Maltego: RDAP transforms

RDAP transforms surface DomainTools’ parsed RDAP dataset for a domain. RDAP is the modern, structured successor to WHOIS; fields come back as typed values rather than free-form record text.

All transforms in this set start from a Domain entity.

Note

The labels shown in this table are descriptive. The Maltego client’s context menu shows each transform’s display name (set by the Transform Hub listing), which may be lightly different; the underlying transform endpoint name is a third identifier and isn’t customer-facing. Match on a transform’s inputs, outputs, and description rather than on the label.

Transforms

Transform	Output	Description
Domain to Parsed RDAP	RDAP	Returns a parsed RDAP entity. The entity’s properties panel is populated with the RDAP handle, domain statuses, creation date, last-changed date, expiration date, and conformance fields.
Domain to RDAP Emails	Email Address	Returns email addresses from the parsed RDAP record.
Domain to RDAP Email Domains	Domain	Returns the apex domains of every email address in the parsed RDAP record.
Domain to RDAP Name Servers	NS Record	Returns the name servers listed in the parsed RDAP record.
Domain to RDAP Registrar	Registrar	Returns the registrar listed in the parsed RDAP record.

When to use RDAP transforms versus WHOIS

• RDAP gives you a consistently structured answer across registries that support it. Fields come back typed and labeled — useful when you want a reliable creation_date or expiration_date without parsing free-form record text.
• WHOIS (see WHOIS, History, and Reputation transforms) gives you the record as a registry or registrar actually emits it, which is still the richer source for many legacy TLDs and for historical lookups.

When both are available for a domain, use RDAP for current, parsed data, and WHOIS for raw record inspection or historical pivots.