Provide current and historical ownership information on domains / IPs. Identify all connections between domains, registrants, registrars, and DNS servers.
Look into all current and historical DNS / IP connections between domains and A, MX, NS, and other records. Monitor suspicious changes to DNS records.
Get detailed context on an IP address, including its user’s geolocation, time zone, connected domains, connection type, IP range, ASN,
and other network ownership details.
Access our web-based solution to dig into
and monitor all domain events of interest.
Get access to a web-based enterprise-grade solution to search and monitor domain registrations and ownership details for branded terms, fuzzy matches, registrants of interest, and more.
New gTLD Intelligence Services (NGIS)
Independent, evidence-based DNS and abuse intelligence for applicants, advisors, governments, and counsel participating in the ICANN 2026 New gTLD Program.
Predictive Threat Intelligence Feeds
Predictive threat intelligence is your best first line of defense. Subscribe to the feeds to strengthen your cybersecurity posture. Contact us today for more information.
Unlock integrated intelligence on Internet properties and their ownership, infrastructure, and other attributes.
Our complete set of domain, IP, and DNS intelligence available via API calls as an annual subscription with predictable pricing.
Security Intelligence (SI) Suite
Offers complete access to WHOIS, IP, DNS, and subdomain data for product enrichment, threat hunting and more.
Uncover entire attack surfaces with this API to embed asset discovery, vulnerability scanning, and technology metadata into your platform. Now in early access.
Talk to our APIs using LLMs. Connect your preferred LLM to WhoisXML API and simply chat about WHOIS, DNS, threat intelligence, and more.
I’m your Domain Intelligence Assistant. I make it easy to explore WHOIS, DNS, and threat data from WhoisXML API — I’m cloud-based, fast, and always ready to help.
WhoisXML API Domain Intelligence Advisor (via ChatGPT)
A custom GPT for WHOIS, DNS, IP, and threat intelligence research. Connects ChatGPT directly to WhoisXML API to enable fast, conversational investigations and domain insights.
Access our latest research and insights on WHOIS, IP, and DNS data for cybersecurity, data science, and other business purposes through our webinars, podcasts, white papers, threat reports, and videos from the Academy.
Have questions?
The high-profile cyberintrusion of the Democratic National Committee (DNC) computer system in 20151 disrupted the 2016 presidential election in the U.S. It remains one of the most popular cyber attacks, with top security firms performing different investigations.
Copycatting the world’s most popular software applications is a commonly used technique to lure users into visiting seemingly legitimate yet often malicious pages.
WebAttacker can be considered an aged threat, but it may not be out of the cybercrime game just yet.1 While it has been in business since 2006, what WhoisXML API threat researcher Dancho Danchev discovered recently seems to indicate its operators could still be up to no good.
An Iran-based hacker forum that was shut down in 2018 became active again last year.1 While our initial investigation at that time uncovered 100+ digital properties related to the group, our most recent exploration exposes thousands more.
Pay-per-install (PPI) and affiliate networks, which made headlines between 2008 and 2013, may not entirely be gone. Research by WhoisXML API threat researcher Dancho Danchev revealed that some of the domains registered using email addresses belonging to their operators remain active to this day.
Fake network devices are being sold online, some of which can bypass security functions.1 Recently, a CEO was arrested for allegedly selling about a billion dollars’ worth of counterfeit Cisco devices.2
Monkeypox was recently declared a public health emergency1 so it’s bound to gain even more attention in the coming weeks or months. Even before then, it has already been used as a phishing campaign lure,2 are we set to see more of this?
Roaming Mantis may have stolen the credentials or infected the devices of hundreds of thousands of people. The threat group did that through a smishing campaign targeting Android and iOS users. According to SEKOIA-IO,1 more than 90,000 unique IP addresses have requested XLoader from Roaming Mantis’s command-and-control (C&C) servers as of mid-July 2022.
We are here to listen. For a quick response, please select your request type. By submitting a request, you agree to our Terms of Service and Privacy Policy.
