WhoisXML API Blog

Representatives from WhoisXML API joined hundreds of cybersecurity professionals and enthusiasts at the BSides Chicago 2025 conference, held at the Hilton Chicago from October 31 to November 1, 2025.

The WhoisXML API team, including Tara Conneally (Enterprise Partnership Development III), Hanna Frank (Technical Account Executive), and Michael Kaparos (DevSecOps & Threat Researcher), was on site. We participated with a booth alongside vendors from across the cybersecurity community, such as Aikido, Bitwarden, GitGuardian, Guidepoint Security, Push Security, and SecurityScorecard.

Can you quickly spot the difference between these two domains: whoisxmlapi[.]com and whoisxrnlapi[.]com? Took you a few seconds, didn’t it? Your eyes can deceive you, and that’s exactly what threat actors hope for when they use lookalike domains. 

Lookalike domains are one of the most effective tools cybercriminals use in modern cyberattacks, tricking people into thinking that they are visiting a legit website or receiving an official business email. 

In this post, we explore what lookalike domains are, how dangerous they can be, and how organizations can detect and protect against them.

Your domain name is one of the most valuable digital assets you own. It is your address and a central hub for your business, and because of this, your domain name is a prime target for opportunistic scammers. 

It’s not just about stealing a domain name from you — there are other types of domain name scams. In this post, we discuss some of the most pervasive domain name scams, detailing how each of them works and the steps you can take to avoid falling victim to them. 

WhoisXML API analyzed 9.6+ million domains registered between 1 and 31 October 2025 to identify the most popular registrars, top-level domain (TLD) extensions, and other global domain registration trends.

We also determined the top TLD extensions used by 38.7+ billion domains from our DNS database’s A record full file dated 4 October 2025.

Next, we studied the top TLDs of 1.1+ million domains detected as indicators of compromise (IoCs) this month.

Finally, we summed up our findings and provided links to the threat reports produced using DNS and domain intelligence sources during the period.

WhoisXML API analyzed 8.7+ million domains registered between 1 and 30 September 2025 to identify the most popular registrars, top-level domain (TLD) extensions, and other global domain registration trends.

We also determined the top TLD extensions used by 42.1+ billion domains from our DNS database’s A record full file dated 4 September 2025.

Next, we studied the top TLDs of 1.0+ million domains detected as indicators of compromise (IoCs) this month.

Finally, we summed up our findings and provided links to the threat reports produced using DNS and domain intelligence sources during the period.

WhoisXML API is proud to announce that the false positive rate of its First Watch Malicious Domains Data Feed went down from 3% to 1.66%. This significant reduction in false alarms translates directly into a more efficient, reliable, and trustworthy predictive threat intelligence solution for users, allowing them to block upcoming threats with higher confidence and fewer interruptions.

WhoisXML API announces the launch of the Domain Info API, a new cyber intelligence solution designed to deliver a single, enriched WHOIS record for any active or expired domain name by leveraging WhoisXML API’s massive historical WHOIS database. The Domain Info API automatically fills in WHOIS fields that are redacted or missing for any domain name, using the latest available historical data.

This post breaks down the whois command — how it works, how to use it, the data points it provides, the parameters you can use with it, and its limitations. We also suggest some tools and techniques that can help you work around the tool’s limitations.