WHOIS / RDAP

What a lookup tells you

For a suspect domain, a registration record answers the questions that decide priority and routing: how old is it, which registrar sponsors it, when did it last change, and which nameservers does it use. Registrant contact details are largely redacted since 2018, so the record identifies the responsible provider rather than the person.

WHOIS versus RDAP

WHOIS returns free-form text that differs by registry and is awkward to parse. RDAP returns the same information as JSON over HTTPS, with a defined structure and the ability to redirect the client to the authoritative server. ICANN operates a bootstrap service that maps each top-level domain to its RDAP server. For automated triage, RDAP is the one to build on.

Using it in abuse work

• Registration date: a domain registered days ago and already serving a sign-in page is a strong signal.
• Registrar: this is who receives the abuse report about the registration itself; the abuse contact is published in the record.
• Nameservers and hosting: these point to the other providers who can act on the content.
• Keep the record: it is part of the evidence and it changes when the domain is transferred or suspended.

Related terms

• Domain monitoring
• Abuse desk
• Lookalike domain
• Typosquatting