SKILL.md
Who owns this domain
Registration data tells you who bought the name; DNS tells you who runs the
service. They are frequently different parties, and conflating them is the
mistake that wrecks attribution. Everything here is passive except where flagged
— but note that dig aimed at the target's own nameservers lands in the
target's query logs, so resolve through a public recursive resolver or passive
DNS when you care about being quiet.
Which source first
| You hold | Reach for | Why |
|---|---|---|
| A domain, nothing else | RDAP, then registrar WHOIS | Structured, gives dates + registrar + status in one hit |
| Redacted WHOIS | Historical WHOIS + passive DNS | Redaction is not retroactive across archives |
| A domain you suspect is one of many | Nameserver pair + MX + reverse WHOIS | Infrastructure reuse outlives contact privacy |
| An IP | IP RDAP at the RIR, then ASN lookup | Tells you the netblock holder, not the site owner |
| A ccTLD | The registry's own WHOIS/web service | ccTLDs ignore gTLD policy; coverage swings wildly |
| A brand-new domain | Creation date + registrar + NS | Age plus a bulk-friendly registrar is the phishing tell |