WhoisXML API Blog

An organization’s domain name is one of its most valuable digital assets, so the desire to secure it is only natural. However, the terms used to describe these security measures—domain name protection and domain name privacy—are often used interchangeably, which can lead to confusion.

While both aim to protect, there are distinct differences, which we discuss in greater detail in this post. Please refer to the table below for the TL;DR version.

WhoisXML API announces the launch of its MCP server that allows large language models (LLMs) to query 17 of its APIs, enabling users to access unique internet infrastructure intelligence data, run bulk queries and conduct complex internet infrastructure research projects directly from the chatbot interface using natural language.

The MCP server is software that enables the use of the Model Context Protocol, an open standard that enables LLMs and other AI systems to securely connect to external data sources. The protocol uses a client-server architecture, where the client is the AI application that connects to the MCP server.

WhoisXML API analyzed 8.3+ million domains registered between 1 and 31 July 2025 to identify the most popular registrars, top-level domain (TLD) extensions, and other global domain registration trends.

We also determined the top TLD extensions used by 49.3+ billion domains from our DNS database’s A record full file dated 3 July 2025.

Next, we studied the top TLDs of 1.1+ million domains detected as indicators of compromise (IoCs) this July.

Finally, we summed up our findings and provided links to the threat reports produced using DNS and domain intelligence sources during the period.

We are excited to announce that a protocol selector has been added to WHOIS Lookup and WHOIS Search (on Domain Research Suite), giving users more flexibility to choose how to retrieve domain registration data. 

With this new feature, users can select from three protocols—RDAP, WHOIS, and Auto.

You may have heard of notorious malware variants like Zloader using DNS tunneling for command and control (C2). Instead of making regular web requests, this malware uses the Domain Name System (DNS) to communicate with its C2 servers, and this allows malicious traffic to bypass network security, such as firewalls and intrusion detection systems (IDS).

But wait, DNS doesn’t support arbitrary data transfer like HTTP, does it? Well, it doesn’t, but DNS tunneling is a workaround for that. In this post, we break down DNS tunneling for you, including how it works and how to detect it – both from within an organization’s network and from outside it. 

WhoisXML API analyzed 9.8+ million domains registered between 1 and 30 June 2025 to identify the most popular registrars, top-level domain (TLD) extensions, and other global domain registration trends.

We also determined the top TLD extensions used by 51.7+ billion domains from our DNS database’s A record full file dated 5 June 2025.

Next, we studied the top TLDs of 1.0+ million domains detected as indicators of compromise (IoCs) this June.

Finally, we summed up our findings and provided links to the threat reports produced using DNS, IP, and domain intelligence sources during the period.

Ed Gibbs, VP of Research, whoisxmlapi.com

Issue Overview

CSV files containing CR/LF (carriage return/line feed) line endings can cause parsing errors with certain CSV-to-JSON conversion tools. This commonly occurs when CSV files are created on Windows systems, which use CR/LF (\r\n) line endings, while many Unix-based tools expect only LF (\n) line endings.  This applies to various datafeeds WHOISXMLAPI provides such as WHOIS, Netblocks, and IP Geolocation.