WhoisXML API continues to improve its service offerings with the release of the following products and feature upgrades in 2024 so far.

• Active and Wildcard fields added to DNS Database Download and various APIs: Standard and Premium DNS Database files from DNS Database Download now come with the Wildcard and Active columns. The Wildcard field enhances the filtering of DNS data noise, supporting attack surface discovery and reducing the occurrence of false positives. The Active field, meanwhile, can aid in reconstructing threat timelines, determining botnet connections, and more. These fields are also available as optional output parameters for Reverse IP API, Reverse DNS API, Reverse MX API, and Reverse NS API. Download a sample Premium DNS Database file or contact us to know more.

• DNS Chronicle API and DNS Chronicle Lookup joins our passive DNS product line: These latest additions to our passive DNS offerings further enable proactive threat detection and widen attack surface discovery by providing visibility into a domain’s or an IP address’s complete DNS history through new consumption models, in addition to database downloads. Users can perform two types of passive DNS queries with the new API and lookup tool—forward and reverse searches. Test DNS Chronicle API now or contact us to learn how passive DNS data can enhance various cybersecurity use cases.

• First Watch Malicious Domains Data Feed now available: The latest addition to our predictive threat intelligence lineup lets users identify and block malicious domains as soon as they are registered with 97% precision. Backed by a proprietary deep learning neural network trained on billions of data points to identify malicious intent, the feed detects 12 times more malicious domains than other data feeds. Download a sample file or discover more about cutting-edge predictive threat intelligence for just $199/month.

• Quarterly WHOIS Database Download files now up on Snowflake: Snowflake users can now get access to WHOIS Database Download’s quarterly gTLD and ccTLD files in three formats—simple, regular, and full. These files can serve as an ideal starting point for cybersecurity solution developers in search of comprehensive domain ownership data without additional work on the part of their product and development teams. Contact us to request access to WHOIS data within Snowflake.

• Server-to-Server OAuth is now available for all API products: API users can now authorize API requests using Server-to-Server OAuth. This more secure authentication method enables your applications and WhoisXML API servers to communicate without involving user interactions, making API integration more straightforward and scalable. Using Server-to-Server OAuth is a simple two-step process detailed here.

• Domains-Only Data Feed launched for the Newly Registered Domains (NRD) Database: NRD Database Ultimate users can now access a domains-only data feed that contains all domains from the Ultimate dataset, plus all new and removed domains identified in each daily zone file. The data feed does not include the domains’ WHOIS information, allowing users to access domain intelligence faster.

• Tech announcement service page is now up and running: Customers can keep track of data feed releases and updates on the new tech announcement service page. The service currently covers the NRD Database, the Typosquatting Feed, the Early DGA Detection Feed, the Early Warning Phishing Feed, and the Quarterly WHOIS Database. Learn more about this service here.

• POST request method for WHOIS API: In addition to the existing HTTP GET request method, users can now process WHOIS queries through POST requests. This new method reduces the risk of unauthorized API access since POST requests encrypt the API key as part of the HTTP message body. For more information, please visit this page.

• WhoisXML API now supports parent-child API keys: A new feature allowing administrators to create individual API keys for their team members is now available for enterprise users. Having child accounts can help them improve in terms of security and control when using WhoisXML API products. To learn how to create a child account user, visit this page.

• Premium DNS Database coverage peaks at 116 billion records: Our premium DNS Database Download has been significantly expanded, tallying a 578% increase in less than a year. As of Q2 2024, we expanded the historical coverage of our full database files from 90 to 365 days, giving users access to as many as 116 billion historical DNS records.

• Historical WHOIS intelligence contains more than 20 billion records: From 13.7+ historical WHOIS records in Q1 2022, our WHOIS history coverage rose to 15.6 billion in Q1 2023. In Q1 2024, this coverage further increased by 28%, enabling us to expand our historical WHOIS data to reach more than 20 billion records. With this massive coverage increase, security teams and organizations can further empower their cybersecurity and business capabilities.

• New version of the Typosquatting Data Feed has been released: With the recent updates, users can now enjoy improved typosquatting detection with broader coverage. The Typosquatting Data Feed’s coverage was expanded to include country-code top-level domains (ccTLDs). Its detection algorithm has also been enhanced and made more sensitive to a broader set of domain similarities. In addition, daily file production is now scheduled for the next day for better accuracy and coverage.

Developer Resources

WhoisXML API also enhanced its library of developer resources with these updates:

• Script for monitoring the API status page: Users can use a premade script that allows them to monitor changes on the API status page. The script can be customized to fit the unique requirements of the user’s organization. Learn more about the script here.

• Tutorial on importing Premium DNS Database into ClickHouse: WhoisXML API worked on a project demonstrating how to upload data from the DNS Premium 365 Database to a local ClickHouse database using automation scripts and SQL commands. The project aims to facilitate high-performance processing and analysis of massive DNS datasets. Check out the project details here.

• Predefining API request limits: WhoisXML API produced a script that allows developers to specify the number of API requests they want to send per second, enabling them to maintain a constant burst rate. Details about the script can be found here.

• Scripts for finding an IP address in the netblocks database using a binary tree: Users can use two scripts created by WhoisXML API that provide an easy way to gather the netblocks data of IP addresses quickly. The first script enables developers to create a binary tree, while the second script searches the binary tree for a specific IP address. To know more about these scripts, visit this page.

Stay tuned for more product and feature improvements in the coming quarters.