Provide current and historical ownership information on domains / IPs. Identify all connections between domains, registrants, registrars, and DNS servers.
Look into all current and historical DNS / IP connections between domains and A, MX, NS, and other records. Monitor suspicious changes to DNS records.
Get detailed context on an IP address, including its user’s geolocation, time zone, connected domains, connection type, IP range, ASN,
and other network ownership details.
Access our web-based solution to dig into
and monitor all domain events of interest.
Get access to a web-based enterprise-grade solution to search and monitor domain registrations and ownership details for branded terms, fuzzy matches, registrants of interest, and more.
New gTLD Intelligence Services (NGIS)
Independent, evidence-based DNS and abuse intelligence for applicants, advisors, governments, and counsel participating in the ICANN 2026 New gTLD Program.
Predictive Threat Intelligence Feeds
Detect and block access to and from dangerous domain names before malicious actors can weaponize them. Contact us today for more information.
Unlock integrated intelligence on Internet properties and their ownership, infrastructure, and other attributes.
Our complete set of domain, IP, and DNS intelligence available via API calls as an annual subscription with predictable pricing.
Security Intelligence (SI) Suite
Offers complete access to WHOIS, IP, DNS, and subdomain data for product enrichment, threat hunting and more.
Uncover entire attack surfaces with this API to embed asset discovery, vulnerability scanning, and technology metadata into your platform. Now in early access.
Talk to our APIs using LLMs. Connect your preferred LLM to WhoisXML API and simply chat about WHOIS, DNS, threat intelligence, and more.
I’m your Domain Intelligence Assistant. I make it easy to explore WHOIS, DNS, and threat data from WhoisXML API — I’m cloud-based, fast, and always ready to help.
WhoisXML API Domain Intelligence Advisor (via ChatGPT)
A custom GPT for WHOIS, DNS, IP, and threat intelligence research. Connects ChatGPT directly to WhoisXML API to enable fast, conversational investigations and domain insights.
WhoisXML API is pleased to announce the addition of support for two-factor authentication (2FA) — an important new security upgrade for user accounts.
Representatives from WhoisXML API joined hundreds of cybersecurity professionals and enthusiasts at the BSides Chicago 2025 conference, held at the Hilton Chicago from October 31 to November 1, 2025.
The WhoisXML API team, including Tara Conneally (Enterprise Partnership Development III), Hanna Frank (Technical Account Executive), and Michael Kaparos (DevSecOps & Threat Researcher), was on site. We participated with a booth alongside vendors from across the cybersecurity community, such as Aikido, Bitwarden, GitGuardian, Guidepoint Security, Push Security, and SecurityScorecard.
Can you quickly spot the difference between these two domains: whoisxmlapi[.]com and whoisxrnlapi[.]com? Took you a few seconds, didn’t it? Your eyes can deceive you, and that’s exactly what threat actors hope for when they use lookalike domains.
Lookalike domains are one of the most effective tools cybercriminals use in modern cyberattacks, tricking people into thinking that they are visiting a legit website or receiving an official business email.
In this post, we explore what lookalike domains are, how dangerous they can be, and how organizations can detect and protect against them.
Your domain name is one of the most valuable digital assets you own. It is your address and a central hub for your business, and because of this, your domain name is a prime target for opportunistic scammers.
It’s not just about stealing a domain name from you — there are other types of domain name scams. In this post, we discuss some of the most pervasive domain name scams, detailing how each of them works and the steps you can take to avoid falling victim to them.
WhoisXML API analyzed 9.6+ million domains registered between 1 and 31 October 2025 to identify the most popular registrars, top-level domain (TLD) extensions, and other global domain registration trends.
We also determined the top TLD extensions used by 38.7+ billion domains from our DNS database’s A record full file dated 4 October 2025.
Next, we studied the top TLDs of 1.1+ million domains detected as indicators of compromise (IoCs) this month.
Finally, we summed up our findings and provided links to the threat reports produced using DNS and domain intelligence sources during the period.
WhoisXML API analyzed 8.7+ million domains registered between 1 and 30 September 2025 to identify the most popular registrars, top-level domain (TLD) extensions, and other global domain registration trends.
We also determined the top TLD extensions used by 42.1+ billion domains from our DNS database’s A record full file dated 4 September 2025.
Next, we studied the top TLDs of 1.0+ million domains detected as indicators of compromise (IoCs) this month.
Finally, we summed up our findings and provided links to the threat reports produced using DNS and domain intelligence sources during the period.
WhoisXML API is proud to announce that the false positive rate of its First Watch Malicious Domains Data Feed went down from 3% to 1.66%. This significant reduction in false alarms translates directly into a more efficient, reliable, and trustworthy predictive threat intelligence solution for users, allowing them to block upcoming threats with higher confidence and fewer interruptions.
WhoisXML API announces the launch of the Domain Info API, a new cyber intelligence solution designed to deliver a single, enriched WHOIS record for any active or expired domain name by leveraging WhoisXML API’s massive historical WHOIS database. The Domain Info API automatically fills in WHOIS fields that are redacted or missing for any domain name, using the latest available historical data.
We are here to listen. For a quick response, please select your request type. By submitting a request, you agree to our Terms of Service and Privacy Policy.
