How to Check Who Owns a Website Using WHOIS Lookup, Domain Age, and About Page Analysis

Close the tab. Do not click the link. Do not forward the message. That WhatsApp alert about a government refund, the urgent email from your bank, the breaking news story that seems slightly off: before you act on any of them, take fifteen minutes to check who owns the website. A WHOIS lookup, a domain age check, and an About page analysis cost nothing and require no technical skill. You will learn how to spot an imposter site posing as a legitimate source, whether it pretends to be a public agency, a bank, or a news outlet.

Start with a WHOIS lookup. It queries a public database of domain registrations and returns who registered the domain, when, and through which registrar. The Internet Corporation for Assigned Names and Numbers (ICANN) oversees the system for generic top-level domains like .com and .org. For the country's own .sg and .com.sg domains, the Singapore Network Information Centre (SGNIC) runs the registry. Run a free lookup at lookup.icann.org for generic TLDs or whois.sgnic.sg for local domains.

A typical WHOIS record returns the registrant name, registrant organisation, registrant email, administrative and technical contacts, the registrar, and critical dates including the creation date and expiration date. A brand-new domain registered three days before a breaking news story appears is a major red flag. A domain registered ten years ago with a matching registration history is far less suspicious, though not proof of legitimacy on its own.

Many registrants use a privacy guard or proxy service to hide their personal details. The WHOIS record shows something like "REDACTED FOR PRIVACY" or "Privacy service provided by WhoisGuard" instead of a name. This is legal. Both legitimate sites and scammers use it, so do not assume a hidden owner means a scam. But when the owner is hidden and the domain is young and the site makes big claims, treat that combination with suspicion.

Singapore has a stricter rule: SGNIC does not permit proxy registration for .sg domains. If you look up a .sg domain and the WHOIS shows a privacy service, something is off. Read SGNIC's policy on their website. For generic TLDs, ICANN's Temporary Specification for gTLD Registration Data, effective 20 May 2018, and the newer Registration Data Policy from 21 March 2024, allowed registrars to redact personal data but still required them to provide a lookup service and to validate registrant contact details within 15 days of registration under the 2013 Registrar Accreditation Agreement.

Domain age is the second check, and it is the one most likely to get a quick verdict. The creation date field in a WHOIS record tells you exactly when the domain was first registered. To calculate domain age, subtract the creation date from today's date. Use whois.com or lookup.icann.org and look for the field labelled "Creation Date". For .sg domains, SGNIC's WHOIS also labels it "Creation Date".

Research from the Stanford History Education Group found something that should shorten your decision time: domains registered within 30 days of a news event are more likely to be associated with misinformation. A domain that is eleven days old and publishing political news is a serious warning sign, whatever its design looks like. A domain age checker tool shows this in seconds. Make it a habit to look before you read.

Scammers love the officialdom halo. They wrap a fake site in agency logos, official-sounding language, and a URL that looks like it belongs to a public body. In this country, the trick works because the public sector's digital presence is strong and trusted. The defence is simple: genuine agency websites use the .gov.sg domain, and that domain is restricted to the public sector. No private company, no individual, and no foreign actor can register a genuine .gov.sg domain. If you see a site claiming to be the Ministry of Health or the police using a different domain, it is an imposter website.

The domain policy is administered through the Info-communications Media Development Authority (IMDA) and the Government Technology Agency, and the .gov.sg second-level domain is reserved for the public sector. When you need to spot an imposter news site, check the URL, then check the WHOIS record, then check whether the site links to official channels. A real agency site will have a .gov.sg address and will not ask for personal data through a pop-up.

Fake agency site detection starts with the URL inspection. Scammers register lookalike domains such as gov-singapore.com or moh-update.sg to catch people who type quickly. The .gov.sg suffix is non-negotiable. If the domain does not end in that exact string, it is not a local public-sector site, no matter what logo sits on the header. The same logic applies to police.gov.sg, mom.gov.sg, and any other agency.

Check the site's About page and contact page to see if they name real people and provide a phone number that matches the official directory. A public agency publishes a physical address and a hotline. If the contact page only has a web form and a Gmail address, you are looking at an impersonation scam. The Singapore Police Force publishes a scam alert page and the POFMA Office runs Factually at gov.sg/factually to counter falsehoods, but neither will contact you through WhatsApp demanding payment.

