Domain registration information should be transparent

Domain registration information should be transparent | Artem Golubin

The single best signal for identifying a phishing domain is the domain registration date, and yet domain registrars still limit access to such data.

For certificates, we have Certificate Transparency Logs where every issued TLS certificate is publicly visible within seconds of issuance.

For domains, we used to use WHOIS protocol, which returned plaintext data:

It was pretty hard to deal with, because every domain zone used its own format that was hard to parse.

In the last five years, a new RDAP protocol has grown in popularity. Instead of plaintext, it now outputs JSON data.

It became a mandatory protocol in 2025 and more than 1440 TLDs (domain zones) support it now. Despite the new protocol, the problem persists - registrars are still rate limiting access.

Historically, access to such data was limited due to the scraping of contact information. But as of 2026, almost everyone hides their contact information and can do so for free.

The shadiest domain zones are often rate-limited. One of the ways to prevent phishing at large companies, is to block access to newly registered domains. To do so, you need to check each domain through RDAP protocol, and if you check hundreds of domains in a particular zone, your IP might get blocked. It's easy to hit the limits when your e-mail server is getting thousands of spam e-mails per day.

The usual workaround is to buy registration data from third parties. These companies use proxies to scrape it, which doesn't reduce the load that much as it shifts it. Instead of checking only particular domains, third parties often have to obtain information for all the domain names. Also, the data won't be available in real time: domains registered minutes or hours ago won't appear until the next batch update.

One of the counterarguments is that making it very accessible incurs a lot of incoming requests. The reference implementation of RDAP protocol by ICANN can handle tens of thousands of requests per second since it keeps all domain information in RAM.

The .com, .net, .org domains are not rate-limited because of this, while the cheapest domain zones that are often abused by malicious actors only allow a few requests per minute and may block your IP forever (e.g., .shop, .top):

"errorCode": 429, "title": "Forbidden request", "description": [ "Your access is too fast,please try again later."

There are tens of thousands of phishing domains registered each quarter in these cheap zones:

Source: Cybercrime Information Center

It's time to make registration dates accessible for safer internet! The registration date is also useful for finding clusters of domains registered by the same malicious actor, since they are often registered in bulk and RDAP protocol provides exact timestamps including seconds.

If you have any questions, feel free to ask them via e-mail displayed in the footer.

All articles on this website are written by a human.

Domain registration information should be transparent

Related Articles

(no title)

Scientists reverse brain aging, with a nasal spray

AI has torched the market for junior programmers

Al Vigier: Canada's AI strategy shouldn't include secret Palantir bills

The Anatomy of an AI-Native Org