Provide current and historical ownership information on domains / IPs. Identify all connections between domains, registrants, registrars, and DNS servers.
Get detailed context on an IP address, including its user’s geolocation, time zone, connected domains, connection type, IP range, ASN, and other network ownership details.
Get access to a web-based enterprise-grade solution to search and monitor domain registrations and ownership details for branded terms, fuzzy matches, registrants of interest, and more.
Predictive threat intelligence is your best first line of defense. Subscribe to the feeds to strengthen your cybersecurity posture. Contact us today for more information.
I’m your Domain Intelligence Assistant. I make it easy to explore WHOIS, DNS, and threat data from WhoisXML API — I’m cloud-based, fast, and always ready to help.
Discover what you really pay for when buying commercial Internet intelligence data.
Written by Ching Chiao, Head of APAC and Global Data Partnership & Alexandre François, Product Marketing Director WhoisXML API
On January 28, 2025, ICANN (the Internet Corporation for Assigned Names and Numbers) will officially sunset the WHOIS Port 43 services. This decision marks a pivotal moment for the cybersecurity industry, domain registries, and anyone who relies on domain data for operational or investigative purposes. But what does this change mean, and how will it impact the broader ecosystem?
Domain categorization is an essential component of cybersecurity, enabling businesses and security solutions to identify and mitigate threats at the network level. Certain categories are especially relevant for flagging confirmed malicious websites, which may be hosted on domain names that First Watch Malicious Domains Data Feed can detect even before they are weaponized.
The feed leverages deep learning and proprietary techniques to identify suspicious domains at the time of registration. Its threat prevention effectiveness is continually assessed, offering users assurance when deciding whether to preemptively block or closely monitor the domains listed in the feed’s files.
In our latest analysis, we explored a dataset of 477,082 domains collected from the feed, using a reputable web categorization service provided by a renowned cybersecurity organization to classify them. Of these, 50,436 domains were successfully categorized, with notable classifications such as malicious (5,219), pornography (2,843), gambling (1,725), and phishing (366). This study applies advanced statistical methods to identify patterns, highlight potential biases in detection, and propose areas for improving categorization algorithms.
The WhoisXML API research team analyzed 7.9+ million domains registered between 1 and 31 December 2024 to identify the most popular registrars, top-level domain (TLD) extensions, and other global domain registration trends.
We also determined the top TLD extensions used by 60.1+ billion domains from our DNS database’s A record full file released in the same month.
Next, we studied the top TLDs of 1.3+ million domains detected as indicators of compromise (IoCs) in December.
Finally, we summed up our findings and provided links to the threat reports produced using DNS, IP, and domain intelligence sources during the period.
The WhoisXML API research team analyzed 8.2 million domains registered between 1 and 30 November 2024 to identify the most popular registrars, top-level domain (TLD) extensions, and other global domain registration trends.
We also determined the top TLD extensions used by 59.6 billion domains from our DNS database’s A record full file released in the same month.
Next, we studied the top TLDs of 1.1 million domains detected as indicators of compromise (IoCs) in November.
Finally, we summed up our findings and provided links to the threat reports produced using DNS, IP, and domain intelligence sources during the period.
We are thrilled to announce that several of our APIs have been upgraded to include new data points, namely, wildcard and active. In particular, both fields are now optional output parameters for Reverse IP API, Reverse DNS API, Reverse MX API, and Reverse NS API. Our newly launched DNS Chronicle API, meanwhile, has a wildcard field as part of its default output format.
We are excited to introduce First Watch Malicious Domains Data Feed, the newest addition to our predictive threat intelligence product line. This innovative solution is designed to enhance early threat detection and response by identifying substantially more malicious domains than traditional feeds, right at the point of registration.
First Watch Malicious Domains Data Feed offers several key advantages for cybersecurity teams, whether they are part of in-house Security Operations Centers (SOCs) or Managed Security Service Providers (MSSPs).
Authors: Ed Gibbs, Field CTO, WHOIS API Inc. Jeff Vogelpohl
Introduction
Growing up, I remember the vast array of candies and ice cream flavors while visiting quaint candy shops. Today, we’re overwhelmed by the plethora of technologies any imaginative person could want – thanks to the provocativeness of human ingenuity. As flavors were designed for these memories of delightful treats, this same ingenuity has brought technological advancements like AI to aid and improve all life whereas some provide just the opposite. Our adversaries continuously exploit and weaponize our ingenuity to degrade life. Life is worth protecting.
This document outlines the setup of a PostgreSQL database on Ubuntu Linux to efficiently manage and query WHOISXMLAPI’s Premium DNS database. Designed to store and analyze billions of DNS records, this database will handle large-scale data ingestion, facilitate rapid data retrieval, and support extensive analytical operations. PostgreSQL's robust performance, scalability, and support for advanced indexing make it ideal for managing DNS data, while its compatibility with open-source tools provides a flexible environment for future scaling and data processing.
