Provide current and historical ownership information on domains / IPs. Identify all connections between domains, registrants, registrars, and DNS servers.
Attack Surface Discovery API
Uncover entire attack surfaces with this API, enabling asset discovery, vulnerability scanning, and technology metadata collection within your platform.
Have questions?
50 Billion+
Domains and subdomains
15+ years
Of historical data
7,596+
TLDs & ccTLDs tracked
60%+
Cyber 150 in key categories trust us
Powerful Building Blocks for Attack Surface Management Pipelines
Discover more assets
Combine high quality DNS, WHOIS, and SSL data with web crawling and brute forcing to achieve broader and more accurate external asset discovery.
Clean up discovery results
Filter out the noise from discovery pipelines by removing false positives from wildcards, public infrastructure IPs, and third-party services. Get likelihood scores for connected assets.
Scan for vulnerabilities
Integrate vulnerability scanning across both infrastructure and web applications. Go beyond standalone scanners’ limits with broader coverage and detection of misconfigurations and outdated software.
Get richer vulnerability context
Enrich vulnerability findings with correlated context from multiple sources, including vulnerability database identifiers, CVSS and EPSS scores, CISA KEV data, and specific remediation guidance.
Why Choose Attack Surface Discovery API
An attack surface discovery engine might seem like an easy combination of reverse WHOIS, DNS, and SSL lookups stitched together with a vulnerability scanner on top, but it’s much more complex than that.
- Wildcard certificates and public cloud infrastructure litter asset inventories with false positives. Attack Surface Discovery API combines different data sources with advanced logic to identify and clean up such assets, enabling a complete yet clean asset inventory within your product.
- You need to combine a number of scanners to get a full perspective on the issues of both infrastructure and web apps. Attack Surface Discovery API can serve either as a foundation or a complement to your existing tooling, combining unified discovery and scanning capabilities.
- Vulnerability scanners often do not provide sufficient context for prioritization and remediation. Attack Surface Discovery API pulls data from multiple vulnerability databases, together with vendor advisories and other third-party sources, to enrich findings with correlated context.
Attack Surface Discovery API Use Cases
Building Cybersecurity Platforms
Leverage building blocks specifically made for attack surface discovery as a foundation and build your cybersecurity platform on top of them, saving time and effort on complex logic and connections between sources and tools.
Penetration Testing Enablement
Power reconnaissance and attack surface mapping features that support penetration testing workflows by providing comprehensive visibility into exposed assets before testing begins.
Vulnerability Assessment Capabilities
Enable or strengthen vulnerability assessments, covering entire attack surfaces rather than just one domain.
External Attack Surface Management
Build or enhance external attack surface management platforms by embedding asset discovery, vulnerability scanning, and vulnerability context enrichment through Attack Surface Discovery API.
Build Complex Workflows with Ease Using Attack Surface Discovery API
Frequently Asked Questions
Attack Surface Discovery API is a set of embedded API capabilities designed to enable attack surface discovery, cleanup, and scanning for cybersecurity platforms. It supports identification of internet-facing assets, false-positive reduction, vulnerability scanning across hosts and web applications, and enrichment of findings with detailed vulnerability context — all through unified API access.
While WHOIS, DNS, SSL, and similar APIs provide individual data points, Attack Surface Discovery API combines multiple data sources with advanced correlation logic.
It goes beyond raw lookups by:
- Discovering assets using DNS, WHOIS, SSL, web crawling, and brute forcing together
- Filtering out noise such as wildcard certificates, public cloud infrastructure controlled by cloud providers, and third-party services
- Assigning likelihood scores to connected assets
- Enabling vulnerability scanning across infrastructure and web applications
- Enriching vulnerabilities with data from multiple vulnerability databases and advisories
The result is the ability to produce a complete and clean attack surface inventory rather than fragmented data.
Key benefits include:
- Comprehensive asset discovery across domains, IPs, hosts, and web applications
- Reduced false positives through advanced cleanup logic and likelihood scoring
- Unified vulnerability scanning capabilities covering servers, open ports, and web apps
- Rich vulnerability context including vulnerability database IDs, CVSS, EPSS, CISA KEV, and remediation guidance
- Simplified integration, consolidating access to multiple tools and scanners through a single API-driven workflow
API attack surface management focuses specifically on discovering and securing exposed APIs.
Attack Surface Discovery API, on the other hand, provides visibility across the entire external attack surface, including:
- Domains and subdomains
- IPs and hosts
- Web applications
- Network services and open ports
- APIs as part of broader infrastructure
It enables a holistic view of external exposure within security platforms and workflows, rather than a narrow focus on APIs alone.
We’re starting the public test of the Attack Surface Discovery API. To become an early adopter, reach out to us.
