondent-side defense and reverse domain name hijacking. COGNOMEN handles court action and domain theft recovery matters across gTLDs and ccTLDs; our practice covers the full sequence from registrar escalation through anticybersquatting litigation with local litigation counsel in the relevant jurisdiction. To discuss a domain, contact info@cognomenlaw.com.

Related at COGNOMEN

• court recovery – court action and domain theft recovery services across gTLDs and ccTLDs
• Blockchain domain names and the limits of the UDRP – when UDRP does not reach a disputed domain name
• alert enforce udrp decision co – what to do when a transfer order needs enforcement

Author: Adrian Harland — Court anticybersquatting and domain theft recovery. Meet the team.

Speak with Cognomen Law

For a scoped view of your domain matter, contact info@cognomenlaw.com. Discuss your matter

Domain in disputeYour sideI want to recover a nameI received a complaint — I need a defensePortfolio / brand protectionWhat happenedEmailI agree to the processing of my enquiry as described in the privacy policy.Assess my case

No obligation. Confidential. We reply within two hours in business hours.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@cognomenlaw.com.