Check the Registrant Against Public Registries

A single WHOIS record is not enough. Take the registrant name or organisation from the WHOIS and check it against public registries. For locally registered entities, search the Accounting and Corporate Regulatory Authority (ACRA) BizFile+ register at bizfile.gov.sg. Enter the company name, and you will see the Unique Entity Number, registration date, status, and officers. If the WHOIS registrant says "ACME Pte Ltd" but ACRA has no such company, the registration details are false. If ACRA shows a different address than the website's contact page, that is another red flag.

Search the Domain's History

Search the domain name in quotation marks on a search engine to find other sites owned by the same entity. A scammer often registers multiple domains for different frauds, and they may link back to the same phone number or email. Check the Internet Archive's Wayback Machine at web.archive.org to see what the site looked like in the past. A site that changed its About page from a travel blog to a bank's customer portal in one week is not a bank.

The About page is where legitimacy shows or fails. A genuine organisation names its people: a managing editor, a chief executive, a board of directors. An imposter site will have an About page with generic stock photos and no names, or it will lift a real person's bio from another site. When you read the About page, look for named individuals, verifiable credentials, and a history that matches the domain age.

Search for the names you find. If the CEO's name returns no other trace on the internet, that is suspicious. Use lateral reading: open a new tab and search for the person's name plus the organisation name, and check whether any independent source mentions them. Also check the website's social media account creation dates. A news outlet with a 2009 domain but a Twitter account created last month is a mismatch worth investigating.

The URL is your first line of defence. Look at the actual domain name, not the display text. Scammers use homoglyphs, extra words, or misspellings. A real address is "gov.sg" but a fake may be "govv.sg" or "gov.org.sg". A contact page should list a physical street address, not just a post office box, and a phone number that connects to a human. Call it. A legitimate organisation will answer; a scam site will not.

Cross-check the contact details against the WHOIS record and the ACRA register. If the site claims to be a local company but the WHOIS shows a registrant in another country using a proxy service, that is a mismatch. The contact page verification method is simple: email the address on the site and see if you get a bounce or a generic response. A real organisation uses a domain-based email, not a free Gmail account.

Scam websites fall into recognisable patterns. The phishing site clones a bank login page. The fake agency site offers a refund or demands a fee. The imposter news site mixes real headlines with fabricated stories to build trust. The investment scam promises guaranteed returns. The love scam sets up a fake personal profile. Each type leaves traces: the phishing site's SSL certificate may match a different company, the fake agency site's WHOIS age is measured in days, and the imposter news site's About page names a reporter who does not exist.

The Singapore Police Force's scam typology includes job scams, phishing, e-commerce fraud, investment scams, impersonation scams, and love scams. When you check a website, ask which type it might be and whether the site fits the pattern. An impersonation scam site will have a URL that mimics a real one and will pressure you to act quickly. The officialdom halo is strongest when the scammer adds a fake logo or a fabricated verification seal.

Phishing site detection is not a single tool but a habit. You check the WHOIS and see the domain is five days old. You check the About page and find no names. You check the contact page and the phone number is a mobile number with no other trace. You check the URL and it is a misspelling of a bank's domain. Any one of these might be explainable; all of them together mean you should close the tab.

ScamShield, the official app, blocks known scam numbers and websites, but it cannot catch everything. The app's accuracy depends on its database being up to date, and new scam domains appear faster than any database can be refreshed. Use ScamShield as a backstop, not a primary defence. Your own verification is faster and more reliable.

Lateral reading means leaving the site you are evaluating and checking what other sources say about it. Open a new tab and search the domain name, the organisation name, and any named people. If the only results are the site itself and social media profiles that post identical content, that is a warning sign. A legitimate organisation will have a digital footprint across multiple independent sources.

Reverse image search is a powerful companion. If the site's About page shows a team photo, upload the image to Google Images or TinEye. If the same photo appears on a stock photo site or on a different company's website, the team is fake. This technique is useful for identifying imposter news sites, where scammers lift photos from legitimate outlets to build false credibility.

