RDAP Scraper — Domain, IP, ASN & Entity Lookup (Modern WHOIS)

Look up registration data for any domain, IP address, autonomous system number (ASN), registry entity, or nameserver using RDAP — the IETF-standard, JSON-based successor to WHOIS. Unlike free-text WHOIS, RDAP returns clean, structured, machine-readable data: registrar names, nameservers, DNSSEC status, registration and expiry dates, IP allocation ranges, CIDR blocks, and abuse contacts. This actor queries rdap.org, which bootstraps every request to the authoritative registry (IANA, the Regional Internet Registries such as ARIN/RIPE/APNIC, and the domain registries), so you always get first-party data straight from the source. HTTP-only — no API key, no login, no cookies, no proxy.

What this actor does

• Five lookup modes: domain, ip, autnum (ASN), entity, nameserver
• Single or batch lookups — pass one value, or a list of up to 50 domains / IPs / ASNs / entity handles / nameserver hosts per run; each is looked up independently
• Authoritative data — every query is routed to the real registry via the RDAP bootstrap, not a cached mirror
• Internationalized domains (IDN) — enter Unicode domains like bücher.com; they're converted to punycode automatically
• Empty fields are omitted

Output per record type

Each run pushes one record per successfully looked-up value, plus one typed error record per invalid or not-found value. A single-value input produces one record; a batch input (domains, ipAddresses, asns, or entityHandles) produces up to one record per list entry.

• recordType — domain, ip, autnum, entity, nameserver, or error
• objectClassName — RDAP object class as reported by the registry
• handle — registry-assigned handle for the object
• ldhName / unicodeName — LDH (ASCII) and Unicode forms of the domain (domain, nameserver)
• status — list of EPP / registry status codes
• registrationDate / expirationDate / lastChangedDate — key registration lifecycle dates (ISO 8601)
• lastUpdateOfRdapDatabase — when the registry last refreshed its RDAP data
• nameservers — list of authoritative nameserver host names (domain)
• secureDNS — DNSSEC delegation status and DS records (domain)
• registrarName / registrarIanaId — sponsoring registrar and its IANA ID (domain)
• name / type — network / AS name and allocation type (ip, autnum)
• startAddress / endAddress / cidr — address range and CIDR block(s) (ip)
• ipVersion — v4 or v6 (ip)
• startAutnum / endAutnum — AS number range (autnum)
• country — two-letter country code, when provided (ip, autnum)
• registrantName — resource holder organization (ip, autnum)
• abuseEmail — abuse-role contact email (domain, ip, autnum)
• org / email / tel / kind / roles — contact identity parsed from the vCard (entity)
• entities — flattened list of associated contacts {name, org, roles, email} (domain, ip, autnum, entity, nameserver)
• ipv4 / ipv6 — glue IP addresses the nameserver advertises (nameserver)
• sourceUrl — canonical RDAP URL of the authoritative record
• scrapedAt — UTC timestamp of the lookup

Error records (recordType: "error") additionally carry error (one of invalid_domain, invalid_ip, invalid_asn, invalid_nameserver, not_found), message, and input.

Domain record example

{
  "recordType": "domain",
  "objectClassName": "domain",
  "handle": "2138514_DOMAIN_COM-VRSN",
  "ldhName": "GOOGLE.COM",
  "status": ["client delete prohibited", "client transfer prohibited"],
  "registrationDate": "1997-09-15T04:00:00Z",
  "expirationDate": "2028-09-14T04:00:00Z",
  "lastChangedDate": "2019-09-09T15:39:04Z",
  "nameservers": ["NS1.GOOGLE.COM", "NS2.GOOGLE.COM", "NS3.GOOGLE.COM", "NS4.GOOGLE.COM"],
  "secureDNS": { "delegationSigned": false },
  "registrarName": "MarkMonitor Inc.",
  "registrarIanaId": "292",
  "abuseEmail": "abusecomplaints@markmonitor.com",
  "entities": [{ "handle": "292", "name": "MarkMonitor Inc.", "roles": ["registrar"] }],
  "sourceUrl": "https://rdap.verisign.com/com/v1/domain/GOOGLE.COM",
  "scrapedAt": "2026-07-02T09:09:27+00:00"
}

