RDAP
RDAP (Registration Data Access Protocol) is the JSON successor of WHOIS that returns a domain's registrar, dates, status and abuse contact.
How it works
Each registry and registrar runs an RDAP server; bootstrap files tell clients which server is authoritative for a TLD. Responses are structured, so tools can read registrar IDs and abuse e-mail addresses reliably.
For phishing response, RDAP gives the registration date (new domains are riskier) and where to send the abuse report.
Example from the PhishDestroy database
- genesis-variational.com: Domain report with RDAP registration evidence, first detected 2026-10-21.
- exodusprotect.com: Domain report with RDAP registration evidence, first detected 2026-10-21.
- reward-kinetiqfnd.xyz: Domain report with RDAP registration evidence, first detected 2026-10-21.
How to protect yourself
- Look up the registrar's abuse contact through RDAP before reporting a domain.
- Treat domains registered in the last few days as higher risk.