Private WHOIS Doesn’t Mean Fake: How to Verify a Privately Registered Website
A redacted registrant record tells you how a domain was registered, not who runs the business. Here is what to check instead.
Briefing ·
Domain privacy that hides the right things
What registration data reveals, what privacy and proxy services change, and how to keep a domain account from becoming someone else's. Privacy should cut unnecessary exposure without making accountability disappear.
What's moving this week
- Why Internet Infrastructure Decisions Rarely Stay LocalizedInternet Society
- The keys to the Internet change on October 11. Are you ready?Cloudflare Blog
- Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters InvestigationKrebs on Security
- A Safer Internet Starts with Taking Action: Introducing the Online Trust and Safety HubInternet Society
- Everything we launched during Birthday Week 2026Cloudflare Blog
- U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon ExtortionsKrebs on Security
More from Krebs on SecurityMore from Cloudflare BlogMore from Internet Society
WHOIS Explained
What a private record still shows
Redaction removes the person, not the paper trail. A typical record for a generic domain still names the registrar, the creation and expiry dates, the lock status, the name servers and an abuse contact. Those fields are how you judge a domain's history, and how you report it when something's wrong.
That split is the idea this publication keeps coming back to. Hide what doesn't need to be public. Keep the routes to accountability open.
- Domain Name
- EXAMPLE.COM
- Visible
- Registrar
- Example Registrar, LLC
- Visible
- Creation Date
- 2019-03-14T18:02:11Z
- Visible
- Domain Status
- clientTransferProhibited
- Visible
- Name Server
- NS1.EXAMPLE-DNS.NET
- Visible
- Registrant Name
- REDACTED FOR PRIVACY
- Hidden
- Registrant Street
- REDACTED FOR PRIVACY
- Hidden
- Registrant Email
- Contact via registrar form
- Hidden
Illustrative record, not live data. Field names follow common gTLD output.
Domain Privacy
Domain Privacy
Most registrars now redact personal registrant data by default, so the useful question is no longer whether to hide your details. It's what stays visible, who can still request the rest, and what happens when your contact email is the only route a registrar has to reach you.
Read the Domain Privacy sectionAbuse and takedown reporting from Krebs on Security
- Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters InvestigationKrebs on Security
- U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon ExtortionsKrebs on Security
- Data Broker Radaris Loses Domains in Privacy FightKrebs on Security
WHOIS
WHOIS
WHOIS is the name everyone still types, even though the protocol behind it has been retired for generic domains. We explain how to read a record, what the status codes mean, and why a blank registrant field proves very little on its own.
Read the WHOIS sectionAbuse and takedown reporting from Krebs on Security
- Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters InvestigationKrebs on Security
- U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon ExtortionsKrebs on Security
- Data Broker Radaris Loses Domains in Privacy FightKrebs on Security
RDDS
RDDS
Registration Data Directory Services is ICANN's umbrella term for the systems that publish domain registration data, with RDAP now the definitive source for generic top-level domains. This is the section for structured responses, redaction rules and lawful request channels.
Read the RDDS sectionInternet policy from the Internet Society
Privacy Services
Privacy Services
A privacy service keeps you as the registrant but swaps your contact details for the provider's. That's a different legal position from a proxy, and it matters when the provider, the registrar or your account runs into trouble.
Read the Privacy Services sectionInternet policy from the Internet Society
Proxy Services
Proxy Services
With a proxy, the service itself becomes the registrant of record and licenses the domain to you. That can be the right call, as long as you know what the terms say about disclosure, transfers and who owns the name on paper.
Read the Proxy Services sectionAbuse and takedown reporting from Krebs on Security
- Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters InvestigationKrebs on Security
- U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon ExtortionsKrebs on Security
- Data Broker Radaris Loses Domains in Privacy FightKrebs on Security
Domain Registration
Domain Registration
Picking a registrar is a security decision dressed up as a shopping decision. We look at account recovery, two-factor options, transfer locks, renewal traps and the small settings that decide whether a domain stays yours.
Read the Domain Registration sectionDNS and infrastructure notes from Cloudflare
- The keys to the Internet change on October 11. Are you ready?Cloudflare Blog
- Everything we launched during Birthday Week 2026Cloudflare Blog
- One year later: the power of 1.1.1.1 internsCloudflare Blog
Ownership Question
Before you register, renew or switch on privacy
What should I know before getting into domain privacy?
Start with what your registrar already does. For most generic domains, personal registrant data is redacted by default, so a paid privacy add-on may change less than the checkout page suggests. Check which email address the registrar uses to reach you, because a dead contact address can cost you a renewal notice or a transfer approval. Privacy limits public exposure, but it doesn't stop lawful requests or abuse reports.
How much does domain privacy cost in United States, Canada, United Kingdom, Australia, Europe, South Carolina, global English-speaking website owners and domain registrants?
Many registrars now include privacy at no extra charge for generic domains like .com, while others still sell it as a yearly add-on. Country-code domains follow their own rules: .us does not allow privacy or proxy registration at all, and CIRA, which runs .ca, already withholds individual registrants' details. Your extension and registrar matter more than where you live, so check both before paying for a feature you may already have.