IP record example

{
  "recordType": "ip",
  "objectClassName": "ip network",
  "handle": "NET-8-8-8-0-2",
  "name": "GOGL",
  "type": "DIRECT ALLOCATION",
  "ipVersion": "v4",
  "startAddress": "8.8.8.0",
  "endAddress": "8.8.8.255",
  "cidr": ["8.8.8.0/24"],
  "status": ["active"],
  "registrantName": "Google LLC",
  "abuseEmail": "network-abuse@google.com",
  "sourceUrl": "https://rdap.arin.net/registry/ip/8.8.8.0",
  "scrapedAt": "2026-07-02T09:09:27+00:00"
}

ASN record example

{
  "recordType": "autnum",
  "objectClassName": "autnum",
  "handle": "AS15169",
  "name": "GOOGLE",
  "type": "DIRECT ALLOCATION",
  "startAutnum": 15169,
  "endAutnum": 15169,
  "status": ["active"],
  "registrantName": "Google LLC",
  "country": "US",
  "abuseEmail": "network-abuse@google.com",
  "sourceUrl": "https://rdap.arin.net/registry/autnum/15169",
  "scrapedAt": "2026-07-02T09:09:27+00:00"
}

Entity record example

{
  "recordType": "entity",
  "objectClassName": "entity",
  "handle": "ZG39-ARIN",
  "org": "Google LLC",
  "email": "arin-contact@google.com",
  "roles": ["administrative", "technical"],
  "sourceUrl": "https://rdap.arin.net/registry/entity/ZG39-ARIN",
  "scrapedAt": "2026-07-02T09:09:27+00:00"
}

Nameserver record example

{
  "recordType": "nameserver",
  "objectClassName": "nameserver",
  "ldhName": "NS1.GOOGLE.COM",
  "ipv4": ["216.239.32.10"],
  "ipv6": ["2001:4860:4802:32::a"],
  "lastUpdateOfRdapDatabase": "2026-08-17T11:55:27Z",
  "sourceUrl": "https://rdap.verisign.com/com/v1/nameserver/ns1.google.com",
  "scrapedAt": "2026-08-17T11:55:27+00:00"
}

Error record example

{
  "recordType": "error",
  "error": "invalid_domain",
  "message": "'not a domain' is not a valid domain name.",
  "input": "not a domain",
  "sourceUrl": "https://rdap.org/domain/",
  "scrapedAt": "2026-07-02T09:09:27+00:00"
}

Input

Field	Type	Default	Description
mode	string	domain	domain / ip / autnum / entity / nameserver
domain	string	google.com	Registrable domain name, IDN accepted (mode=domain, required unless domains is set)
domains	array	–	Batch of up to 50 domain names; takes precedence over domain (mode=domain)
ipAddress	string	8.8.8.8	Single IPv4 or IPv6 address (mode=ip, required unless ipAddresses is set)
ipAddresses	array	–	Batch of up to 50 IPv4/IPv6 addresses; takes precedence over ipAddress (mode=ip)
asn	string	AS15169	AS number, with or without the AS prefix (mode=autnum, required unless asns is set)
asns	array	–	Batch of up to 50 AS numbers; takes precedence over asn (mode=autnum)
entityHandle	string	ZG39-ARIN	Registry entity handle including its registry tag (mode=entity, required unless entityHandles is set)
entityHandles	array	–	Batch of up to 50 registry entity handles; takes precedence over entityHandle (mode=entity)
nameserverHost	string	ns1.google.com	Single nameserver host name, IDN accepted (mode=nameserver, required unless nameserverHosts is set)
nameserverHosts	array	–	Batch of up to 50 nameserver host names; takes precedence over nameserverHost (mode=nameserver)

