Ownership & Registrant Portfolio
One domain is rarely the whole story. Starting from a seed, this pivots on the registration details — the owner's email, organisation, and phone — to surface every other asset the same operator registered, and shows which detail connected each one. The reverse-lookup for mapping an owner's full portfolio, whether it's a brand, an investigation target, or an adversary.
How it uses the graph
Traverses the WHOIS, DNS layers of the graph, in 9 steps:
Pivoting the seed's registrant email back out to every other domain that declared it
Pivoting the seed's registrant phone back out to other domains that declared the same number
Pivoting the seed's registrant organization to every co-registered asset, tagged by type
Following organization aliases (SAME_ORG_AS) to assets registered under a sibling org record
Seed WHOIS selectors…
Current & previous registrar…
Sibling domains on the same registrar…
Domains sharing the seed's nameservers…
Nameserver + registrant-email intersection…
Why each step runs
- 01Shared registrant email. A reused WHOIS registrant email is the single strongest reverse-WHOIS selector — it clusters the same operator's domains even across unrelated TLDs and brands.
- 02Shared registrant phone. Registrant phone is a second independent selector — it confirms the email cluster and catches assets where the email differs but the phone was reused.
- 03Shared registrant organization. The registrant org spans naming and (where the namespaces meet) network assets; labels(other)[0] surfaces whether each co-registered asset is a HOSTNAME, ASN, or PREFIX so the cluster reads cross-layer.
- 04Organization-alias expansion. Registries normalize the same company to several ORGANIZATION nodes; SAME_ORG_AS bridges them so an operator's assets registered under an alias org still join the cluster. Sparse on the current dataset — kept enabled so it activates on the next data refresh.
- 05Seed WHOIS selectors. Shows the seed domain's own registrant email, phone, organization and registrar in one place, so the investigator can see exactly which selectors the rest of the report is pivoting from.
- 06Current & previous registrar. Identifies who registers the domain today and who held it before, a registrar-transfer history the reverse-WHOIS pivots don't otherwise surface.
- 07Sibling domains on the same registrar. Lists other domains that use the same registrar, a weaker but broad ownership pivot that widens the candidate pool the stronger selectors then confirm.
- 08Domains sharing the seed's nameservers. Finds other domains served by the same nameservers as the seed, a hosting/DNS-operator cluster independent of the WHOIS contact selectors.
- 09Nameserver + registrant-email intersection. Returns only domains that share BOTH a nameserver AND a registrant email with the seed, the high-confidence AND-intersection that pins a cluster to the same operator.