Run a registration lookup on a dentist's website, a local roofer's, or a Conway law office's, and there's a good chance the registrant section reads "REDACTED FOR PRIVACY." Run one on a phishing site set up last Tuesday and you'll often see the same words. The redaction can't tell those sites apart. That isn't a flaw in the record. It was never the record's job.
Short answer: To verify a privately registered website, stop trying to identify the person behind the domain and verify the organization instead. Match its name, address and phone number against independent sources such as licensing directories and state business records, then check that the domain's age and details fit the story the site tells.
I read registration records most days, and the most common mistake I see isn't technical. It's treating privacy as evidence. Hidden registrant details are the normal state of a domain now. Here's how I check a site when the owner's name isn't on the record.
Why the registrant field is usually blank
Two things emptied it. After the GDPR took effect in 2018, registrars began redacting personal data from public records for generic domains, and ICANN's Registration Data Policy now sets those redaction rules for accredited registrars. On top of that, many owners add a privacy service or a proxy service, which puts the provider's contact details where theirs would have been.
The lookup changed too. For generic top-level domains, RDAP became the definitive source of registration data in January 2025, replacing the old WHOIS protocol, though nearly everyone still says "WHOIS." Our RDDS coverage explains that machinery. For this piece the point is simpler: a blank registrant field is the default, not a choice that reveals anything about intent.
What a private record still tells you
Redaction removes the person. It leaves a fair amount behind. Pull the record from ICANN's registration data lookup and look at these fields:
- Creation date. A firm that says it has served clients since 2004, on a domain registered three weeks ago, has some explaining to do. Rebrands happen, so treat it as a question, not a verdict.
- Registrar. Tells you which company holds the account and where abuse reports go.
- Status codes. A code such as clientTransferProhibited means the domain is locked against casual transfer, which is what a careful owner sets.
- Name servers. Show who runs the domain's DNS. Useful context when you're comparing a site with a suspected lookalike.
- Registrar abuse contact. Published even when the registrant isn't.
None of that names the owner. It does tell you whether the domain's history fits the business it claims to be. Our guide to reading WHOIS records goes field by field.
Verify the business, not the privacy setting
Suppose the registration data for a professional website doesn't publicly display the owner's home address or personal contact information. That alone doesn't tell you whether the business is legitimate. Instead, verify the organization itself.
Take a law office. Johnny Gardner Law publicly identifies its office at 1310 Second Ave Upstairs, Conway, South Carolina, publishes the phone number (843) 248-7135, identifies its practice as DUI defense in Horry County, and provides consistent professional and contact information across its website. That's what independently verifiable professional identity looks like: an office you could walk to, a number you could call, and a practice area you could check against a licensing record.
Someone independently researching a Grand Strand DUI lawyer should compare the website's identity and contact details with other trustworthy professional or official sources, rather than relying only on whether WHOIS data is public. The verification lesson I keep coming back to: check the business, not just the registration privacy setting.
A privacy setting describes how a domain was registered. It doesn't describe who you're dealing with.
A ten-minute verification pass
- Write down the domain exactly as it appears in your address bar. Lookalikes depend on "rn" passing for "m," or a hyphen nobody notices.
- Find the organization in a source the website doesn't control. For lawyers, that's the state bar or court attorney directory. For contractors, a licensing board. For most companies, the Secretary of State's business search.
- Compare the name, street address and phone number character by character. Impersonation sites often copy everything except the contact details, because that's where the money goes.
- Call the number you found independently, not the one in an email or a pop-up.
- Check that any website listed in the official record matches the domain you're on.
One thing isn't on the list: the padlock. A TLS certificate shows the connection is encrypted. Most certificates are domain-validated, which means the issuer confirmed control of the domain and nothing about the business behind it.
When hidden details should worry you
Redaction only means something in combination. I start paying attention when a private record sits next to a very young domain, a name one character off from an established business, requests for payment by wire transfer, crypto or gift cards, and contact through a web form only. Any one of those has an innocent explanation. Four together don't.
If you suspect impersonation, you don't need to unmask anyone to act. Report the domain to the registrar's published abuse contact, and tell the business being copied. Requests for nonpublic registration data go through lawful channels, including ICANN's Registration Data Request Service, not guesswork. For how privacy fits with accountability more broadly, see our domain privacy coverage.