Example: domain lookup

{
  "mode": "domain",
  "domain": "google.com"
}

Example: batch domain lookup

{
  "mode": "domain",
  "domains": ["google.com", "github.com", "wikipedia.org"]
}

Example: IP address lookup

{
  "mode": "ip",
  "ipAddress": "8.8.8.8"
}

Example: ASN lookup

{
  "mode": "autnum",
  "asn": "AS15169"
}

Example: entity lookup

{
  "mode": "entity",
  "entityHandle": "ZG39-ARIN"
}

Example: nameserver lookup

{
  "mode": "nameserver",
  "nameserverHost": "ns1.google.com"
}

Use cases

• Domain due diligence — confirm a domain's registrar, creation/expiry dates, and DNSSEC before a purchase or partnership
• Brand & fraud protection — check registration data of look-alike or newly registered domains
• Network / abuse operations — resolve the holder and abuse contact behind an IP address or ASN
• Threat intelligence — enrich indicators (domains, IPs, ASNs) with authoritative registration metadata
• Asset inventory — track expiry dates and nameserver configuration across a domain portfolio
• Research & OSINT — map IP allocations and autonomous systems to their owning organizations

FAQ

What is RDAP and how is it different from WHOIS? RDAP is the IETF-standard successor to WHOIS. WHOIS returns unstructured text that differs from registry to registry; RDAP returns standardized JSON with consistent fields, internationalization support, and clear object classes for domains, IPs, ASNs, and entities.

Do I need an API key, account, or proxy? No. RDAP is a public protocol and this actor talks to the authoritative registries directly. There are no credentials, cookies, or proxy requirements.

Which TLDs and registries are supported? All TLDs and RIRs that publish an RDAP service (which is now the vast majority, including all gTLDs and the five RIRs — ARIN, RIPE, APNIC, LACNIC, AFRINIC). A small number of ccTLDs do not yet operate an RDAP server; those return a not_found error record.

Can I look up internationalized (non-ASCII) domains? Yes. Enter the Unicode form (e.g. bücher.com) and the actor converts each label to its punycode xn-- form before querying.

Why did my entity lookup return not_found? Entity handles must include their registry tag (for example ZG39-ARIN). The RDAP bootstrap uses that tag to route the request; an untagged handle cannot be resolved.

Is contact data like registrant name and address available for domains? For domains, most registries redact personal registrant details under ICANN's temporary specification / GDPR, so typically only the registrar and abuse contact are available. IP and ASN records generally expose the holder organization and abuse contact in full.

Can I search for domains/entities by keyword instead of exact match? No. RDAP search is defined per-registry, not by the public bootstrap this actor uses, so only exact-identifier lookups (domain name, IP, ASN, entity handle, nameserver host) are supported.

How many records does one run return? A single-value input (domain, ipAddress, asn, entityHandle, or nameserverHost) returns one record (or one typed error record). To look up many objects in one run, use the matching batch field (domains, ipAddresses, asns, entityHandles, or nameserverHosts) with up to 50 values — each is queried independently, so one bad value never aborts the rest of the batch.

Are duplicate values in a batch list deduplicated? Yes. Duplicate entries (case-insensitive) in domains / ipAddresses / asns / entityHandles / nameserverHosts are deduplicated before lookup, so you never get two records for the same object.

Why are notices and remarks fields not included in the output? notices is generic registry Terms-of-Service boilerplate identical across every response from that registry, not object-specific registration data. remarks is inconsistently populated across registries with non-standardized free text and duplicates the structured abuseEmail field. Both are intentionally excluded so every field this actor emits is object-specific, structured data.

Is this actor affiliated with any registry or ICANN? No. This is a third-party actor that queries the public RDAP bootstrap and authoritative registries; it is not affiliated with ICANN, IANA, or any registrar/registry.