London, UK: July 6, 2026 – MarkScout today introduced a set of investigation tools designed for a world in which registrant data is partly redacted and access depends on the jurisdiction. The tools bring RDAP lookups, structured disclosure requests and infrastructure analysis into one workflow, so analysts spend their time on decisions instead of on switching between systems.
The release follows two shifts in the domain industry: the EU's NIS2 directive, which obliges registries and registrars to collect accurate data and provide lawful access, and the ongoing move from WHOIS to RDAP, with operators such as Nominet planning to retire their WHOIS service for .UK in February 2027.
The new workflow records the legitimate-interest basis for every request, tracks responses by registrar and keeps an audit trail that can be reused in later proceedings. Where registrant fields remain hidden, it clusters domains by hosting, name servers, certificate history and page content to show which sites are probably run by the same party.
“Registration data is only one clue among many. Putting it next to infrastructure signals lets our analysts connect cases much faster than any single source could,” says Marcus Whitfield, cybersecurity and digital risk intelligence expert at MarkScout.