WHOIS Scraper

Domain, IP and ASN registration data (WHOIS / RDAP) — registrar, owner, dates, name servers, DNSSEC and abuse contacts — as clean JSON.

WHOIS tells you who registered a domain, through which registrar, when it was created and when it expires; for an IP address or AS number it tells you which organisation holds the network and where to report abuse. This Actor looks up WHOIS and RDAP registration data for domains, IP addresses and AS numbers: registrar, owner contacts, creation and expiry dates, domain age, name servers, DNSSEC, IP ranges and abuse contacts. Paste domains, URLs or emails. WHOIS fallback for ccTLDs. No API key, no proxy. It asks each registry directly through RDAP, the standard JSON successor to WHOIS, so the data comes from the authoritative source rather than a third-party database. For .com, .net and other registries that keep no owner data it also asks the sponsoring registrar, and for country domains whose registry has no RDAP service (.eu, .it, .jp, .ru, .se, .be and more) it falls back to the registry's classic WHOIS server. Built for sales and lead-enrichment teams, security and fraud analysts, brand-protection and domain-portfolio managers, and anyone feeding domain or network data into a CRM, SIEM or AI pipeline.

⚡ Quick start

{
  "startUrls": [{ "url": "https://apify.com/store" }],
  "domains": ["wikipedia.org", "europa.eu"],
  "ips": ["8.8.8.8"],
  "asns": ["AS13335"],
  "maxItems": 5
}

🧩 Input

Field	Type	Required	Default	Description
startUrls	array	no	—	Any website URL, such as https://apify.com/store; its registrable domain (apify.com) is looked up. RDAP links (https://rdap.org/domain/apify.com) and ICANN Lookup links work too.
domains	array	no	—	Domains to look up, such as wikipedia.org or bbc.co.uk. Subdomains, URLs and email addresses (info@example.com) are reduced to their registrable domain.
ips	array	no	—	IPv4 or IPv6 addresses or networks, such as 8.8.8.8, 2001:4860:4860::8888 or 193.0.0.0/21.
asns	array	no	—	Autonomous system numbers, such as AS13335 or 15169.
includeRegistrarData	boolean	no	true	For .com, .net and other registries that keep no owner data, also ask the sponsoring registrar for the registrant, admin and technical contacts.
maxItems	integer	no	—	Maximum number of lookups (dataset rows) for the whole run. The input form starts at 5; leave it empty to look up every value.
proxyConfiguration	object	no	{ "useApifyProxy": false }	Proxy settings. Registries need no proxy.

Mix any of the four lists. Every value becomes one lookup and one dataset row, and the same domain given twice (say, as a URL and as an email address) is looked up once. Subdomains are reduced to the domain a registry actually knows, using the Public Suffix List: https://shop.example.co.uk/cart looks up example.co.uk.

📤 Output

Each lookup is one dataset row. itemType says what kind: domain, ip or asn. Domain rows carry the registrar, contacts, dates and name servers; IP and ASN rows carry the network range, the organisation that holds it and its abuse contact. Every row has found (false when the registry has no such domain, which usually means it is unregistered), source (rdap or whois), a plain-words note whenever data is missing or partial, and the registry's own answer in raw. Contacts are kept exactly as published: most registries now redact owner details for privacy, and values such as REDACTED FOR PRIVACY are passed through, never guessed.

