RDAP
Structured replacement for WHOIS: JSON over HTTPS describing who registered an IP block.
RDAP (Registration Data Access Protocol) returns registration data as JSON over HTTPS, replacing free-form WHOIS output. Each regional internet registry exposes an endpoint.
Useful fields: the network handle and name, the exact address range, the registered country, and timestamps. A block registered to a hosting provider is a strong signal before any heuristic runs.
Rate limits are strict; cache responses and treat RDAP as a verification layer, not a verdict.
Related: Residential IP · Native IP · Dual ISP · CGNAT · ASN · BGP · RPKI · Anycast