How to Find All Domains Registered to an Email Address

Reverse WHOIS lookup by email lets you find every domain name registered using a specific email address. Instead of starting with a domain and looking up its owner, you start with a known owner attribute and retrieve the complete list of domains connected to it. This makes reverse WHOIS one of the most direct methods for mapping domain portfolios, tracing threat actor infrastructure, and identifying brand infringements.

WhoisFreaks indexes more than 3.6 billion WHOIS records and supports reverse searches by email address, registrant name, organization name, phone number, and keyword. Results include both active and historical registrations, which means domains registered before GDPR privacy protections took effect in 2018 remain searchable even if their current records are redacted.

This guide explains how reverse WHOIS by email works, when to use it, what its limitations are, and how to run it manually through a lookup tool or at scale through the API.

What Is Reverse WHOIS Lookup?

Reverse WHOIS lookup is the process of querying a WHOIS database using a registrant attribute, such as an email address, person name, or company name, and retrieving all domain names linked to that attribute. It inverts the standard WHOIS direction: standard WHOIS takes a domain and returns its owner data, while reverse WHOIS takes owner data and returns all associated domains.

Understanding WHOIS and Reverse WHOIS Lookup

Every domain on the internet carries a WHOIS record with structured ownership data, including the registrant's name, email address, organization, registration and expiration dates, registrar, and nameservers.

A standard WHOIS lookup retrieves that record and returns it for a single domain. The data is publicly accessible unless the domain owner has opted for WHOIS privacy protection, which replaces personal contact fields with proxy information provided by the registrar.

How Reverse WHOIS differ from standard WHOIS?

Unlike a standard WHOIS lookup, which searches for information about one domain name, a Reverse WHOIS Lookup allows users to find all domains that share a common WHOIS detail, such as:

• A specific email address (in case you have the email address of the person/company who you might think is associated with the relevant domain).
• A registrant name (in case you have an individual's name whom you think might have purchased the website with their name)
• A company name (in case you are tracking a specific brand or company and other domain names relevant to them)

For example, if a cybersecurity researcher wants to find all domains registered by a known attacker, they can perform a Reverse WHOIS Lookup using the attacker’s email address.

This will return a list of all domains linked to that email, helping to identify other websites potentially involved in phishing campaigns, malware distribution, or fraudulent activities.

For example, in the attached Reverse WHOIS Lookup using Email of an attacker, the tool showed 266 records.

How to Run a Reverse WHOIS Lookup by Email Address

The following steps work for both the free tool and the API. Use the tool for one-off lookups. Use the API when you need to process multiple email addresses or integrate results into a workflow.

Step 1: Go to the Reverse WHOIS Lookup tool

Navigate to the WhoisFreaks Reverse WHOIS tool. The search interface accepts four types of input: email address, registrant name, organization name, and keyword. Select "Email" as your search type.

Step 2: Enter the email address

Paste the full email address you want to investigate. Use the exact registrant email as it would appear in a WHOIS record, for example [email protected]. Partial matches are supported using the keyword field and for the email regex search option is available.

Step 3: Choose the result mode

WhoisFreaks returns results in standard mode by default, which includes all the details WHOIS provides. If you need only the registrant name, organization, registration date, and domain name use the mini mode, this will reduce response size.

Step 4: Review the results

Each result row shows the domain name, the registrant details matched to your email, and the registration date. Domains that no longer use that email but used it at any prior point in registration history will appear in the results. Review for patterns: shared nameservers, registration clusters on specific dates, or related domain naming conventions often indicate a coordinated campaign or a single operator's full portfolio.

Step 5: Export or escalate to the API

For exports above the tool's display limit, use the Reverse WHOIS API to retrieve results programmatically. A basic API call for email-based reverse lookup takes the form:

GET https://api.whoisfreaks.com/v1.0/whois?apiKey=YOUR_KEY&whois=reverse&[email protected]

For full parameter documentation, authentication setup, and pagination reference, see the Reverse WHOIS API product page.

What to Do With Reverse WHOIS Results

A reverse WHOIS search by email returns a list of domain names. That list is the starting point, not the end of the investigation. How you triage and act on those results determines how useful the lookup actually is.

Look for registration clusters: Sort results by registration date. If a large number of domains were registered within the same one-to-three-day window, that pattern suggests a coordinated registration event rather than organic activity over time. A threat actor standing up a phishing campaign typically registers all supporting domains at once.

Look for naming conventions: Scan the domain names for recurring patterns: brand names with typosquatting variations, keyword combinations that match a known product or service, or structural patterns such as the same prefix or suffix across multiple domains. A registrant who owns 40 domains with consistent naming patterns is almost certainly operating with intent rather than accumulating domains casually.

