# WHOIS Scraper (`anyxsolutions/whois-scraper`) Actor Look up WHOIS and RDAP registration data for domains, IP addresses and AS numbers: registrar, owner contacts, creation and expiry dates, domain age, name servers, DNSSEC, IP ranges and abuse contacts. Paste domains, URLs or emails. WHOIS fallback for ccTLDs. No API key, no proxy. - **URL**: https://apify.com/anyxsolutions/whois-scraper.md - **Developed by:** [Anyx Solutions](https://apify.com/anyxsolutions) (community) - **Categories:** Developer tools, Lead generation, SEO tools - **Security:** Limited permissions - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $2.50 / 1,000 results This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have. Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event ## What's an Apify Actor? An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md. ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run. For examples already wired to this Actor's own input schema, see the [API](#api) section below. Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`). # README ![banner](https://anyx.solutions/banners/whois-scraper.png) ## WHOIS Scraper **Domain, IP and ASN registration data (WHOIS / RDAP) — registrar, owner, dates, name servers, DNSSEC and abuse contacts — as clean JSON.** WHOIS tells you who registered a domain, through which registrar, when it was created and when it expires; for an IP address or AS number it tells you which organisation holds the network and where to report abuse. This Actor looks up WHOIS and RDAP registration data for domains, IP addresses and AS numbers: registrar, owner contacts, creation and expiry dates, domain age, name servers, DNSSEC, IP ranges and abuse contacts. Paste domains, URLs or emails. WHOIS fallback for ccTLDs. No API key, no proxy. It asks each registry directly through RDAP, the standard JSON successor to WHOIS, so the data comes from the authoritative source rather than a third-party database. For .com, .net and other registries that keep no owner data it also asks the sponsoring registrar, and for country domains whose registry has no RDAP service (.eu, .it, .jp, .ru, .se, .be and more) it falls back to the registry's classic WHOIS server. Built for sales and lead-enrichment teams, security and fraud analysts, brand-protection and domain-portfolio managers, and anyone feeding domain or network data into a CRM, SIEM or AI pipeline. ### ⚡ Quick start ```json { "startUrls": [{ "url": "https://apify.com/store" }], "domains": ["wikipedia.org", "europa.eu"], "ips": ["8.8.8.8"], "asns": ["AS13335"], "maxItems": 5 } ``` ### 🧩 Input | Field | Type | Required | Default | Description | | ---------------------- | ------- | -------- | ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `startUrls` | array | no | — | Any website URL, such as `https://apify.com/store`; its registrable domain (`apify.com`) is looked up. RDAP links (`https://rdap.org/domain/apify.com`) and ICANN Lookup links work too. | | `domains` | array | no | — | Domains to look up, such as `wikipedia.org` or `bbc.co.uk`. Subdomains, URLs and email addresses (`info@example.com`) are reduced to their registrable domain. | | `ips` | array | no | — | IPv4 or IPv6 addresses or networks, such as `8.8.8.8`, `2001:4860:4860::8888` or `193.0.0.0/21`. | | `asns` | array | no | — | Autonomous system numbers, such as `AS13335` or `15169`. | | `includeRegistrarData` | boolean | no | `true` | For .com, .net and other registries that keep no owner data, also ask the sponsoring registrar for the registrant, admin and technical contacts. | | `maxItems` | integer | no | — | Maximum number of lookups (dataset rows) for the whole run. The input form starts at 5; leave it empty to look up every value. | | `proxyConfiguration` | object | no | `{ "useApifyProxy": false }` | Proxy settings. Registries need no proxy. | Mix any of the four lists. Every value becomes one lookup and one dataset row, and the same domain given twice (say, as a URL and as an email address) is looked up once. Subdomains