2

Recently, doing "whois" on random large Fortune 500 style bricks-and-mortar companies, I've seen a few use private/"anonymous" registrations.

Normally you see stuff like

Registrant Organization: Levi Strauss and Co.
Registrant Street: 1155 Battery Street, 
Registrant City: San Francisco
Registrant State/Province: CA
Registrant Postal Code: 94111

Checks out.

Of course, regular folk, youtubers, social media stars use anonymized servers, so they don't get stalkers, doxxed, etc. I can see why Pokimane does that. But increasingly, I'm seeing it from respectable large corporations, and that makes it more difficult to authenticate the site obviously. This comes up particularly when it's a standalone domain (e.g. example.com) rather than a subdomain (example.ford.com).

Is there a security reason for a well-known large enterprise with good security to use anonymous registration on the company's domain names? I.E. Should they do that?

Harper - Reinstate Monica
  • 3,401
  • 13
  • 18
  • 2
    The registrant might in some cases be unaware. This could be some default action by the registrar, especially in light of GDPR etc. Whois records are often redacted nowadays. And even the big corporations are not always monitoring their IP assets like they should. – Kate May 02 '23 at 20:55

1 Answers1

2

For most major companies, anonymous registration provides no security benefits. Most of those companies contain public contact information on their websites, and many of them are trading public securities, in which case they must file lots of documentation about their officers and directors and provided detailed business information, so this information is already easily accessible.

The one requirement that WHOIS has is "one network mailbox", which means, in modern parlance, an email address. This is considered important because people need to contact someone relevant about misconfiguration with the domain or its assets. (I have done this on many an occasion with smaller organizations.) However, many people dislike this because of spam, and anonymous domain registration often masks the email address. That is not intrinsically a security problem, but rather an abuse problem. Nevertheless, it can impede the reporting of abuse or security incidents, which may have security-related implications, though.

It's more likely that this behaviour is the default for GDPR reasons, since many registrars enabled it automatically for users when GDPR became a thing. Note that corporations don't have privacy rights in most countries, so they can't exercise GDPR protections, but discerning whether a registrant is a corporation or human isn't necessarily trivial, so a global default would be the easiest way to comply.

bk2204
  • 9,434
  • 22
  • 20