What do you do when a website fails all these checks but you still need the information? Do not share it. Do not click its links. Close the tab and go to the official source directly by typing the known URL into your browser, not by clicking a link from email or a message. For public-sector matters, go to gov.sg. For a bank, type the bank's address directly. For news, go to a known outlet's homepage.

The failure case also applies when you are tempted to skip the verification because you are in a hurry. That is exactly when the scammer wins. A forwarded message on WhatsApp or Telegram claiming to be from an official agency, with a link and a threat of penalty, is the classic vector. The officialdom halo works because people are conditioned to obey authority. Break the loop: do not act on the link, verify the claim, and then act.

ICANN's Registration Data Policy, effective 21 March 2024, requires generic TLD registrars to provide a public lookup service, but it also allows registrant data to be redacted for privacy. For .com and .org, you may not see the owner's name. For .sg domains, SGNIC redacts individual registrant contact details by default since 2020, but still shows the registrant organisation for companies and the creation date. SGNIC also enforces a query limit of 20 WHOIS lookups per IP address per hour, so automate sparingly.

When the WHOIS record is redacted, the domain age and the registrar's identity become more important. A domain registered yesterday through a reseller is a higher risk than one registered ten years ago. Check the PrivacyGuardian indicator: if the WHOIS shows a proxy service, treat the ownership as unknown and proceed with extra caution.

The Five-Minute Routine

Here is a practical routine you can run in under five minutes. First, copy the domain name and go to lookup.icann.org. Read the Creation Date and the Registrar. Count the days since that date. If the domain is under 30 days old and the site makes any factual claim, pause. Second, open the site's About page and look for a named person. Search for that name in a new tab. If nothing comes up, pause again. Third, check the contact page for a physical address and a phone number. Cross-reference the address with the WHOIS and, if it claims to be a local company, with ACRA's register.

If all three checks pass, the site is more likely to be what it claims. If any check fails, do not rely on the site. This process embodies lateral reading, and it is the same method professional fact-checkers use. You do not need to be a detective to protect yourself; you need a few minutes and the willingness to leave the page.

Verifying a website can expose your own data. Submitting a suspicious URL to a random online checker may share your IP address and the URL with a third party. The ScamShield app sends reported numbers and URLs to a central database, which helps others but reveals your report pattern. When you use reverse image search, the image may be stored. Be deliberate about what you upload.

Run WHOIS lookups through trusted services like ICANN's own lookup tool or SGNIC's registry. These are the official sources and do not sell your data for advertising. The trade-off between privacy and verification is real, but you can minimise it by using official tools and not clicking on ads in search results, which are often scam links themselves.

This verification method suits the small-business owner or older adult who has been targeted by impersonation scams, and the curious 16-to-25-year-old who wants to explain disinformation to friends. It is not for the reader who wants official communications, legal advice, or to report a crime; that reader should go to the relevant agency's website. It is also not for a reader outside the country seeking general media literacy theory without local laws and tools, because the examples here draw on the .gov.sg policy, ACRA, and ScamShield.

If you are in the country and need to verify a claim, use these checks. If you are elsewhere, the same principles apply but you will need to substitute your own country's registries and official domains. The failure case remains the same everywhere: when in doubt, do not share, do not pay, and do not click.

What is the fastest way to check who owns a website?

Go to lookup.icann.org and enter the domain. The WHOIS record shows the registrar and creation date; if privacy is enabled, you will see a proxy service. For .sg domains, use whois.sgnic.sg. The creation date is the single fastest signal of a potential impersonation scam.

Can a WHOIS lookup tell me if a site is a scam?

Not on its own, but it is a strong indicator. A domain registered days ago, with hidden registrant details and no matching company in ACRA, is a red flag. Combine the WHOIS data with an About page check and a reverse image search to confirm.

Why do some WHOIS records show "REDACTED FOR PRIVACY"?

That is a privacy guard or proxy service, allowed under ICANN rules for generic TLDs. It hides the personal details of the registrant. Be more suspicious if the site is a .sg domain, because SGNIC does not permit proxy registration.

Is .gov.sg always safe to trust?

Yes, .gov.sg is restricted to public agencies, so a site with that domain is genuinely run by the authorities. But scammers can use lookalike domains like gov-singapore.com. Always check that the exact suffix is .gov.sg, not a variation.