How to verify the company behind a website

To verify the company behind a website, start with the site's current terms, privacy notice and about page, then check available domain registration data through ICANN Lookup for a generic top-level domain. The registrant, site operator, brand owner and section publisher can be different entities. Record what each source actually identifies and leave the relationship unresolved when the evidence stops short.

Related-domain results are a way to find names worth checking. They are not an ownership database. If you reached a candidate through similar-website discovery, keep that discovery observation separate from any later organization claim.

Ask which relationship matters

Before searching, write the decision: are you identifying a contact for editorial research, deciding whether two sites belong to one company, or checking whether a named company currently operates a particular service? The answer determines which pages and records to inspect.

Use the competitor shortlist workflow if your actual question is whether two offers serve the same buyer. Common ownership and commercial competition are separate classifications.

Check registration data carefully

For a generic top-level domain, start with ICANN's Registration Data Lookup Tool. It runs RDAP queries and displays the current registration data it can access. ICANN says RDAP became the definitive source for generic top-level domain registration information in January 2025; country-code domains can have different registry arrangements.

Copy only the fields relevant to the decision: queried domain, registrar or registry source, visible registrant organization if present, relevant dates, and lookup date. A privacy-redacted name is an unknown, not evidence that two domains share an owner. The ICANN lookup explanation notes that personal information may be redacted and registry responses can vary.

For a country-code top-level domain, use IANA's Root Zone Database to identify the listed TLD manager, then check the relevant registry's official registration-data service and rules instead of assuming ICANN's gTLD lookup covers it. Record the registry used, fields shown, redactions and lookup time. Do not treat an unavailable field as evidence about the domain's operator.

A registrar name tells you who provides registration service. It does not identify the organization operating the website. Matching name servers, hosting providers or analytics identifiers can suggest a technical relationship, but shared infrastructure can serve unrelated customers. Do not promote these clues to an owner claim without independent corroboration.

Inspect the current site operator

Read the site's terms, privacy notice, about page and contact page. Record the exact named entity and the page date or your inspection date. Check whether the language identifies an operator, a publisher, a contracting party or only a payment processor. A single page may answer one of those questions and leave the others open.

If the site redirects, record both the starting domain and final destination. A redirect can be a useful lead; it does not by itself establish a corporate merger, acquisition or transfer. If a company claims several brands on its own official site, cite that claim and state its date. For a legal conclusion, obtain the applicable primary corporate record or counsel's review.

The ICANN RDAP guide describes the protocol as access to domain registration data. Treat the current website as a different source with a different scope. The two may corroborate each other, conflict, or leave the operator question unresolved.

Resolve conflicting names without guessing

If RDAP displays one organization and the website names another, first ask whether the fields describe different roles. A domain can be registered for an operator by a parent, agency or other party. That is a possible explanation, not a conclusion about the particular sites being checked. Write the two observations with their source dates before looking for a relationship between the named organizations.

Check the actual wording on each page. “Operated by,” “published by,” “a brand of,” and “payments processed by” make different claims. A payment processor listed in checkout terms does not become the site's publisher. A brand footer may name a legal entity, but it might apply only to the current storefront and say nothing about a separate informational subdomain. Preserve the quoted role label in your notes instead of rewriting every name as “owner.”

When a page has no update date, use the inspection date and say so. If an archived page names a different operator, the record can help investigate a change, but it does not override the current page automatically. Identify the archived capture date and whether the exact page was captured. Do not turn an old footer into a current corporate claim.

For a high-impact decision, seek corroboration from a current primary record issued by the relevant organization or public authority. Record exactly which legal entity and website that record connects. If the current site page, registration data and other primary records cannot connect the entities, the result remains unresolved. Another search result repeating the same unsourced claim is not independent evidence.

A useful final sentence is narrower than “X owns Y”: “On the inspected date, the site's terms named X as the service operator; the public RDAP response named Y as registrant; the checked sources did not establish the corporate relationship between X and Y.” This says what a reviewer can verify without hiding the conflict.

Work a fictional ownership question

Suppose a fictional research list includes northern-guide.example and northern-shop.example. A fictional graph result places them near each other, and a fictional directory links to both. These are invented teaching inputs, not real LinkCensus observations or live registration lookups.

A responsible note would say: “The two sites were discovered in related-domain research; the public registration fields reviewed did not identify registrants; their inspected pages name different publisher and seller entities. Common corporate control is unresolved.” It would not say that the sites are certainly unrelated. The absence of an observed relationship is not proof of separate ownership.

The table is fictional and has no captured evidence URLs. In a real investigation, each observation row needs a source address, lookup or inspection timestamp, the exact field or page passage supporting the role, and any redaction noted. Save the record or a permitted copy when the decision requires a durable audit trail. Without those fields, a colleague cannot reproduce the conclusion after pages change.

Use an evidence matrix and stop rule

For each domain, record: normalized domain and any relevant subdomain; the question being answered; discovery source; RDAP URL and lookup date; visible registration fields or redaction; official page URL and inspection date; exact entity and role stated; corroborating primary record if required; conclusion; confidence limit; next check.

Use three conclusion states: supported for the specific relationship, contradicted by current primary evidence, or unresolved. Do not invent a numeric confidence score. If the task only needs an editorial contact and the site names a current publisher, stop there. If a financial or legal decision depends on ultimate control, escalate to the relevant primary corporate records and professional review.

When organizing many candidates, apply the host and domain grouping worksheet first so you do not accidentally turn two subdomains into two corporate entities. Preserve the raw names and exceptions.

Can shared linkers prove common ownership?

No. LinkCensus shows shared linkers (among top 200 retained) within a dated graph edition. A source linking to two targets says something about link context, not registration, site operation or corporate control. The shared-linker explanation shows exactly what that bounded graph observation supports.