WHOIS vs RDAP for Domain and IP Investigation
WHOIS remains common for domain registration records, while RDAP gives you structured registry ownership data that often fits IP and ASN investigation better.
ComUtil 的域名查询返回 WHOIS 和 SSL 记录，IP 查询返回 RDAP 注册数据并以 WHOIS 作为回退。不支持完整的域名 RDAP。
Use this page when
你手上有主机名或 IP，需要知道哪种查询能回答你的问题。
ComUtil boundary
Use the live domain workflow for registrar, nameserver, and certificate facts. Use the live IP workflow for ASN, registry, and network-range context.
护栏
两种协议都不会告诉你域名或地址是否为恶意。它们只返回注册信息。
Start from a suspicious login domain
几天前才注册、且证书在同一天签发的域名值得进一步查看。
1. Check a domain
2. Review registrar, expiration, and nameservers
3. Compare certificate timing before you pivot to IP ownership
Start from a source IP or ASN question
如果地址归属的是托管服务商而非你预期的 ISP，这条流量的含义就不一样了。
1. Lookup an IP
2. Compare registry, ASN owner, and network range
3. Escalate with those ownership facts
Use both when the investigation pivots
A domain can lead you into IP ownership, but the two jobs still answer different questions.
Domain facts -> WHOIS/SSL workflow
Infrastructure ownership -> IP workflow
Range scope -> CIDR guide if the question expands
WHOIS 返回注册商、创建与到期日期、名称服务器，以及注册局公开时的注册人联系字段。
- Use the domain workflow when the investigation starts from a hostname, login URL, or registrable domain.
- 最近注册的域名和受隐私保护的注册人字段是值得留意的信号，而非结论。
RDAP 返回 JSON 而非自由格式文本，因此注册局、ASN 所有者和网络范围都能可靠解析。RDAP 不可用时，IP 工作流会回退到 WHOIS。
- Use the IP workflow when the question is who owns this address, which registry allocated it, and what network range it belongs to.
- Treat RDAP as ownership context, not as a maliciousness verdict or a replacement for deeper investigation.