are reduced to the domain a registry actually knows, using the Public Suffix List: `https://shop.example.co.uk/cart` looks up `example.co.uk`. ### 📤 Output Each lookup is one dataset row. `itemType` says what kind: `domain`, `ip` or `asn`. Domain rows carry the registrar, contacts, dates and name servers; IP and ASN rows carry the network range, the organisation that holds it and its abuse contact. Every row has `found` (`false` when the registry has no such domain, which usually means it is unregistered), `source` (`rdap` or `whois`), a plain-words `note` whenever data is missing or partial, and the registry's own answer in `raw`. Contacts are kept exactly as published: most registries now redact owner details for privacy, and values such as `REDACTED FOR PRIVACY` are passed through, never guessed. #### Fields | Field | Type | Description | | ------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `itemType` | string | `domain`, `ip` or `asn`. | | `query` | string | The input value exactly as given. | | `url` | string | The source record: the registry's RDAP record, or IANA's page for a WHOIS-only TLD. | | `found` | boolean | `true` when the registry has the object, `false` when it has no record (an unregistered domain), `null` when the lookup could not be completed. | | `rdapAvailable` | boolean | Whether the registry runs an RDAP service. | | `source` | string | Where the data came from: `rdap`, `whois` (the registry's port-43 WHOIS server) or `null`. | | `handle` | string | The registry's id for the object, such as `NET-8-8-8-0-2` or `AS15169`. | | `status` | array | Status codes, such as `client transfer prohibited` or `active`. | | `events` | array | Every dated event the registry publishes: `action`, `date` (ISO 8601, UTC) and `actor`. | | `createdAt` | string | Registration date (ISO 8601, UTC; a few WHOIS servers give only the day, `YYYY-MM-DD`). | | `updatedAt` | string | Last change. | | `rdapServer` | string | The RDAP service that answered. | | `rdapUrl` | string | The RDAP record that was read. | | `note` | string | Why data is missing or partial, in plain words. `null` when the lookup is complete. | | `raw` | object | The registry's RDAP answer, untouched. | | `domain` | string | Domain rows: the host that was given, such as `www.bbc.co.uk`. | | `registrableDomain` | string | Domain rows: the domain that was looked up, such as `bbc.co.uk`. | | `publicSuffix` | string | Domain rows: the public suffix, such as `co.uk`. | | `tld` | string | Domain rows: the top-level domain, such as `uk`. | | `registrar` | object | Domain rows: the sponsoring registrar's `name`, `ianaId`, `url`, `abuseEmail` and `abusePhone`. | | `registrant` | object | Domain rows: the owner contact as published: `role`, `handle`, `name`, `organization`, `email`, `phone`, `fax`, `street`, `city`, `region`, `postalCode`, `country` and `contactUrl` (the registrar's contact form). `null` when not published. | | `admin` | object | Domain rows: the administrative contact, same shape. | | `tech` | object | Domain rows: the technical contact, same shape. | | `expiresAt` | string | Domain rows: expiry date. | | `ageDays` | integer | Domain rows: days since registration. | | `daysUntilExpiry` | integer | Domain rows: days until expiry (negative once expired). | | `nameservers` | array | Domain rows: name servers, lower case. | | `dnssec` | boolean | Domain rows: whether the delegation is DNSSEC-signed. | | `whoisServer` | string | Domain rows: the WHOIS server for the domain. | | `registrarRaw` | object | Domain rows: the registrar's own RDAP answer, when it was asked. | | `whoisText` | string | Domain rows: the WHOIS server's text answer, for TLDs without RDAP. | | `name` | string | IP and ASN rows: the network or AS name, such as `GOGL` or `CLOUDFLARENET`. | | `type` | string | IP rows: allocation type, such as `DIRECT ALLOCATION` or `ASSIGNED PA`. | | `country` | string | IP and ASN rows: the country code the registry gives, otherwise the country in the holder's address. | | `organisation` | string | IP and ASN rows: the organisation the network or AS number is registered to. | | `abuseEmail` | string | IP and ASN rows: where to report abuse. | | `abusePhone` | string | IP and ASN rows: abuse phone number. | | `contacts` | array | IP and ASN rows: every published contact (registrant, abuse, technical, administrative, NOC), same shape as `registrant`. | | `ipVersion` | string | IP rows: `v4` or `v6`. | | `startAddress` | string | IP rows: first address of the network. | | `endAddress` | string | IP rows: last address of the network. | | `cidr` | array | IP rows: the network as CIDR blocks, such as `8.8.8.0/24`. | | `parentHandle` | string | IP rows: the enclosing network's handle. | | `startAutnum` | integer | ASN rows: first AS number of the block. | | `endAutnum` | integer | ASN rows: last AS number of the block. |
Example output A domain row and an IP row. `raw` and `registrarRaw` are trimmed to their first fields here; in the dataset they hold the full RDAP answers. ```json [ { "itemType": "domain", "query": "https://apify.com/store", "domain": "apify.com", "registrableDomain": "apify.com", "publicSuffix": "com", "tld": "com", "url": "https://rdap.verisign.com/com/v1/domain/apify.com", "found": true, "rdapAvailable": true, "source": "rdap", "handle": "1557856354_DOMAIN_COM-VRSN", "status": ["client transfer prohibited"], "events": [ { "action": "registration", "date": "2009-06-02T17:14:10.000Z", "actor": null }, { "action": "expiration", "date": "2035-06-02T17:14:10.000Z", "actor": null }, { "action": "last changed", "date": "2026-05-16T16:53:04.000Z", "actor": null }, { "action": "last update of RDAP database", "date": "2026-10-13T01:48:38.000Z", "actor": null } ], "createdAt": "2009-06-02T17:14:10.000Z", "updatedAt": "2026-05-16T16:53:04.000Z", "rdapServer": "https://rdap.verisign.com/com/v1/", "rdapUrl": "https://rdap.verisign.com/com/v1/domain/apify.com", "note": null, "raw": { "objectClassName": "domain", "handle": "1557856354_DOMAIN_COM-VRSN", "ldhName": "APIFY.COM" }, "registrar": { "name": "Amazon Registrar, Inc.", "ianaId": "468", "url": "http://registrar.amazon.com", "abuseEmail": "trustandsafety@support.aws.com", "abusePhone": "+1.2024422253" }, "registrant": { "role": "registrant", "handle": null, "name": "On behalf of apify.com OWNER", "organization": "c/o whoisproxy.com", "email": "61d557de683e4d12e1bc409a33772f6ef1d3f0dcbe5e4e1e14e94e9508c1b409@apify.com.whoisproxy.org", "phone": "+64.48319528", "fax": null, "street": "604 Cameron Street", "city": "Alexandria", "region": "VA", "postalCode": "22314", "country": "US", "contactUrl": null }, "admin": null, "tech": { "role": "tech", "handle": null, "name": "On behalf of apify.com TECH", "organization": "c/o whoisproxy.com", "email": "61d557de683e4d12e1bc409a33772f6ecb8e337324f5806d3ee5a9fcad17c963@apify.com.whoisproxy.org", "phone": "+64.48319528", "fax": null, "street": "604 Cameron Street", "city": "Alexandria", "region": "VA", "postalCode": "22314", "country": "US", "contactUrl": null }, "expiresAt": "2035-06-02T17:14:10.000Z", "ageDays": 6341, "daysUntilExpiry": 3154, "nameservers": [ "ns-1225.awsdns-25.org", "ns-1928.awsdns-49.co.uk", "ns-449.awsdns-56.com", "ns-839.awsdns-40.net" ], "dnssec": true, "whoisServer": null, "registrarRaw": { "objectClassName": "domain", "handle": "1557856354_DOMAIN_COM-VRSN", "ldhName": "apify.com" }, "whoisText": null }, { "itemType": "ip", "query": "8.8.8.8", "url": "https://rdap.arin.net/registry/ip/8.8.8.8", "found": true, "rdapAvailable": true, "source": "rdap", "handle": "NET-8-8-8-0-2", "status": ["active"], "events": [ { "action": "last changed", "date": "2023-12-28T22:24:56.000Z", "actor": null }, { "action": "registration", "date": "2023-12-28T22:24:33.000Z", "actor": null } ], "createdAt": "2023-12-28T22:24:33.000Z", "updatedAt": "2023-12-28T22:24:56.000Z", "rdapServer": "https://rdap.arin.net/registry/", "rdapUrl": "https://rdap.arin.net/registry/ip/8.8.8.8", "note": null, "raw": { "objectClassName": "ip