How to Find Out Who Is Behind a Website or a Scam

Who owns this website? What you can and cannot find

You can usually find out which company claims to run a website and whether that company exists; you can rarely find the private individual behind a scam site on your own. Each public source answers part of the question:

Step 1: the domain record (RDAP, formerly WHOIS)

Since 28 January 2025, RDAP is the authoritative source of registration data for generic domains, and ICANN recommends its free ICANN Lookup tool. Enter the bare domain and read three fields: the registration date, the registrar, and the registrant.

A real example: on 28 October 2026, the record for amazon.com showed a registration date of 1 November 1994, the registrar MarkMonitor Inc., and, in the registrar’s data, the registrant organisation Amazon Technologies, Inc. with a postal address in Reno, Nevada. Large companies often publish their organisation this way.

Most records will not be that helpful. As ICANN explains, personal data protection laws now require many registrars to redact the personal data that WHOIS once showed. You will often see “redacted for privacy” or the name of a privacy service. That is legal and common, and it is why the registry and the legal notice matter more.

Two more details help you read a record. Country-code domains such as .fr, .de or .co.uk are run by national registries, which publish their own lookup tools and their own privacy rules. And a registrar is not the owner: it is the company that sold the domain, but it is also the right place to send an abuse report.

Step 2: the legal notice and the company registry

The most direct answer to “who owns this website” is the company the site names, confirmed by an official registry. In the EU, the e-Commerce Directive requires online service providers to show their name, address and trade register number. Then look the company up:

• UK: Companies House shows the company’s status, registered address and officers, and lets you search disqualified directors.
• France: the Annuaire des Entreprises shows the SIREN number, status, address and directors.
• US: companies register by state, so use the Secretary of State search of the state named in the terms; SEC EDGAR covers companies that file with the SEC.
• Worldwide: the GLEIF LEI search lists entities that hold a Legal Entity Identifier, with their legal name and country.

Check the match, not just the existence. Scammers often name a real company that has nothing to do with them. Same name, same address, active status and an incorporation date consistent with the site’s story make a match; a different address or a dissolved company is a warning sign.

Step 3: parent companies, LEI and Wikidata

For well-known brands, the owner is often a parent company in another country. Wikidata records, for many organisations, the official website, the parent organisation, owners, founders and chief executive, with references. GLEIF records can show parent relationships for entities with an LEI. Use them to answer “who owns this brand”, then confirm the link through the company’s own investor or legal pages.

Step 4: regulator registers for financial sites

For a broker, trading platform or crypto service, the regulator’s register tells you which legal entity is authorised and which websites it uses. In the UK, search the FCA register and the FCA Warning List; in France, the AMF blacklists; worldwide, IOSCO I-SCAN. If the authorised firm lists a different website from the one you are on, you may be on a clone.

Step 5: hosting, certificates and connected sites

When the identity trail goes cold, the infrastructure can still tell you something. The IP address of a site points to a hosting provider, whose abuse team can act on a report. Certificate transparency logs, searchable at crt.sh, list certificates issued for a domain and sometimes reveal other domains run by the same operator. Identical page templates, the same phone number or the same “company” across several sites are signs of one operation behind them.

This tells you how the operation is built, not who runs it. Hosting and registrar records about customers are released to the police on request, not to the public.

How to find a scammer: phone numbers and location

Realistically, you can gather leads, not an identity. A phone number can be checked for its type (mobile, landline, VoIP) and the country it is assigned to, but the FTC warns that scammers can make any name or number appear on caller ID. VoIP numbers are rented online and can be used from anywhere, so the country code says little about where the caller sits.

Location is even harder. An IP address appears in email headers only sometimes, often belongs to a VPN or a cloud server, and is linked to a person only through records the provider gives to the police. What helps investigators most is what you already have: the phone numbers, the website addresses, the payment details (IBAN, wallet address, account name), screenshots and dates. Put them in a report.

Photos are the exception where your own search can help: a reverse image search with Google Lens or TinEye often shows that a “trader” or “recruiter” is using someone else’s face. See how to spot a fake profile picture.

What is legal, and what is not

Looking at public records is fine: registries, regulator lists, RDAP, archived pages and search results exist to be consulted. Lines you should not cross:

• Do not try to break into the scammer’s accounts, website or devices.
• Do not publish the name, address or photos of someone you believe is behind it. The person shown may be a victim of identity theft or a recruited money mule, and you may be wrong.
• Do not pay a “hacker” or a recovery service that promises to unmask or chase the scammer: the FBI’s IC3 warns that it does not work with law firms or crypto services to recover money.
• Do not pretend to be police or a lawyer to get data from a registrar or a host. Use the official request channels instead.

Our “who is behind it” checks

The Business Check runs steps 1 to 4 from one website address. It reads the legal notice and up to 12 pages, extracts the company name, identifiers, address and phone numbers, looks the company up in official registries where available (France, the UK, US public companies, LEI holders), and recognises known organisations through Wikidata. People are shown only when a registry, Wikidata or the company’s own pages name them, each with its source: we never guess a name.

When the operator cannot be identified, the report says so, the score goes down (“opaque operator”), and on the Business plan our team can review the case by hand. Any country estimate is labelled as an estimate with its basis, such as a phone prefix or a currency, never as a fact. The company check starts from the same report when your question is about a supplier or a partner rather than a website.

Getting a scam site taken down

Even without a name, the people who host and register the site can act. Registrars accredited by ICANN must publish an abuse contact, which appears in the RDAP record, and since 5 April 2024 their contracts include obligations to act on DNS abuse such as phishing and malware (ICANN advisory). Report the site to the registrar’s abuse address, to the hosting provider and to Google Safe Browsing. The official police channels are in how to report a scam.

Frequently asked questions