In line with WhoisXML API’s commitment to improving its service offerings, we released the following products and feature upgrades in Q3 and Q4 2023:

• “First seen” UNIX timestamp has been added to Threat Intelligence Data Feeds’ files: Subscribers of our Threat Intelligence Data Feeds can now reference the date and time when an indicator of compromise (IoC) was first detected. The new column has been added to these files:

• Malicious IPv4/IPv6 address data feed
• Malicious domain name data feed
• Malicious URL data feed
• Malicious file hash data feed
• Malicious IPv4/IPv6 ranges in CIDR notation data feed

With this additional data point, users can easily distinguish new IoCs that may still need to be added to their security systems. The new field also enables users to determine the length of time the IoC has been active, potentially providing insights into the threat actors’ tactics.

• Newly Registered Domains (NRD 2.0) coverage increased by 89%: NRD 2.0 users can now enjoy broader and higher quality data coverage as a result of our development team’s efforts to continuously improve our new domain activity tracking capabilities. The records in our NRD 2.0 daily files now contain up to 250,000+ newly added domains, 363,000+ newly dropped domains, 532,000+ newly updated domains, and 55,000+ newly discovered domains across thousands of TLDs. Specifically considering ccTLD coverage, we recorded a 154% increase in the number of domain activities for the top 10 ccTLDs in 2023 compared to 2022.

• NRD 1.0 end-of-life is scheduled for 31 December 2024: Since an upgraded version with more comprehensive data coverage has become available, we have been actively migrating NRD 1.0 users to NRD 2.0. By 1 March 2024, we will stop providing customer support for NRD 1.0. We will then discontinue the product and no longer provide any related service file or update by 31 December 2024. NRD 1.0 users should contact their account managers as soon as possible to avoid service disruption.

• New version of Email Verification API is now available: Following the launch of a more stable and accurate Email Verification API V3, our development team will stop providing support and updates by 31 January 2024. We will then discontinue Email Verification V2 by 30 April 2024. We encourage all users to migrate to Version 3 today for a seamless transition and to benefit from superior email validation.

• Website Categorization API upgraded to Version 3: We recently launched Website Categorization API V3, which uses an advanced website categorization model for more stable, reliable, and granular website classification. The new version has 84 granular categories, including Malware Sites, Gambling, Games, Spam URLs, and Confirmed Spam Sources. It also includes confidence levels along with the results with additional output fields, such as a domain's creation date from its WHOIS records and its IP address's AS details.

• New Website Categorization Database has been launched: Our new and improved Website Categorization Database has been enriched with additional data points, including AS details (i.e., AS number, domain, name, route, and type) and WHOIS registration data (i.e., creation date). It now employs the same web categorization model as Website Categorization API V3, enabling a more targeted classification for millions of websites. Users can access the data through various subscription terms to notably empower web filtering and threat detection capabilities and gain valuable market insights.

• Threat Intelligence API and Threat Intelligence Lookup have been launched: You can now retrieve threat details for any domain, URL, IP, CIDR number, or hash easily using our new Threat Intelligence API and Threat Intelligence Lookup. The threat information we provide includes the threat types (i.e., attack, botnet, c2, malware, phishing, spam, suspicious, tor, and generic) and dates when the threats were first and last seen. The API version can be readily integrated into existing security solutions, while the lookup tool provides instant threat intelligence even when you're on the go.

• IP Geolocation Lookup and IP Netblocks Lookup have been enriched with threat detection capability: You can now find out if an IP address or IP range is part of a malicious network using IP Geolocation Lookup and IP Netblocks Lookup. These tools have been recently linked to Threat Intelligence API, enabling users to discover more details about malicious IP resources, including the types of threat they were associated with and when they were first and last seen.

• Typosquatting Data Feed has been upgraded: Users of Typosquatting Data Feed can now enjoy broader coverage as it now contains country-code top-level domains (ccTLDs). The similarity detection algorithm behind the data feed has also been made more robust and sensitive, effectively improving typosquatting detection capabilities to prevent domain impersonation-led cybercrime and improve brand protection. Its data production schedule has also been altered. As such, daily files are generated and released the next day for higher accuracy and better coverage.

Stay tuned for more product and feature improvements in the coming quarters.