Provide current and historical ownership information on domains / IPs. Identify all connections between domains, registrants, registrars, and DNS servers.
Look into all current and historical DNS / IP connections between domains and A, MX, NS, and other records. Monitor suspicious changes to DNS records.
Get detailed context on an IP address, including its user’s geolocation, time zone, connected domains, connection type, IP range, ASN, and other network ownership details.
Access our web-based solution to dig into and monitor all domain events of interest.
Get access to a web-based enterprise-grade solution to search and monitor domain registrations and ownership details for branded terms, fuzzy matches, registrants of interest, and more.
Predictive threat intelligence is your best first line of defense. Subscribe to the feeds to strengthen your cybersecurity posture. Contact us today for more information.
Unlock integrated intelligence on Internet properties and their ownership, infrastructure, and other attributes.
Our complete set of domain, IP, and DNS intelligence available via API calls as an annual subscription with predictable pricing.
Offers complete access to WHOIS, IP, DNS, and subdomain data for product enrichment, threat hunting and more.
Conversations around replacing WHOIS – the main protocol for retrieving information about domain registrants – have been around for decades. Now, WHOIS is being phased out and replaced by the Registration Data Access Protocol (RDAP).
Why is that happening?
We are thrilled to announce that WHOIS History API has been upgraded to include a feature called “skipLiveWhois,” an optional parameter that enables users to skip WHOIS API requests when the latest indexed record is not fresh (i.e., there is no current WHOIS record from the past 24 hours).
This enhancement is designed to improve the speed of historical WHOIS lookup requests by close to 90%—from 3.5 seconds to an average of 370 milliseconds.
Despite actively improving cybersecurity defenses, the cost of cybercrime only continues to grow. Statista draws a steadily ascending graph, predicting that the global cost of cybercrime will go up more than a trillion $USD in 2025 – to $USD 10.29 trillion from 9.22 trillion in 2024. And it will continue the same way in 2026, 2027, and further on.
To avoid contributing to this growing number, organizations are switching toward proactive and even predictive cybersecurity – that is one of the main 2025 cybersecurity trends. Cybersecurity automation is another trend that has gained significant momentum. In their 2024 research, Wakefield Research concluded that 80% of organizations planned to increase their investment in cybersecurity automation.
There’s an intersection between these trends – an area of cybersecurity that belongs to both and is critically important in 2025: cyber threat intelligence feeds. This guide provides you everything you need to know about them.
WhoisXML API is proud to announce a new integration with Core4ce, a data-minded company that serves as a trusted partner to the U.S. national security community.
This new partnership brings WhoisXML API’s comprehensive domain, DNS, IP, and Internet intelligence repositories to Core4ce’s Cyberscape, a cloud-based platform that enables security analysts to visualize threats, collaborate across teams, document intelligence for key stakeholders, and share reports with industry partners and government agencies in one workspace.
“Core4ce’s goal to streamline cyber threat investigation through rapid data integration supports our vision of a safer Internet, where relevant, high-quality intelligence is readily accessible to those on the front lines of cybersecurity,” says Jonathan Zhang, WhoisXML API CEO.
The WhoisXML API research team analyzed 7.6+ million domains registered between 1 and 31 January 2025 to identify the most popular registrars, top-level domain (TLD) extensions, and other global domain registration trends.
We also determined the top TLD extensions used by 61.2+ billion domains from our DNS database’s A record full file released in the same month.
Finally, we summed up our findings and provided links to the threat reports produced using DNS, IP, and domain intelligence sources during the period.
Change is the only constant in this world, and cybersecurity is no exception to that rule. While no one can know for sure what will happen in 2025 and the years to come, one thing is certain: organizations must adapt to new cybersecurity trends to keep pace with peers and adversaries alike.
For one, organizations will need to employ a proactive and integrated approach to cybersecurity this year due to the forecasted growth of high-impact artificial intelligence (AI)-enabled threats. While this strategy has been peeking around the corner in the past few years, it will take the frontline in 2025.
WhoisXML API presents this and other cybersecurity predictions, covering both emerging cyber threats and the strategies required to address them, to help organizations prepare for future challenges.
Written by Ching Chiao, Head of APAC and Global Data Partnership & Alexandre François, Product Marketing Director
WhoisXML API
On January 28, 2025, ICANN (the Internet Corporation for Assigned Names and Numbers) will officially sunset the WHOIS Port 43 services. This decision marks a pivotal moment for the cybersecurity industry, domain registries, and anyone who relies on domain data for operational or investigative purposes. But what does this change mean, and how will it impact the broader ecosystem?
Author: Ed Gibbs
Editor: Alexandre François
Domain categorization is an essential component of cybersecurity, enabling businesses and security solutions to identify and mitigate threats at the network level. Certain categories are especially relevant for flagging confirmed malicious websites, which may be hosted on domain names that First Watch Malicious Domains Data Feed can detect even before they are weaponized.
The feed leverages deep learning and proprietary techniques to identify suspicious domains at the time of registration. Its threat prevention effectiveness is continually assessed, offering users assurance when deciding whether to preemptively block or closely monitor the domains listed in the feed’s files.
In our latest analysis, we explored a dataset of 477,082 domains collected from the feed, using a reputable web categorization service provided by a renowned cybersecurity organization to classify them. Of these, 50,436 domains were successfully categorized, with notable classifications such as malicious (5,219), pornography (2,843), gambling (1,725), and phishing (366). This study applies advanced statistical methods to identify patterns, highlight potential biases in detection, and propose areas for improving categorization algorithms.
We are here to listen. For a quick response, please select your request type. By submitting a request, you agree to our Terms of Service and Privacy Policy.
