RDAP Domain Lookup for Domain Research and Phishing Investigations
Use this RDAP domain lookup tool to review domain registration details, registrar information, nameservers, domain status, creation dates, expiration dates, and technical RDAP data. This tool can help with phishing investigations, suspicious domain reviews, and general domain research.
An RDAP domain lookup does not prove whether a website is malicious, but it can provide useful clues. Security analysts often compare RDAP results with DNS records, IP geolocation, redirect behavior, screenshots, and phishing scanner results before deciding whether a domain is suspicious.
You can also use other IT Knowledge Bases tools during an investigation, including the DNS Lookup Tool, IP Geolocation Tool, Microsoft Safe Links Decoder, and Phishing URL Scanner.
RDAP Domain Lookup Warning Signs
RDAP Domain Lookup Clues for Phishing Sites
When reviewing a suspicious domain, check the domain creation date, registrar, nameservers, domain status, and whether the domain name matches the organization it claims to represent.
- Recently registered domains: A domain created only days or weeks ago may be suspicious if it claims to represent a well-known company.
- Lookalike domains: Watch for swapped letters, extra words, hyphens, numbers, or fake brand names.
- Unexpected nameservers: Unfamiliar infrastructure may be worth reviewing when the domain claims to be tied to a major brand.
- Domain age mismatch: A new domain should not normally be trusted as the main login page for an established organization.
- Redacted contacts: Missing contact details are common in RDAP and do not automatically mean the domain is malicious.
What RDAP Domain Lookup Can Show
Domain Registration Details
- Domain registration date
- Domain expiration date
- Last updated date
- Registrar name
- Registry domain ID
- Nameserver records
- Domain status codes
- Technical RDAP response data
These details can help you compare the domain against the organization it claims to represent. Treat RDAP as one investigation signal, not the final answer.
RDAP Domain Lookup FAQ
What is RDAP?
RDAP stands for Registration Data Access Protocol. It is the modern replacement for traditional WHOIS lookup and provides structured domain registration data.
Is RDAP the same as WHOIS?
No. WHOIS is the older lookup system. RDAP is newer, structured, and easier for tools to process. Many users still search for WHOIS lookup, but RDAP is commonly used for modern domain registration lookup.
Can RDAP tell me who owns a domain?
Sometimes, but often not. Many domain owner, registrant, admin, and technical contact details are redacted for privacy. RDAP usually provides registrar, nameserver, status, registration date, expiration date, and technical data.
Can RDAP prove a website is phishing?
No. RDAP alone cannot prove that a website is phishing. A suspicious registration date, unusual nameservers, lookalike domain, or mismatched infrastructure can raise concern, but phishing decisions should be based on multiple indicators.
Should I click a suspicious link before checking RDAP?
No. Do not click suspicious links directly. Use RDAP lookup, DNS lookup, safe link decoding, screenshots, and phishing URL analysis before interacting with the site.
External RDAP and Phishing Resources
Official Domain and Phishing References
For additional research, review ICANN RDAP information, ICANN EPP domain status codes, and CISA phishing guidance.