Provide current and historical ownership information on domains / IPs. Identify all connections between domains, registrants, registrars, and DNS servers.
Cyber Threat Intelligence Enrichment Solutions
Make your threat intelligence more comprehensive and relevant with a complete view of the DNS.
Have questions?
50 Billion+
Domains and subdomains
28.7 Billion+
WHOIS records
116 Billion+
DNS records
15+
Years of data crawling
10.6 Million+
IP netblocks in total
How Much Added Visibility Would a Satellite View of the Internet Bring to Your Threat Intelligence?
Business Problem
Cyber threat intelligence lies behind most cybersecurity strategies, platforms, or operation centers. Yet the scale and scope of today’s ever-dynamic and geographically dispersed threat landscape means organizations cannot settle for partially informed or run-of-the-mill threat intelligence. Accounting for every bit of information, including countless real-time and historical Internet events, matters to proactively notice, monitor, and protect networks from threat actors.
Data-Driven Solution
Cyber threat intelligence can only be as good as the raw data used in its development. Historical coverage of DNS, WHOIS, and other Internet records facilitates malicious infrastructure investigation and disruption by exposing otherwise hidden connections. These critical Internet events significantly contribute to every stage of the threat intelligence development cycle—enabling early threat detection, real-time threat analysis, broader threat expansion, and timely threat disruption.
Our Enterprise Value Proposition
Our enterprise packages offer scalable data access, flexible licensing models, and better coverage and higher total value delivered. Contact us for information on our packages and the contained premium, tier 1, and tier 2 products.
Premium | |
Tier 1 | |
Tier 2 |
Check Out Our Intelligence
See what complete domain and DNS intelligence looks like in practice.
Request Enterprise Demo
Talk to us. We’re eager to listen and find innovative ways to contribute to your success.
Gain a Satellite View of the World’s DNS Today
The WhoisXML API data engine is built and frequently upgraded to offer you the most complete, updated, and unique Internet intelligence footprints since 2010. Don’t get lost in all the red tape and unforeseen technical complexities of finding your own domain and DNS data. Our technology is ready to give back months or years of development cycle time to your most pressing and mission-critical projects and deployments.
1. Collection
- Internet-wide data sensing and crawling since 2010
- Legal agreements with major data aggregators
- Large and growing network of data exchange partners
Practical usage
Our Internet intelligence sources enriched the various processes required in the development of cyber threat intelligence, including:
Accelerated Threat Discovery
Detect suspicious domains, subdomains, nameservers, IP addresses, and other Internet-related records as soon as they get added, updated, or dropped, including cyber properties that seem to imitate legitimate brands and those that currently or historically share the same infrastructure as known threats.
Context-Rich Threat Analysis and Investigation
Gather accurate geolocation, ownership, administration, DNS infrastructure details, and other Internet intelligence raw materials needed to deepen threat contextualization and bring you one step closer to fully understanding and pinning down threat actors.
TTPs Analysis Enrichment and Pattern Detection
Analyze tactics, techniques, and procedures (TTPs) in real-time by observing and detecting old and new patterns in domain registration events, nameserver assignments, registrar affiliation, top-level domains (TLDs), IP geolocation, and other data that can be associated with threat actors.
Early-Stage Threat Prediction
Anticipate the badness of a domain, subdomain, or IP address before they are weaponized by following breadcrumbs left behind by the adversaries’ inevitable reuse of digital assets, such as nameservers, registrars, IP ranges, Secure Sockets Layer (SSL) certificates, and suspicious domain types.
Adversary Disruption and Takedown
Track down malicious properties to their respective owners, registrars, registries, and Internet service providers (ISPs) to intercept threat actors. Expose their domain, DNS, and IP connections to take steps toward disrupting malevolent infrastructure.
Proactive Threat Prevention
Pinpoint domains, subdomains, and IP addresses that currently share the same details or infrastructure as those used in confirmed threats or have recently or historically done so to support threat prevention efforts, from preemptive blocking to fueling security heuristics analysis and threat prevention models.
Related downloadable materials
Newly Registered Domains
Stay ahead of cyber threats with daily updates on newly registered and expired domains. Download our product sheet to learn more.
DNS Database Download
Uncover the world’s largest historical DNS database for deep cybersecurity insights. View the product sheet.
Shahnoor Kiani
Volunteer
CyberPeace Institute
"WhoisXML API’s passive DNS database, even the lite version for academic purposes, has much better subdomain data coverage compared with other commercial and free databases."
Sharada Jayaprakash
Senior Manager, Connector Engineering
Cyware
"WhoisXML API’s rich repository of domain records will be invaluable for Cyware and joint customers, as it enables automated enrichment of domain and IP content via Cyware Orchestrate."
Rahul Madduluri
Co-Founder and CTO
Doppel
"We did trials with WhoisXML API to make sure the data was truly resulting in successful takedowns. We were able to consistently discover and mitigate real threats as a result of using the products."
Michael Roberts
Founder & Private Investigator
Rexxfield
"WhoisXML was the game changer for us. It has revolutionized our ability to disrupt cybercrime in process and at scale by quickly identifying all of the vendors providing material support for scammers using sophisticated website templates that look legitimate. By quickly identifying the vendors unknowingly supporting the criminals, we can provide them with public interest justification to burn down the criminal infrastructure."
Trusted by
the smartest
companies
For pricing details and building your customized solution, please contact us!
Have questions?
We are here to listen. For a quick response, please select your request type. By submitting a request, you agree to our Terms of Service and Privacy Policy.