WhoisXML API Blog

TL;DR

• The upgraded WHOIS API runs real-time lookups with improved parsing accuracy.
• It’s now 2x faster than before. 
• Account rate limits now go up to 200 requests per second, up from 50.
• Control the cache freshness and choose the protocol used to retrieve domain registration data.
• Some changes may affect how you integrate.

WhoisXML API analyzed 11.1+ million domains registered between 1 and 31 July 2026 that appeared in Newly Registered Domains to identify the most popular registrars, TLD extensions, and other global domain registration trends. This number rose by 20.1% from 9.2+ million NRDs last month.

We also determined the top TLD extensions used by 1.9+ million domains likely registered with malicious intent from the First Watch Malicious Domains Data Feed in July 2026. This number decreased by 1.1% from the previous month.

Most often, SSL/TLS certificates are issued for specific websites: one certificate for one hostname or website. But for larger organizations, this creates problems with certificate management — they pile up, they expire at different times, it becomes harder to spot rogue certificates, and so on. 

This problem is solved by so-called SAN certificates, or multi-domain certificates, which can secure multiple domain names or hostnames with the help of the Subject Alternative Names (SAN) field. This post covers what a SAN certificate actually is, how it works, how to get one, and how security teams use SAN data for asset discovery. 

TL;DR

• The Disposable Email Domains Database has been upgraded with a more precise machine learning detection model that reaches 99% tested detection precision.
• It adds scoring for every domain on a scale from 0 to 100, allowing you to set your own block, verify, and allow thresholds based on the score.
• It tracks 162,000+ disposable domains and is refreshed daily in CSV and JSON.

TL;DR

• You can now restrict API requests to a list of trusted IP addresses, so a leaked or shared key alone is no longer enough for unauthorized users to use your API key.
• Enterprise account administrators using Parent-Child API keys can see API usage broken down by individual team member or combined for the whole account.
• Both are available now in your account settings. The IP allowlist is off by default, and your account setup stays the same.

A newly observed domain (NOD) is one that has just appeared in Domain Name System (DNS) traffic for the first time, indicating that it has started being queried, resolved, or otherwise seen in DNS activity. Tracking newly observed domains has become an important part of modern threat intelligence because threat actors often register domains in batches and well in advance — sometimes months ahead — then activate them only when a campaign is ready to launch or when the previous domain they used was taken down. 

We discuss NODs in more detail in this post, including how they differ from newly registered domains, the risks they pose, and how to track them.