WhoisXML API Blog

Everything has its pros and cons. For web administrators, wildcard subdomains help simplify domain management and dealing with multisite applications. For cybersecurity professionals, they are a source of regular headaches. They can make an organization’s attack surface look much bigger (or smaller) than it actually is. 

In this post, we look at wildcard subdomains from the security perspective: how they affect attack surface mapping, why it happens, and how you can see through the noise.

The task of enumerating the subdomains of a domain, while it may appear simple at first glance, is in fact quite complicated. There is no one technique that can find every subdomain, and different tools produce different results because they rely on different sets of techniques.

In this post, we discuss the techniques that can be used for subdomain enumeration and some of the best tools that use these techniques with varying degrees of success.

WhoisXML API is proud to announce the launch of the TLD RDAP Monitor, an intuitive dashboard that constantly monitors the range of adoption of the Registration Data Access Protocol (RDAP) across 1,440 top-level domains (TLDs).

The TLD RDAP Monitor answers a critical need within the domain data ecosystem. As the industry transitions to RDAP, TLD registries have implemented the new protocol with varying degrees of progress, with some slower than others. This lack of uniformity can lead to data retrieval errors and application failures for those who rely on domain data access for their products and services.

WhoisXML API is proud to be named among the 2025 Inc. 5000 fastest-growing private companies in America, ranking 119th in the regionals and 4,271st overall. To qualify for the ranking, companies must be independent and meet strict requirements over the three-year period from 2021 to 2024.

“It is a great honor to be on the Inc. 5000 for the eighth year now. The credit belongs to every single person who has contributed to our continued ability to provide high-fidelity cyber intelligence that enables thousands of customers to enrich cyber solutions and workflows,” says WhoisXML API CEO Jonathan Zhang.

Traditional vulnerability management programs rely on a vast database of vulnerabilities. As of early September 2025, the National Vulnerability Database (NVD) contains more than 307,000 Common Vulnerabilities and Exposures (CVEs), 10% of which — over 30,000 — were added in 2025. This may sound scary and impossible to deal with, but the truth is that these CVEs do not reflect real-world threats because not all of them are easy to exploit. 

What security teams need to prioritize are vulnerabilities that are most likely to be exploited or are already actively exploited in the wild by threat actors targeting their specific industry. Doing this requires using threat intelligence. It helps organizations move beyond a reactive approach to vulnerability management and shifts the focus from “What assets are vulnerable?” to “What vulnerabilities are more likely to be exploited?”

An organization’s domain name is one of its most valuable digital assets, so the desire to secure it is only natural. However, the terms used to describe these security measures—domain name protection and domain name privacy—are often used interchangeably, which can lead to confusion.

While both aim to protect, there are distinct differences, which we discuss in greater detail in this post. Please refer to the table below for the TL;DR version.

WhoisXML API announces the launch of its MCP server that allows large language models (LLMs) to query 17 of its APIs, enabling users to access unique internet infrastructure intelligence data, run bulk queries and conduct complex internet infrastructure research projects directly from the chatbot interface using natural language.

The MCP server is software that enables the use of the Model Context Protocol, an open standard that enables LLMs and other AI systems to securely connect to external data sources. The protocol uses a client-server architecture, where the client is the AI application that connects to the MCP server.