Domain WHOIS Intelligence — RDAP, Age & Risk (AI)

Every domain tells a story — this Actor reads it. Hand it a list of domains (or URLs, or emails) and it pulls each domain's modern WHOIS record over RDAP — the registrar, when it was created, when it expires, how old it is, its status flags, nameservers and DNSSEC — resolves live DNS (A / MX / NS + mail provider), and finishes with an AI trust/risk read: is this domain established, or newly registered and privacy-masked?

You bring the domains. It hands back a registration dossier with a risk flag on top.

---

The flow

domain / URL / email
                │
        ┌───────┴────────┐
        ▼                ▼
   RDAP (WHOIS)      DNS (node:dns)
  registrar · dates   A · MX · NS ·
  status · NS ·       mail provider
  DNSSEC · registrant
        └───────┬────────┘
                ▼
         AI trust read
   trustSignal · riskFlags ·
       2-sentence summary

1. RDAP lookup via rdap.org — a bootstrap that redirects to the authoritative registry's RDAP server and returns structured JSON (the modern, machine-readable successor to port-43 WHOIS).
2. DNS resolution (optional, on by default) — A, MX and NS records, plus a best-effort mail provider guess from the MX hosts.
3. AI trust read — OpenAI reads only the facts above and returns a trust signal, risk flags and a short, hedged summary meant for human review.

---

What you get per domain

1. registrar — the registrar of record (e.g. "MarkMonitor Inc.").
2. createdDate · expiryDate · lastChanged — registration lifecycle dates (ISO).
3. domainAgeDays · daysUntilExpiry — how old the domain is, and how long until it lapses.
4. isNewlyRegistered (< 90 days) · isExpiringSoon (< 30 days) — the two flags fraud and ops teams care about most.
5. statuses — EPP status codes (clientTransferProhibited, serverHold, …).
6. nameservers · dnssec — delegation and whether the zone is DNSSEC-signed.
7. registrantOrg · privacyMasked — the registrant org when published, or a flag that it's redacted / behind a privacy service.
8. dns — { a, mx, mailProvider, ns } from live DNS (when enabled).

Then the AI layer (OpenAI gpt-4o-mini, fast and low-cost) adds:

• trustSignal — established · normal · caution · high-risk.
• riskFlags — short phrases such as "newly registered", "expiring soon", "privacy-masked registrant", "no DNSSEC", "suspicious registrar/TLD".
• aiSummary — two sentences, written as a signal for review, not a verdict.

---

Three ways people use it

• Fraud & trust checks — vet a domain before you pay an invoice, approve a vendor, or trust a link. A WHOIS API that surfaces domain age and newly registered domains instantly — the single strongest fraud signal there is.
• B2B lead enrichment — enrich a list of prospect domains with registrar, age, mail provider and DNS, and filter out parked or expiring domains before they hit your CRM.
• Security & phishing triage — score inbound domains with a fast RDAP lookup and domain risk read: fresh registration + privacy mask + no DNSSEC is the classic phishing fingerprint. Feed it straight into your SOC workflow.

Keywords this Actor is built for: WHOIS API, RDAP lookup, domain age, domain risk, newly registered domains, DNS lookup, registrar lookup, domain expiry check.

---

Input

Field	Type	Notes
domains	array	Required. Domains, website URLs or emails — the bare domain is extracted. One per line.
includeDns	boolean	Resolve A / MX / NS and guess the mail provider. Default true.
maxResults	integer	Cap how many domains to look up. Default 200.
maxConcurrency	integer	Domains processed in parallel. Default 8.
model	string	Override the OpenAI model. Default gpt-4o-mini.

Minimal input example

{
  "domains": ["stripe.com", "example.com"]
}

---

Output example

{
  "domain": "stripe.com",
  "registrar": "MarkMonitor Inc.",
  "createdDate": "2008-09-05T00:00:00.000Z",
  "expiryDate": "2026-09-05T00:00:00.000Z",
  "lastChanged": "2024-08-02T00:00:00.000Z",
  "domainAgeDays": 6609,
  "daysUntilExpiry": 331,
  "isNewlyRegistered": false,
  "isExpiringSoon": false,
  "statuses": ["clientTransferProhibited", "clientUpdateProhibited"],
  "nameservers": ["ns-cloud-e1.googledomains.com", "ns-cloud-e2.googledomains.com"],
  "dnssec": false,
  "registrantOrg": null,
  "privacyMasked": true,
  "dns": {
    "a": ["34.98.71.47"],
    "mx": ["aspmx.l.google.com"],
    "mailProvider": "Google Workspace",
    "ns": ["ns-cloud-e1.googledomains.com"]
  },
  "trustSignal": "established",
  "riskFlags": ["privacy-masked registrant"],
  "aiSummary": "This domain has been registered since 2008 with a major corporate registrar and transfer locks in place, consistent with a long-established, legitimate business. The registrant is privacy-masked, which is routine for large organisations and not itself a concern."
}

A domain that isn't found in RDAP (unregistered, or a TLD without RDAP) comes back with an error field and is not charged.

---

Pay-per-event pricing

This Actor uses pay-per-event billing with a single event:

Event	Price	Charged when
domain-checked	$0.10	Once per domain successfully looked up via RDAP/WHOIS and DNS, with an AI trust/risk read.

The Actor logs its OpenAI token usage and the estimated AI cost per domain at the end of every run, so the event price always stays safely above the model cost.

---

Data source

Registration data comes from RDAP (Registration Data Access Protocol) — the modern, JSON-based WHOIS mandated by ICANN and served directly by the authoritative registry and registrar systems. It is official, structured, free registry data; there is no scraping of any port-43 WHOIS mirror. DNS is resolved live via the standard resolver.

---

Setup

The trust read calls the OpenAI API. Set the environment variable / secret OPENAI_API_KEY on the Actor. The lookup itself runs without it — you still get full RDAP + DNS data; only trustSignal, riskFlags and aiSummary are left empty.

---

Use it from an AI agent (Apify MCP server)

This Actor is available through the Apify MCP server, so AI agents (Claude, ChatGPT, or anything that speaks MCP) can call it as a tool — hand it a list of domains and read back the registration, DNS and trust data — with no custom integration code.

---

Run it locally

npm install
# put your input in storage/key_value_stores/default/INPUT.json
export OPENAI_API_KEY=sk-...   # optional, enables the AI trust read
apify run -p

---

Related actors

• B2B Tech Stack Detector — Detect the technologies, frameworks and mail provider behind any domain.
• B2B Email Verifier — Verify deliverability of email addresses with MX and SMTP checks.
• AI Company Enrichment — Turn domains into structured firmographic company profiles with AI.
• CVE Vulnerability Lookup — Look up CVE vulnerabilities with severity, scores and affected products.

---

Part of the No Niner toolkit — no-code web scraping, enrichment & AI data tools, all pay-per-use. Browse the full set at noniner.io.