Kevin Branzetti
CEO
National Child Protection Task Force
"To every single person who showed up—who came in early, stayed late, worked shoulder to shoulder with people they’ve never met, and treated every case like it mattered most—THANK YOU. You gave these children more than just safety. You gave them hope, love, and compassion. And you reminded each other that this fight doesn’t have to be lonely."
Michael Bazzell
Owner
IntelTechniques
"The WhoisXML History API has been a game changer for our online investigations, trainings, and books. We have uncovered the true owners behind numerous malicious domains, even though they currently possess "private" Whois registration."
Flavio Critelli
Distinguished Professor of Digital Forensics
University of Perugia
"Whois XML is one of the most important tools we use for domain intelligence in the Bachelor's Degree program in Investigation and Security Sciences at the University of Perugia. In particular, we appreciate the reverse research from IP to Domain and Whois with query filters. The tool is comprehensive, providing detailed information such as phone numbers, names, and other details from Whois records. While many Whois records are now covered by privacy regulations, WhoisXML API provides access to all historical WHOIS records."
Dennis Suermann
Student
University of Paderborn, System Security department
"The website intelligence is easy to set up and returns everything we need. One reason for this is the documentation of the API, which is well-written and very detailed."
Marzieh Bitaab
PhD Student, Computer Science
Arizona State University
"Thanks to well-structured and clear API documentation provided by WhoisXML API, we were able to integrate the solution seamlessly into our system with minimal technical challenges."
Michael Roberts
Founder & Private Investigator
Rexxfield
"WhoisXML was the game changer for us. It has revolutionized our ability to disrupt cybercrime in process and at scale by quickly identifying all of the vendors providing material support for scammers using sophisticated website templates that look legitimate. By quickly identifying the vendors unknowingly supporting the criminals, we can provide them with public interest justification to burn down the criminal infrastructure."
VP of Engineering
EASM company
"After thorough testing, we were thrilled to find that Chronicle DNS Database consistently identified 10 times more 'active' subdomains compared to other options in the market."
LR
Loonie Reed
Certified Fraud Examiner and Computer Forensic Examiner
"The consistent and structured data provided by WhoisXML API made it possible to group and identify who is behind suspected fraudulent websites, being able to search by phone number, address or e-mail address used in the domain registration."
Yannick Delsahut
CEO
Goldstark
"I appreciate your products that are useful for checking domain expiration dates."
Karlis Blumentals
CEO
Mozello
"Mozello offers built-in domain registration services to our customers, and we needed an easy-to-implement domain availability checking solution that covers all possible domain names, including exotic ones. WhoisXML API provides right what we need at a reasonable cost and with zero maintenance, plus it is very easy to implement."
Christine Bejerasco
Senior Analyst
F-Secure Corporation
"WhoisXML API is a responsive and reliable provider of domain intelligence. Whenever there are issues, they are quick to respond and resolve them. Working with them is smooth and straightforward."
Rich Sutton
VP of Engineering
Proofpoint
"WhoisXML API’s domain intelligence allows us to quickly integrate WHOIS lookups into our security heuristics and algorithms without having to worry about hosting services, staging and merging data, and the complicated task of normalization."
Kieran Kennedy
Head
Snowflake Marketplace
"Keeping track of new domain registration activity is essential in today's digital economy. We look forward to continuing our collaboration with WhoisXML API to help customer leverage critical domain insights in a secure cloud environment that aligns with their data privacy and governance requirements."
Oleg Danilov
Director of Marketing Services - Sales Excellence & Data Management
Herold
"WhoisXML API data helps us make informed and automated decisions, filtering invalid email addresses much faster."
James Knight
Director
Broads Tours
"We needed a simple way of verifying the integrity of user-entered email addresses, and discovered WhoisXML API – it is great value and was really easy to integrate with our systems. Excellent customer service when required, too."
Larry Cameron
President and Founder
Paradigm Intelligence Ltd
"WhoisXML API is amazing for checking out the historic registration information of a domain, pivoting to locate the alternate registrations with the same details and also my cyber investigations. The data proved very useful when investigating pig butchering scams and domains that host child abuse material."
NC
Nik Charlson
StoneLatch
"DRS is a Great product, easy to use and everything I need in one place."
Jacob Waltz
CEO/Founder
Intraframe
"Very useful for investigations, we can go back in history and see when domains were registered and who owned them at a certain time."
David Pearson
CEO/Founder
Bayse Intelligence
"WhoisXML API builds out data sets that help users correlate attack infrastructure with related IP and WHOIS information."
Trusted by
the smartest
companies
Have questions?
We are here to listen. For a quick response, please select your request type. By submitting a request, you agree to our Terms of Service and Privacy Policy.