Provide current and historical ownership information on domains / IPs. Identify all connections between domains, registrants, registrars, and DNS servers.
Look into all current and historical DNS / IP connections between domains and A, MX, NS, and other records. Monitor suspicious changes to DNS records.
Get detailed context on an IP address, including its user’s geolocation, time zone, connected domains, connection type, IP range, ASN, and other network ownership details.
Access our web-based solution to dig into and monitor all domain events of interest.
Get access to a web-based enterprise-grade solution to search and monitor domain registrations and ownership details for branded terms, fuzzy matches, registrants of interest, and more.
Predictive threat intelligence is your best first line of defense. Subscribe to the feeds to strengthen your cybersecurity posture. Contact us today for more information.
Unlock integrated intelligence on Internet properties and their ownership, infrastructure, and other attributes.
Our complete set of domain, IP, and DNS intelligence available via API calls as an annual subscription with predictable pricing.
Offers complete access to WHOIS, IP, DNS, and subdomain data for product enrichment, threat hunting and more.
Talk to our APIs using LLMs. Connect your preferred LLM to WhoisXML API and simply chat about WHOIS, DNS, threat intelligence, and more.
I’m your Domain Intelligence Assistant. I make it easy to explore WHOIS, DNS, and threat data from WhoisXML API — I’m cloud-based, fast, and always ready to help.
For cybersecurity researchers, the DNS hides a treasure trove of data. It offers insights to identify malicious domains, map attacker infrastructure, detect fast flux, and identify typosquatting domains. But it also requires knowing where to look and what to analyze.
In this post, we cover different the best DNS lookup tools for different types of lookups and what types of investigations they can help with.
The WhoisXML API research team analyzed 8.5+ million domains registered between 1 and 31 May 2025 to identify the most popular registrars, top-level domain (TLD) extensions, and other global domain registration trends.
We also determined the top TLD extensions used by 54.6+ billion domains from our DNS database’s A record full file dated 1 May 2025.
Next, we studied the top TLDs of 1.3+ million domains detected as indicators of compromise (IoCs) this May.
Finally, we summed up our findings and provided links to the threat reports produced using DNS, IP, and domain intelligence sources during the period.
WhoisXML API is proud to announce its new partnership with the Global Signal Exchange (GSE), a collaborative initiative that serves as a global clearinghouse for the real-time sharing of scam and fraud signals.
The company joins tech giants Google, Meta, Microsoft, and Netcraft, along with other leaders in the Internet infrastructure, financial services, and law enforcement sectors.
As a GSE Partner, WhoisXML API contributes its Early Warning Phishing Feed to the project’s open data layer. Early Warning Phishing Feed is a predictive threat intelligence source that identifies newly registered domains likely to figure in upcoming phishing campaigns, scams, and brand abuse.
Often dubbed as the Internet’s phonebook, the DNS serves a critical function in modern Internet communications, translating human-readable domain names into IP addresses. We have a primer on the subject if you want to dig deeper into the DNS, how it works, and other related concepts.
Given its foundational role, it’s no surprise that threat actors often target the DNS. According to the Cybersecurity & Infrastructure Security Agency (CISA), “DNS infrastructures are common threat vectors for attacks.” It is within this context that the U.S. National Institute of Standards and Technology (NIST) published an initial public draft of the third Secure DNS Deployment Guide (NIST SP 800-81r3 ipd) in April 2025.
The RSA Conference held in San Francisco from 28 April to 1 May 2025 attracted a record-breaking 41,000 attendees, and we’re thrilled to say that WhoisXML API representatives were among them. The global cybersecurity gathering featured 413 sessions and 656 exhibitors, all offering valuable insights into emerging cybersecurity trends—evolving threats, cutting-edge solutions, and industry best practices.
In this post, we’ll recap the recurring themes and key trends from the event and highlight the most impactful insights that will continue to shape organizations’ cybersecurity strategies.
Ching Chiao, Head of APAC & Global Partnership at WhoisXML API, joined more than 20,000 security professionals from around the world in the recently concluded Cybersec 2025. He participated as a speaker at the three-day conference and expo that aims to take on digital threats as one cybersecurity community.
Held in Taiwan on 15–17 April 2025, Cybersec 2025 hosted more than 300 sessions and speakers and focused on 28 various themes, including artificial intelligence (AI), cloud, AI of Things (AIoT) and hardware, financial technology (fintech), and open-source security. Several of the topics resonated with us, and we’ll dive into some of them in this post.
We’re excited to introduce upgraded web tool interfaces with enhanced data access across all our lookup tools. The improved GUIs are designed to make your lookup reports richer and simpler to use for investigations and testing, improving how technical and nontechnical users access and utilize domain, DNS, IP, and other cyber data accessible through this complete list of our lookup tools.
Here are the new features available to all logged-in users with credits.
The WhoisXML API research team analyzed 7.6+ million domains registered between 1 and 30 April 2025 to identify the most popular registrars, top-level domain (TLD) extensions, and other global domain registration trends.
We also determined the top TLD extensions used by 55.8+ billion domains from our DNS database’s A record full file dated 3 April 2025.
Next, we studied the top TLDs of 1.5+ million domains detected as indicators of compromise (IoCs) this April.
Finally, we summed up our findings and provided links to the threat reports produced using DNS, IP, and domain intelligence sources during the period.
We are here to listen. For a quick response, please select your request type. By submitting a request, you agree to our Terms of Service and Privacy Policy.
