Provide current and historical ownership information on domains / IPs. Identify all connections between domains, registrants, registrars, and DNS servers.
Look into all current and historical DNS / IP connections between domains and A, MX, NS, and other records. Monitor suspicious changes to DNS records.
Get detailed context on an IP address, including its user’s geolocation, time zone, connected domains, connection type, IP range, ASN, and other network ownership details.
Access our web-based solution to dig into and monitor all domain events of interest.
Get access to a web-based enterprise-grade solution to search and monitor domain registrations and ownership details for branded terms, fuzzy matches, registrants of interest, and more.
Detect and block access to and from dangerous domain names before malicious actors can weaponize them. Contact us today for more information.
Unlock integrated intelligence on Internet properties and their ownership, infrastructure, and other attributes.
Our complete set of domain, IP, and DNS intelligence available via API calls as an annual subscription with predictable pricing.
Offers complete access to WHOIS, IP, DNS, and subdomain data for product enrichment, threat hunting and more.
Enjoy priority data access with our premium API services topped with extra perks including dedicated team support, enterprise-grade infrastructure, and SLAs for full scalability and high performance.
The Who Behind Cyber Threat Intelligence
For over a decade, we have collected, aggregated, and delivered domain, IP, and DNS intelligence to make the Internet more transparent and secure. Our data feeds and APIs have proven invaluable in augmenting the capabilities of commercial security platforms (SIEM, SOAR, TIP, ASM) and supporting threat detection and response (TDR), third-party risk management (TPRM), identity access management (IAM), and other cybersecurity processes.
Law enforcement agencies, managed security service providers (MSSPs), and security operations centers (SOCs) benefit from our intelligence to defend against advanced persistent threats (APT), fight cybercrime, and achieve superior network visibility. Fortune 1000 companies and SMBs rely on our data to protect their digital assets, extend their brand protection efforts, detect phishing and fraud, and monitor the global domain activity landscape.
Join more than 50K satisfied customers
Get access to complete domain name footprints, which include ownership, timeline, updates, statuses, and other essential registration details for about every domain on the Internet.
Learn moreDive into the biggest passive DNS database comprising billions of historical DNS data points and relevant records for the vast majority of IP addresses and hosts.
Learn moreObtain precise geographical data down to the postal code with latitude and longitude coordinates, network information, timezone, connected domains, and more for deeper contextualization.
Learn moreAccess the most structured and detailed IP ranges correlated with ownership data, contacts, and network records from WHOIS, Regional Internet Registries (RIRs), and other sources.
Learn moreEnjoy complete control with convenient download formats for custom integrations, investigations, and data enrichment efforts in line with security policies.
We offer domain, DNS, and IP data in meaningful ways to developers with forward, reverse, and bulk APIs and code libraries for all major programming languages.
Our lookup and monitoring tools are easy to use with straightforward reports for domain names, IP addresses, email addresses, and other search terms of interest.
Identify daily clusters of new risky domain names as soon as they are registered to prevent phishing, typosquatting, malware, and C&C attacks with our collection of predictive intelligence sources.
Check the packageUnlock integrated intelligence on Internet properties and their ownership, infrastructure, and other attributes with our relevant collection of domain, DNS, IP, and other data sources.
Check the packageCommercial security platform providers such as Security Information and Event Management (SIEM), Security Orchestration, Automation and Response (SOAR), and Threat Intelligence Platforms (TIPs), use our intelligence to boost their capabilities and achieve better threat contextualization and prioritization.
Managed Security Service Providers (MSSPs) use our data as part of their correlation processes to deliver visibility into their clients’ networks and better detect, analyze, and deal with all types of security events, threats, and vulnerabilities.
Security Operations Centers (SOCs) benefit from the breadth and depth of our intelligence to enhance ongoing cybersecurity processes and strategies. Access to our extensive data footprints, APIs, and tools helps detect, categorize, and respond to incidents.
Law enforcement & digital forensics professionals retrieve insights from our intelligence repositories to kickstart and unlock investigations as well as to gather pieces of evidence. Indicators of compromises often include domain names, DNS records, and IP addresses.
A better understanding of current and historical footprints can be of great value to digital marketers, business development managers, researchers, and other specialists to level up their business intelligence and build commercial applications.
Brand managers and legal specialists use our footprints and monitoring tools to stay updated on typosquatting, cybersquatting abuses, trademark infringements, and other abuses and misrepresentations of their brands' domain names.
Internet surfaces continue to widen as interconnectivity grows and business operations expand and evolve. Attack surface management (ASM) solutions must adapt and continuously improve their asset discovery, scoring, monitoring, and prioritization capabilities, notably by accessing real-time and comprehensive Internet intelligence sources, including DNS, IP, and WHOIS data.