Fields

Field	Type	Description
itemType	string	domain, ip or asn.
query	string	The input value exactly as given.
url	string	The source record: the registry's RDAP record, or IANA's page for a WHOIS-only TLD.
found	boolean	true when the registry has the object, false when it has no record (an unregistered domain), null when the lookup could not be completed.
rdapAvailable	boolean	Whether the registry runs an RDAP service.
source	string	Where the data came from: rdap, whois (the registry's port-43 WHOIS server) or null.
handle	string	The registry's id for the object, such as NET-8-8-8-0-2 or AS15169.
status	array	Status codes, such as client transfer prohibited or active.
events	array	Every dated event the registry publishes: action, date (ISO 8601, UTC) and actor.
createdAt	string	Registration date (ISO 8601, UTC; a few WHOIS servers give only the day, YYYY-MM-DD).
updatedAt	string	Last change.
rdapServer	string	The RDAP service that answered.
rdapUrl	string	The RDAP record that was read.
note	string	Why data is missing or partial, in plain words. null when the lookup is complete.
raw	object	The registry's RDAP answer, untouched.
domain	string	Domain rows: the host that was given, such as www.bbc.co.uk.
registrableDomain	string	Domain rows: the domain that was looked up, such as bbc.co.uk.
publicSuffix	string	Domain rows: the public suffix, such as co.uk.
tld	string	Domain rows: the top-level domain, such as uk.
registrar	object	Domain rows: the sponsoring registrar's name, ianaId, url, abuseEmail and abusePhone.
registrant	object	Domain rows: the owner contact as published: role, handle, name, organization, email, phone, fax, street, city, region, postalCode, country and contactUrl (the registrar's contact form). null when not published.
admin	object	Domain rows: the administrative contact, same shape.
tech	object	Domain rows: the technical contact, same shape.
expiresAt	string	Domain rows: expiry date.
ageDays	integer	Domain rows: days since registration.
daysUntilExpiry	integer	Domain rows: days until expiry (negative once expired).
nameservers	array	Domain rows: name servers, lower case.
dnssec	boolean	Domain rows: whether the delegation is DNSSEC-signed.
whoisServer	string	Domain rows: the WHOIS server for the domain.
registrarRaw	object	Domain rows: the registrar's own RDAP answer, when it was asked.
whoisText	string	Domain rows: the WHOIS server's text answer, for TLDs without RDAP.
name	string	IP and ASN rows: the network or AS name, such as GOGL or CLOUDFLARENET.
type	string	IP rows: allocation type, such as DIRECT ALLOCATION or ASSIGNED PA.
country	string	IP and ASN rows: the country code the registry gives, otherwise the country in the holder's address.
organisation	string	IP and ASN rows: the organisation the network or AS number is registered to.
abuseEmail	string	IP and ASN rows: where to report abuse.
abusePhone	string	IP and ASN rows: abuse phone number.
contacts	array	IP and ASN rows: every published contact (registrant, abuse, technical, administrative, NOC), same shape as registrant.
ipVersion	string	IP rows: v4 or v6.
startAddress	string	IP rows: first address of the network.
endAddress	string	IP rows: last address of the network.
cidr	array	IP rows: the network as CIDR blocks, such as 8.8.8.0/24.
parentHandle	string	IP rows: the enclosing network's handle.
startAutnum	integer	ASN rows: first AS number of the block.
endAutnum	integer	ASN rows: last AS number of the block.

💡 Use cases

• Lead enrichment — turn a list of company websites or email addresses into registrar, registrant organisation, country and domain age.
• Fraud and phishing triage — flag newly registered domains (ageDays), privacy-proxied owners and suspicious registrars before they reach your users.
• Domain portfolio and brand protection — watch expiry dates (daysUntilExpiry), transfer locks, name servers and DNSSEC across every domain you own or monitor.
• Security operations — find who holds an IP address or AS number and where to send an abuse report.
• Due diligence and research — check how long a business has held its domain and who sponsors it.
• AI agents and data pipelines — give an LLM, CRM or SIEM clean, structured registration records instead of raw WHOIS text.

❓ FAQ

• Where does the data come from? From each registry directly: the registry named by IANA for the TLD, IP block or AS number, through RDAP (the standard JSON successor to WHOIS). For .com, .net and similar registries it also asks the sponsoring registrar, which holds the contacts.
• Why are the owner's name and email "REDACTED"? Since GDPR most registries and registrars no longer publish personal contact data. The Actor reports exactly what is published: often the organisation and country survive, and contactUrl points to the registrar's form for reaching the owner.
• Which TLDs are covered? Every TLD whose registry runs RDAP (all generic TLDs and most country TLDs, including .uk, .de, .io, .co, .fr, .nl, .au, .ca). For country TLDs without RDAP, such as .eu, .it, .jp, .ru, .se and .be, it reads the registry's WHOIS server instead, which publishes fewer and less uniform fields. A few TLDs publish no registration data at all; their row says so in note.
• How do I check whether a domain is available? Look at found: false means the registry has no record of it.
• Do I need a proxy or an API key? No. Registries are public. The Actor sends one request at a time to each registry, with a pause between them, and backs off when a registry asks it to slow down.
• How fast is it? Different registries are queried in parallel, about one lookup per second per registry. A list of a thousand .com domains takes roughly half an hour (two requests each with registrar data); turn off includeRegistrarData to halve that.
• Why did a lookup return a note instead of data? The registry was unreachable or kept rate limiting after several retries, or publishes no data for that TLD. Every input still gets a row with the reason in note.
• Are there limits on how I can use the results? Yes. Registries and registrars publish RDAP and WHOIS data under their own terms of use, which limit high-volume automated querying and typically forbid using the data for unsolicited marketing or spam. The output is for information only, such as checking a domain's status, expiry date or registrar; using it within those terms is up to you. The Actor keeps to a modest pace (a few lookups in parallel, one request at a time per registry) and slows down whenever a registry answers with a rate limit.

🔗 More scrapers by Anyx

• Web Content Scraper
• Google Maps Email & Contact Extractor
• Yellow Pages Scraper
• Google Search Scraper

🤝 Anyx Solutions

We build custom scrapers and data-extraction pipelines.

• Email: tantosthor@gmail.com

🖼 Image credit

Image credit: iana.org