network", "handle": "NET-8-8-8-0-2", "startAddress": "8.8.8.0", "endAddress": "8.8.8.255" }, "name": "GOGL", "type": "DIRECT ALLOCATION", "country": "United States", "organisation": "Google LLC", "abuseEmail": "network-abuse@google.com", "abusePhone": "+1-650-253-0000", "contacts": [ { "role": "registrant", "handle": "GOGL", "name": "Google LLC", "organization": null, "email": null, "phone": null, "fax": null, "street": "1600 Amphitheatre Parkway, Mountain View, CA, 94043, United States", "city": null, "region": null, "postalCode": null, "country": "United States", "contactUrl": null }, { "role": "abuse", "handle": "ABUSE5250-ARIN", "name": "Abuse", "organization": "Google Inc.", "email": "network-abuse@google.com", "phone": "+1-650-253-0000", "fax": null, "street": "1600 Amphitheatre Parkway, Mountain View, CA, 94043, United States", "city": null, "region": null, "postalCode": null, "country": "United States", "contactUrl": null }, { "role": "technical, administrative", "handle": "ZG39-ARIN", "name": "Google LLC", "organization": "Google LLC", "email": "arin-contact@google.com", "phone": "+1-650-253-0000", "fax": null, "street": "1600 Amphitheatre Parkway, Mountain View, CA, 94043, United States", "city": null, "region": null, "postalCode": null, "country": "United States", "contactUrl": null } ], "ipVersion": "v4", "startAddress": "8.8.8.0", "endAddress": "8.8.8.255", "cidr": ["8.8.8.0/24"], "parentHandle": "NET-8-0-0-0-0" } ] ```
### 💡 Use cases - **Lead enrichment** — turn a list of company websites or email addresses into registrar, registrant organisation, country and domain age. - **Fraud and phishing triage** — flag newly registered domains (`ageDays`), privacy-proxied owners and suspicious registrars before they reach your users. - **Domain portfolio and brand protection** — watch expiry dates (`daysUntilExpiry`), transfer locks, name servers and DNSSEC across every domain you own or monitor. - **Security operations** — find who holds an IP address or AS number and where to send an abuse report. - **Due diligence and research** — check how long a business has held its domain and who sponsors it. - **AI agents and data pipelines** — give an LLM, CRM or SIEM clean, structured registration records instead of raw WHOIS text. ### ❓ FAQ - **Where does the data come from?** From each registry directly: the registry named by IANA for the TLD, IP block or AS number, through RDAP (the standard JSON successor to WHOIS). For .com, .net and similar registries it also asks the sponsoring registrar, which holds the contacts. - **Why are the owner's name and email "REDACTED"?** Since GDPR most registries and registrars no longer publish personal contact data. The Actor reports exactly what is published: often the organisation and country survive, and `contactUrl` points to the registrar's form for reaching the owner. - **Which TLDs are covered?** Every TLD whose registry runs RDAP (all generic TLDs and most country TLDs, including .uk, .de, .io, .co, .fr, .nl, .au, .ca). For country TLDs without RDAP, such as .eu, .it, .jp, .ru, .se and .be, it reads the registry's WHOIS server instead, which publishes fewer and less uniform fields. A few TLDs publish no registration data at all; their row says so in `note`. - **How do I check whether a domain is available?** Look at `found`: `false` means the registry has no record of it. - **Do I need a proxy or an API key?** No. Registries are public. The Actor sends one request at a time to each registry, with a pause between them, and backs off when a registry asks it to slow down. - **How fast is it?** Different registries are queried in parallel, about one lookup per second per registry. A list of a thousand .com domains takes roughly half an hour (two requests each with registrar data); turn off `includeRegistrarData` to halve that. - **Why did a lookup return a note instead of data?** The registry was unreachable or kept rate limiting after several retries, or publishes no data for that TLD. Every input still gets a row with the reason in `note`. - **Are there limits on how I can use the results?