Learn moreEnterprises rely on managed security operations and platforms for round-the-clock protection against threat actors. Providing this service requires comprehensive and up-to-date visibility into the primary source of threats—the Internet. Historical and real-time access to Internet events, including DNS, WHOIS, and IP information, enables early threat detection and accurate contextualization.
Learn moreCyber threat intelligence is only as good as the data used to process it. Supplementing your current cyber threat intelligence stack with real-time and historical DNS, domain, WHOIS, IP, and other Internet-related data can enable critical security processes—from early and real-time threat detection, analysis, and expansion to threat disruption.
Learn morePolicing requires a balanced mix of technological advancement and intelligence-led initiatives. A unified view of the Internet can supplement existing law enforcement data sources and ensure that no stones are left unturned. DNS, WHOIS, and IP intelligence can provide clues that are otherwise hidden or overlooked, aiding law enforcers in their fight against cybercrime.
Learn moreAs digital transformation continues, organizations become exposed to a growing number of digital risks. Gaining access to Internet-wide intelligence, including DNS, IP, and domain data, can enhance enterprise protection against various digital risks, whether from third parties, internal vulnerabilities, supply chain channels, or other sources.
Learn moreWith half the world’s population and almost all organizations going online, the Internet is a valuable source of market data. DNS, IP, WHOIS, and other Internet data can provide much-needed insights that can help with market forecasting, competitive research and monitoring, business-to-business (B2B) targeting, service discovery, and other critical business processes.
Learn moreOur interconnected global ecosystem requires constant communication with potential and existing customers, vendors, suppliers, and several other parties. Not all of them can be trusted, hence the need for initial and continuous identity verification that can be enriched with real-time access to domain, IP, DNS, and other Internet-related data.
Learn more“The WhoisXML History API has been a game changer for our online investigations, trainings, and books. We have uncovered the true owners behind numerous malicious domains, even though they currently possess "private" Whois registration.”
“Whois XML is one of the most important tools we use for domain intelligence in the Bachelor's Degree program in Investigation and Security Sciences at the University of Perugia. In particular, we appreciate the reverse research from IP to Domain and Whois with query filters. The tool is comprehensive, providing detailed information such as phone numbers, names, and other details from Whois records. While many Whois records are now covered by privacy regulations, WhoisXML API provides access to all historical WHOIS records.”
“The website intelligence is easy to set up and returns everything we need. One reason for this is the documentation of the API, which is well-written and very detailed.”
“Thanks to well-structured and clear API documentation provided by WhoisXML API, we were able to integrate the solution seamlessly into our system with minimal technical challenges.”
“WhoisXML was the game changer for us. It has revolutionized our ability to disrupt cybercrime in process and at scale by quickly identifying all of the vendors providing material support for scammers using sophisticated website templates that look legitimate. By quickly identifying the vendors unknowingly supporting the criminals, we can provide them with public interest justification to burn down the criminal infrastructure.”
“After thorough testing, we were thrilled to find that Premium DNS 365 consistently identified 10 times more 'active' subdomains compared to other options in the market.”
“The consistent and structured data provided by WhoisXML API made it possible to group and identify who is behind suspected fraudulent websites, being able to search by phone number, address or e-mail address used in the domain registration.”
“I appreciate your products that are useful for checking domain expiration dates.”
“Mozello offers built-in domain registration services to our customers, and we needed an easy-to-implement domain availability checking solution that covers all possible domain names, including exotic ones. WhoisXML API provides right what we need at a reasonable cost and with zero maintenance, plus it is very easy to implement.”
“WhoisXML API is a responsive and reliable provider of domain intelligence. Whenever there are issues, they are quick to respond and resolve them. Working with them is smooth and straightforward.”
“WhoisXML API’s domain intelligence allows us to quickly integrate WHOIS lookups into our security heuristics and algorithms without having to worry about hosting services, staging and merging data, and the complicated task of normalization.”
“Keeping track of new domain registration activity is essential in today's digital economy. We look forward to continuing our collaboration with WhoisXML API to help customer leverage critical domain insights in a secure cloud environment that aligns with their data privacy and governance requirements.”
“WhoisXML API data helps us make informed and automated decisions, filtering invalid email addresses much faster.”
“We needed a simple way of verifying the integrity of user-entered email addresses, and discovered WhoisXML API - it is great value and was really easy to integrate with our systems. Excellent customer service when required, too.”
“WhoisXML API is amazing for checking out the historic registration information of a domain, pivoting to locate the alternate registrations with the same details and also my cyber investigations. The data proved very useful when investigating pig butchering scams and domains that host child abuse material.”
“DRS is a Great product, easy to use and everything I need in one place.”
“Very useful for investigations, we can go back in history and see when domains were registered and who owned them at a certain time.”
“WhoisXML API builds out data sets that help users correlate attack infrastructure with related IP and WHOIS information.”
We are here to listen. For a quick response, please select your request type. By submitting a request, you agree to our Terms of Service and Privacy Policy.
