WhoisXML API Blog

WhoisXML API Participates in SecurityScorecard Odyssey 2025

Ed Gibbs, Vice President of Research at WhoisXML API, joined thousands of cybersecurity leaders and innovators at the SecurityScorecard Odyssey.conf, held in Miami, Florida, on 25–27 February 2025.

The event, known for its focus on supply chain cyber risk management, provided a valuable opportunity to consider the role of domain and IP intelligence in strengthening defenses against cyber threats, aligning with this year’s theme, “Charting the Course for Cyber Resilience.”

While the event dove into several important areas of cybersecurity, we highlight three key takeaways in this post. 

Python Script for Transforming Domain Names from First Watch Malicious Domains Data Feed into STIX 2.1

WhoisXML API recently created a Python script to help users of First Watch Malicious Domains Data Feed, also known as “First Watch,” transform predictive domain intelligence into a machine-readable format—STIX 2.1—for automated data processing.

The script reads domain names from First Watch files, converts them to STIX 2.1 Indicator objects with domain-name observable types, and generates a TAXII 2.1-compatible STIX bundle. The output is downloadable as a JSON file in TAXII format.

FQDN to IP, IP to FQDN: The Queries that Power Domain Infrastructure Discovery

Identifying malicious infrastructure, implementing blocklists, analyzing IP or domain reputation — all of these (and many other) tasks rely on mapping fully qualified domain names (FQDNs, or so called "complete domains") to IPs and IPs to FQDNs. These mappings are crucial not only for network security analysis but also for troubleshooting and even basic website administration. 

There are lookup tools that can let you obtain the IP address that resolves to the FQDN (i.e., FQDN to IP or forward lookup tools) or retrieve a list of domains resolving to an IP address (i.e., IP to FQDN also known as reverse lookup tools). If you want to dig deeper—go back in time, if you will—there are also tools that let you perform historical FQDN to IP and IP to FQDN lookups based on passive DNS data. From there, you can create a timeline of the resource's resolutions. 

In this post, we'll show you how to do all of these. If you want to follow along and do the queries yourself, make sure to sign up for a free account to start using the tools we will be demonstrating.

February 2025: Domain Activity Highlights

The WhoisXML API research team analyzed 7.5+ million domains registered between 1 and 28 February 2025 to identify the most popular registrars, top-level domain (TLD) extensions, and other global domain registration trends.

We also determined the top TLD extensions used by 62.1+ billion domains from our DNS database’s A record full file dated 6 February 2025.

Next, we studied the top TLDs of 1.0+ million domains detected as indicators of compromise (IoCs) this February.

Finally, we summed up our findings and provided links to the threat reports produced using DNS, IP, and domain intelligence sources during the period.

What Is RDAP (and Why It’s More Important Now Than Ever)

Conversations around replacing WHOIS – the main protocol for retrieving information about domain registrants – have been around for decades. Now, WHOIS is being phased out and replaced by the Registration Data Access Protocol (RDAP). 

Why is that happening?

Enhance Response Speed for Historical Domain Records with the skipLiveWhois API Parameter

We are thrilled to announce that WHOIS History API has been upgraded to include a feature called “skipLiveWhois,” an optional parameter that enables users to skip WHOIS API requests when the latest indexed record is not fresh (i.e., there is no current WHOIS record from the past 24 hours). 

This enhancement is designed to improve the speed of historical WHOIS lookup requests by close to 90%—from 3.5 seconds to an average of 370 milliseconds.

Threat Intelligence Feeds: a Getting Started Guide

Despite actively improving cybersecurity defenses, the cost of cybercrime only continues to grow. Statista draws a steadily ascending graph, predicting that the global cost of cybercrime will go up more than a trillion $USD in 2025 – to $USD 10.29 trillion from 9.22 trillion in 2024. And it will continue the same way in 2026, 2027, and further on.

To avoid contributing to this growing number, organizations are switching toward proactive and even predictive cybersecurity – that is one of the main 2025 cybersecurity trends. Cybersecurity automation is another trend that has gained significant momentum. In their 2024 research, Wakefield Research concluded that 80% of organizations planned to increase their investment in cybersecurity automation. 

There’s an intersection between these trends – an area of cybersecurity that belongs to both and is critically important in 2025: cyber threat intelligence feeds. This guide provides you everything you need to know about them.

WhoisXML API Data Is Now Available on Core4ce’s Cyberscape

WhoisXML API is proud to announce a new integration with Core4ce, a data-minded company that serves as a trusted partner to the U.S. national security community.

This new partnership brings WhoisXML API’s comprehensive domain, DNS, IP, and Internet intelligence repositories to Core4ce’s Cyberscape, a cloud-based platform that enables security analysts to visualize threats, collaborate across teams, document intelligence for key stakeholders, and share reports with industry partners and government agencies in one workspace.

“Core4ce’s goal to streamline cyber threat investigation through rapid data integration supports our vision of a safer Internet, where relevant, high-quality intelligence is readily accessible to those on the front lines of cybersecurity,” says Jonathan Zhang, WhoisXML API CEO.