** Yes. Registries and registrars publish RDAP and WHOIS data under their own terms of use, which limit high-volume automated querying and typically forbid using the data for unsolicited marketing or spam. The output is for information only, such as checking a domain's status, expiry date or registrar; using it within those terms is up to you. The Actor keeps to a modest pace (a few lookups in parallel, one request at a time per registry) and slows down whenever a registry answers with a rate limit. ### 🔗 More scrapers by Anyx - [Web Content Scraper](https://apify.com/anyxsolutions/web-content-scraper) - [Google Maps Email & Contact Extractor](https://apify.com/anyxsolutions/google-maps-email-extractor) - [Yellow Pages Scraper](https://apify.com/anyxsolutions/yellowpages-scraper) - [Google Search Scraper](https://apify.com/anyxsolutions/google-search-scraper) ### 🤝 Anyx Solutions We build custom scrapers and data-extraction pipelines. - Email: tantosthor@gmail.com ### 🖼 Image credit Image credit: [iana.org](https://www.iana.org/) # Actor input Schema ## `startUrls` (type: `array`): Any website URL, such as https://apify.com/store; its registrable domain (apify.com) is looked up. RDAP links (https://rdap.org/domain/apify.com) and ICANN Lookup links work too. ## `domains` (type: `array`): Domains to look up, one per line, for example wikipedia.org or bbc.co.uk. Subdomains (shop.example.co.uk), URLs and email addresses (info@example.com) are reduced to their registrable domain. ## `ips` (type: `array`): IPv4 or IPv6 addresses or networks to look up, one per line, for example 8.8.8.8, 2001:4860:4860::8888 or 193.0.0.0/21. ## `asns` (type: `array`): Autonomous system numbers to look up, one per line, for example AS13335 or 15169. ## `includeRegistrarData` (type: `boolean`): For .com, .net and other registries that keep no owner data, also ask the sponsoring registrar for the registrant, admin and technical contacts. One extra request per domain. ## `maxItems` (type: `integer`): Maximum number of lookups (dataset rows) for the whole run. Leave empty to look up every value. ## `proxyConfiguration` (type: `object`): Proxy settings for RDAP requests. Registries are public and need no proxy; the Actor keeps to their rate limits. ## Actor input object example ```json { "startUrls": [ { "url": "https://apify.com/store" } ], "domains": [ "wikipedia.org", "europa.eu" ], "ips": [ "8.8.8.8" ], "asns": [ "AS13335" ], "includeRegistrarData": true, "maxItems": 5, "proxyConfiguration": { "useApifyProxy": false } } ``` # Actor output Schema ## `overview` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "startUrls": [ { "url": "https://apify.com/store" } ], "domains": [ "wikipedia.org", "europa.eu" ], "ips": [ "8.8.8.8" ], "asns": [ "AS13335" ], "maxItems": 5 }; // Run the Actor and wait for it to finish const run = await client.actor("anyxsolutions/whois-scraper").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "startUrls": [{ "url": "https://apify.com/store" }], "domains": [ "wikipedia.org", "europa.eu", ], "ips": ["8.8.8.8"], "asns": ["AS13335"], "maxItems": 5, } # Run the Actor and wait for it to finish run = client.actor("anyxsolutions/whois-scraper").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}") for item in client.dataset(run.default_dataset_id).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "startUrls": [ { "url": "https://apify.com/store" } ], "domains": [ "wikipedia.org", "europa.eu" ], "ips": [ "8.8.8.8" ], "asns": [ "AS13335" ], "maxItems": 5 }' | apify call anyxsolutions/whois-scraper --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "type": "http", "url": "https://mcp.apify.com/?tools=fetch-actor-details,anyxsolutions/whois-scraper" } } } ``` The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer ` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations). ## OpenAPI specification Download the OpenAPI definition: https://api.apify.com/v2/actors/7vf6A85cnie1jpAhy/builds/1sbW1PHXukOT94Bz4/openapi.json