WhoisXML API Blog

TL;DR

• The Disposable Email Domains Database has been upgraded with a more precise machine learning detection model that reaches 99% tested detection precision.
• It adds scoring for every domain on a scale from 0 to 100, allowing you to set your own block, verify, and allow thresholds based on the score.
• It tracks 162,000+ disposable domains and is refreshed daily in CSV and JSON.

TL;DR

• You can now restrict API requests to a list of trusted IP addresses, so a leaked or shared key alone is no longer enough for unauthorized users to use your API key.
• Enterprise account administrators using Parent-Child API keys can see API usage broken down by individual team member or combined for the whole account.
• Both are available now in your account settings. The IP allowlist is off by default, and your account setup stays the same.

A newly observed domain (NOD) is one that has just appeared in Domain Name System (DNS) traffic for the first time, indicating that it has started being queried, resolved, or otherwise seen in DNS activity. Tracking newly observed domains has become an important part of modern threat intelligence because threat actors often register domains in batches and well in advance — sometimes months ahead — then activate them only when a campaign is ready to launch or when the previous domain they used was taken down. 

We discuss NODs in more detail in this post, including how they differ from newly registered domains, the risks they pose, and how to track them.

Scammers have always been good at making fake websites look real, even when there were some telltale signs — wrong grammar, typos, pixelated logos. 

But in 2026, legitimate and fake websites can look very similar. Generative AI can produce copy with perfect grammar and spelling as well as high-quality web pages and UI layouts.

So, how do you verify website authenticity today? The short answer is: no single method is enough, but there’s a combination of methods and tools you can try. This guide breaks down 11 methods into three categories — high-confidence tool-based checks; manual verification that still works; and old-school indicators that have mostly lost their value. 

WhoisXML API analyzed 9.2+ million domains registered between 1 and 30 June 2026 that appeared in Newly Registered Domains to identify the most popular registrars, TLD extensions, and other global domain registration trends. This number declined by 12.2% from 10.5+ million NRDs last month.

We also determined the top TLD extensions used by 2.0+ million domains likely registered with malicious intent from the First Watch Malicious Domains Data Feed in June 2026. This number decreased by 31.2% from the previous month.

Next, we studied the top TLD extensions of 1.07+ million confirmed malicious domains from the Threat Intelligence Data Feeds this month, which dropped by 1.1% from 1.08+ million in May.

Finally, we summed up our findings and provided links to the threat reports produced using DNS and domain intelligence sources during the period.

TL;DR

• The feed now captures up to 2x more newly added, updated, dropped, and discovered domains each day.
• Every domain comes with a more complete registration record, because the feed compares its RDAP and WHOIS data and keeps the fullest version.
• No actions needed on your side: the files and the way you integrate them stay the same.

In this post, we explain what the dig command does as well as how to install and use it. We also talk about how to work around its limitations.