Check for shared nameservers across results: A registrant may use different email addresses across domains but reuse the same nameservers. If multiple domains in your results share nameservers with each other or with domains you already know are malicious, you have an infrastructure linkage that holds even if registration data changes.

Escalate to historical WHOIS for unresolved domains: For any domain in your results that currently shows a privacy proxy in its active WHOIS record, run a WHOIS History lookup to check whether earlier snapshots contain the unredacted registrant data from before privacy protection was applied.

Document before acting: If your findings will support a legal complaint, abuse report, or law enforcement referral, save the raw results with timestamps before taking any action. Export the full result set from the API rather than working from the tool's display limit.

WHOIS Privacy and GDPR: When Email-Based Reverse Lookup Has Limits

Since GDPR took effect in May 2018, most domain registrars in the European Union and many outside it began redacting registrant contact data, including email addresses, from publicly accessible WHOIS records. This means that domains registered or renewed after mid-2018 by privacy-conscious registrants will often show a proxy email such as [email protected] rather than the actual registrant email.

When Reverse WHOIS by email works:

First, if the email address was used before privacy redaction and the registrant did not update their records or transfer the domain, historical WHOIS records preserve the original contact data. WhoisFreaks indexes WHOIS history records going back to 1986, and pre-2018 records for millions of domains retain the original registrant email.

Second, some registrars do not participate in GDPR redaction because they operate in jurisdictions that do not require it. Domains registered through these registrars continue to expose registrant email in current WHOIS records.

Third, if a threat actor or registrant reuses the same proxy email across multiple registrations, a reverse WHOIS search on the proxy email address will still surface all domains that share it, even if the proxy obscures the actual registrant.

Practical implications for Reverse WHOIS:

Reverse WHOIS by email is most reliable for pre-2018 registrations and for investigations where the target has not used WHOIS privacy services. For newer registrations with redacted contacts, pair reverse WHOIS with other pivot points such as shared nameservers, SSL certificate organizational data, or IP address clustering.

Choosing Reverse WHOIS Search Input: Email, Name, Company, or Keyword

Reverse WHOIS supports four primary search attributes. Each produces different results and is suited to different investigation or research scenarios.

Choosing between email and organization for company research:

When researching a company's domain portfolio, an organization name search is usually broader and more complete because the company may use multiple email addresses across different registrants or departments. Email-based searches are more precise but may miss domains registered by other employees or subsidiaries using different email addresses. The most thorough approach combines both: run an organization name search first, then pivot on any email addresses that appear in the results.

Finding all emails associated with a domain:

This is a different task from reverse WHOIS. To find all email addresses associated with a specific domain, you need a standard WHOIS or WHOIS History lookup on that domain, not a reverse lookup. The WHOIS record for any domain includes the registrant, admin, and technical contact email addresses used at registration. WHOIS History lookup will show you every email address that has ever been associated with the domain, including addresses changed or redacted over time.

Use Cases of Reverse WHOIS

1. Cybersecurity & Threat Intelligence

Cybersecurity professionals use Reverse WHOIS to track down attackers and identify malicious domains.

Many cybercriminals register multiple web addresses using the same email address or company name. By performing this type of WHOIS Lookup, security analysts can:

• Identify all domain names linked to a known threat actor
• Monitor domains involved in phishing campaigns or fraud
• Detect fraudulent websites impersonating legitimate brands

2. Market Research & Competitive Analysis

Businesses often use WHOIS Lookup to conduct market research and competitive analysis. By searching for a competitor's company name, they can:

• Discover all domain names owned by the competitor
• Identify potential new product launches based on domain registrations
• Monitor brand usage and trademark violations

perform a reverse WHOIS company lookup for your competitor like the one performed below:

3. Brand Protection & Trademark Monitoring

Companies frequently perform Reverse WHOIS Lookups to protect their trademarks and brand identity. If a third party registers a web address similar to a well-known brand, businesses can take action by:

• Identifying who registered the domain
• Filing legal complaints or domain disputes
• Preventing potential fraud or impersonation attempts

For ongoing monitoring rather than one-off lookups, Registrant Monitoring alerts your team automatically when a known registrant email or name registers new domains.

4. Domain Portfolio Management

Organizations that own multiple domains use Reverse Lookup to track all domains registered under their name. This helps them:

• Keep an inventory of owned domains
• Monitor expiration dates and renewals
• Identify any unauthorized domain registrations

Conclusion

Most reverse WHOIS lookups by email work as expected for registrations made before mid-2018, when WHOIS privacy redaction became widespread. For investigations that require coverage of post-2018 domains with redacted contacts, the Reverse WHOIS API supports historical record queries going back to 1986, which means pre-redaction registrant data is accessible even when current records are masked. Pair email-based reverse lookups with organization name searches on the same dataset to build the most complete picture of a registrant's domain activity.