Provide current and historical ownership information on domains / IPs. Identify all connections between domains, registrants, registrars, and DNS servers.
Look into all current and historical DNS / IP connections between domains and A, MX, NS, and other records. Monitor suspicious changes to DNS records.
Get detailed context on an IP address, including its user’s geolocation, time zone, connected domains, connection type, IP range, ASN, and other network ownership details.
Access our web-based solution to dig into and monitor all domain events of interest.
Get access to a web-based enterprise-grade solution to search and monitor domain registrations and ownership details for branded terms, fuzzy matches, registrants of interest, and more.
Independent, evidence-based DNS and abuse intelligence for applicants, advisors, governments, and counsel participating in the ICANN 2026 New gTLD Program.
Predictive threat intelligence is your best first line of defense. Subscribe to the feeds to strengthen your cybersecurity posture. Contact us today for more information.
Unlock integrated intelligence on Internet properties and their ownership, infrastructure, and other attributes.
Our complete set of domain, IP, and DNS intelligence available via API calls as an annual subscription with predictable pricing.
Offers complete access to WHOIS, IP, DNS, and subdomain data for product enrichment, threat hunting and more.
Uncover entire attack surfaces with this API to embed asset discovery, vulnerability scanning, and technology metadata into your platform. Now in early access.
Talk to our APIs using LLMs. Connect your preferred LLM to WhoisXML API and simply chat about WHOIS, DNS, threat intelligence, and more.
I’m your Domain Intelligence Assistant. I make it easy to explore WHOIS, DNS, and threat data from WhoisXML API — I’m cloud-based, fast, and always ready to help.
A custom GPT for WHOIS, DNS, IP, and threat intelligence research. Connects ChatGPT directly to WhoisXML API to enable fast, conversational investigations and domain insights.
One Universal API Credit Pool
Simplify API credit purchasing and usage with one balance that works across our product portfolio.
The same 100 records from the 2026-11 release in every variant and rendering, so the files can be compared line by line. Uncompressed, unlike the production files.
Samples contain 100 records. A monthly release holds about 470 million WHOIS records across ~1,370 TLDs.
Note: if the IP allowlist is enabled in your account settings, HTTPS downloads are accepted only from the listed IP addresses; other requests are rejected with 403 "Your IP address is not on the allowlist".
Note: if the IP allowlist is enabled in your account settings, it applies to data feed downloads as well as to API calls: FTP, FTPS and HTTPS requests from IP addresses that are not on the list are rejected with 403 "Your IP address is not on the allowlist". Add the IP addresses of every machine that downloads the data feeds before enabling it.
Read more about the FTPS connection: https://en.wikipedia.org/wiki/FTPS.
Our FTP server supports explicit FTP over TLS encryption. You may configure your FTP client to use explicit FTP over TLS encryption for secure communications.
Our FTPS server is accessed using the same paths and API keys as a regular FTP server, the instructions for which are described above. To connect via FTPS, select the "Require explicit FTP over TLS" encryption option in your FTP client, if it supports it. FileZilla configuration example:
Directory URLs return an HTML index. Files support HEAD and byte ranges, so interrupted HTTPS downloads resume with curl -C - or wget -c. Please keep downloads to a couple of parallel connections: the server is shared.
# list a release
curl -u user:$API_KEY https://download.whoisxmlapi.com/datafeeds/WHOIS_Database/monthly/2026-11/json/
# download every CSV part of one variant, resuming interrupted files
URL=https://download.whoisxmlapi.com/datafeeds/WHOIS_Database/monthly/2026-11/csv/
VARIANT=full # full | regular | simple
curl -s -u user:$API_KEY "$URL" | grep -o "whoisdb[^\"]*\.$VARIANT-[0-9]*\.csv\.zst" | sort -u \
| xargs -I{} curl -u user:$API_KEY -C - -o {} "$URL{}"
# stream one part into your tool without storing it
curl -s -u user:$API_KEY "${URL}whoisdb.2026-11-02.full-00000001.csv.zst" | zstd -dc | head
Monthly database files are compressed with zstd (Zstandard). Any zstd decoder reads them with default settings; a decoder needs about 140MB of memory per stream for full, much less for regular and simple. A file is a sequence of independent zstd frames with size markers, so pzstd (it ships with the zstd package) decompresses a single file on all cores.
zstd -dc whoisdb.2026-11-02.full-00000001.csv.zst | head # decompress to stdout
zstd -t whoisdb.2026-11-02.full-00000001.json.zst # integrity check
pzstd -dc -p 8 whoisdb.2026-11-02.full-00000001.json.zst > part.json # parallel
We are here to listen. For a quick response, please select your request type. By submitting a request, you agree to our Terms of Service and Privacy Policy.