WHOIS vs RDAP for Domain and IP Investigation
WHOIS remains common for domain registration records, while RDAP gives you structured registry ownership data that often fits IP and ASN investigation better.
ComUtil's domain lookup returns WHOIS and SSL records. Its IP lookup returns RDAP registry data with WHOIS fallback. Full-domain RDAP is not covered.
Use this page when
You have a hostname or an IP in hand and need to know which lookup answers your question.
ComUtil boundary
Use the live domain workflow for registrar, nameserver, and certificate facts. Use the live IP workflow for ASN, registry, and network-range context.
Guardrail
Neither protocol tells you whether a domain or address is malicious. Both return registration facts only.
Start from a suspicious login domain
A domain registered days ago with a certificate issued the same day is worth a closer look.
1. Check a domain
2. Review registrar, expiration, and nameservers
3. Compare certificate timing before you pivot to IP ownership
Start from a source IP or ASN question
An address that resolves to a hosting provider rather than the ISP you expected changes what the traffic means.
1. Lookup an IP
2. Compare registry, ASN owner, and network range
3. Escalate with those ownership facts
Use both when the investigation pivots
A domain can lead you into IP ownership, but the two jobs still answer different questions.
Domain facts -> WHOIS/SSL workflow
Infrastructure ownership -> IP workflow
Range scope -> CIDR guide if the question expands
WHOIS returns the registrar, creation and expiration dates, nameservers, and registrant contact fields where the registry publishes them.
- Use the domain workflow when the investigation starts from a hostname, login URL, or registrable domain.
- Recently registered domains and privacy-protected registrant fields are signals worth noting, not verdicts.
RDAP returns JSON instead of free-form text, so registry, ASN owner, and network range parse reliably. The IP workflow falls back to WHOIS when RDAP is unavailable.
- Use the IP workflow when the question is who owns this address, which registry allocated it, and what network range it belongs to.
- Treat RDAP as ownership context, not as a maliciousness verdict or a replacement for deeper investigation.