Monthly database

Released every month as JSON and CSV, zstd-compressed, in three variants: full (every field, including the raw WHOIS texts), regular (without the raw WHOIS texts) and simple (a compact set of parsed fields). The recommended way to get the data.

Samples

The same 100 records from the 2026-11 release in every variant and rendering, so the files can be compared line by line. Uncompressed, unlike the production files.

Full whoisdb.2026-11-02.sample-100.json JSON Full whoisdb.2026-11-02.sample-100.csv CSV Regular whoisdb.2026-11-02.regular.sample-100.json JSON Regular whoisdb.2026-11-02.regular.sample-100.csv CSV Simple whoisdb.2026-11-02.simple.sample-100.json JSON Simple whoisdb.2026-11-02.simple.sample-100.csv CSV

Sample vs Full Dataset

Samples contain 100 records. A monthly release holds about 470 million WHOIS records across ~1,370 TLDs.

Talk to our team

Data availability

The database is released monthly: a new release folder monthly/%YYYY-MM%/ appears at the beginning of each month. Every release is a full snapshot of the WHOIS records collected in the 365 days before the export date; see the FAQ.

Folders: monthly/%YYYY-MM%/json/, monthly/%YYYY-MM%/csv/
Renderings: JSON (newline-delimited, one record per line) and CSV (header row in every part, every field double-quoted). Download whichever suits your pipeline.
Parts: the serial is 8 digits starting at 00000001, with no gaps: if the highest serial is 00000063, each variant has exactly 63 parts. Part %SERIAL% holds the same records in the same order in every variant and rendering. A record is never split across parts; parts can be processed in any order and in parallel.
Compression: zstd, see Decompression.
Release size, zstd (2026-11): JSON full 197GiB, regular 44GiB, simple 38GiB; CSV full 161GiB, regular 37GiB, simple 32GiB.

Naming convention

Each release is published in three variants: full, regular and simple. They hold the same records and differ only in which fields a record has.

Full

Data included: every field, including the raw WHOIS responses (registry, registrar, cleaned text) and each contact's raw text. CSV: 96 columns.
Filename format: whoisdb.%DATE%.full-%SERIAL%.[json|csv].zst
Filename example: whoisdb.2026-11-02.full-00000001.json.zst, whoisdb.2026-11-02.full-00000001.csv.zst
Average file sizes:

File	Zstd size	Unpacked size	Rows
full-%SERIAL%.json.zst	3.1GiB	98.5GiB	7.5M
full-%SERIAL%.csv.zst	2.6GiB	57.3GiB	7.5M

Regular

Data included: full without the raw WHOIS responses (registryDataRawText, whoisRecordRawText, cleanText); keeps all five contacts with their raw text and the registrar IANA ID. CSV: 94 columns.
Filename format: whoisdb.%DATE%.regular-%SERIAL%.[json|csv].zst
Filename example: whoisdb.2026-11-02.regular-00000001.json.zst, whoisdb.2026-11-02.regular-00000001.csv.zst
Average file sizes:

File	Zstd size	Unpacked size	Rows
regular-%SERIAL%.json.zst	0.7GiB	16.7GiB	7.5M
regular-%SERIAL%.csv.zst	0.6GiB	7.9GiB	7.5M

Simple

Data included: regular without the contacts' raw text, without the billing, technical and zone contacts and without the registrar IANA ID; keeps the registrant and administrative contacts. CSV: 43 columns.
Filename format: whoisdb.%DATE%.simple-%SERIAL%.[json|csv].zst
Filename example: whoisdb.2026-11-02.simple-00000001.json.zst, whoisdb.2026-11-02.simple-00000001.csv.zst
Average file sizes:

File	Zstd size	Unpacked size	Rows
simple-%SERIAL%.json.zst	0.6GiB	9.2GiB	7.5M
simple-%SERIAL%.csv.zst	0.5GiB	4.5GiB	7.5M

Folder structure

WHOIS_Database/monthly/
└── 2026-11/                   # release month
    ├── json/                  # whoisdb.2026-11-02.{full,regular,simple}-00000001…63.json.zst
    └── csv/                   # whoisdb.2026-11-02.{full,regular,simple}-00000001…63.csv.zst

File structure

The tables below describe the full variant; what regular and simple leave out is listed at the end of each section.

Each .json.zst part is zstd-compressed newline-delimited JSON: one WHOIS record per line, no wrapper array. Keys are camelCase and every key is present in every record; a value that is unknown is an empty string (0 for registrarIANAID). Strings are UTF-8. Raw texts keep the original line breaks as |.

{
    "domainName": "knoapharma.us",
    "createdDateParsed": "2021-09-02 20:01:41 UTC",
    "updatedDateParsed": "2025-08-06 09:05:39 UTC",
    "expiresDateParsed": "2027-09-02 20:01:41 UTC",
    "createdDateRaw": "2021-09-02T20:01:41Z",
    "updatedDateRaw": "2025-08-06T09:05:39Z",
    "expiresDateRaw": "2027-09-02T20:01:41Z",
    "audit": {
        "createdDate": "2025-12-02 20:51:06 UTC",
        "updatedDate": "2025-12-02 20:51:06 UTC"
    },
    "nameServers": [
        "auth120.ns.uu.net",
        "auth111.ns.uu.net"
    ],
    "whoisServer": "whois.markmonitor.com",
    "registrarName": "MarkMonitor, Inc.",
    "registrarIANAID": 292,
    "status": "clientUpdateProhibited clientTransferProhibited clientDeleteProhibited",
    "registryDataRawText": "Domain Name: knoapharma.us|Registry Domain ID: …",
    "whoisRecordRawText": "Domain Name: knoapharma.us|Registry Domain ID: …",
    "cleanText": "Domain Name: knoapharma.us|Registry Domain ID: …",
    "contactEmail": "[email protected]",
    "registrantContact": {
        "name": "Purdue Pharma LP",
        "organization": "Purdue Pharma L.P",
        "street": "One Stamford Forum",
        "city": "Stamford",
        "state": "CT",
        "postalCode": "06901",
        "country": "UNITED STATES",
        "email": "[email protected]",
        "telephone": "12035884375",
        "telephoneExt": "",
        "fax": "",
        "faxExt": "",
        "rawText": "Registrant Name: Purdue Pharma LP|Registrant Organization: Purdue Pharma L.P|Registrant Street: One Stamford Forum|…"
    },
    "administrativeContact": { … },
    "technicalContact": { … },
    "billingContact": { … },
    "zoneContact": { … }
}

Output field description

domainName	Domain name, lower-case; IDNs in Punycode (xn--…).
createdDateParsed	The date the domain name was first registered, normalized to YYYY-MM-DD HH:MM:SS UTC.
updatedDateParsed	The date the WHOIS record was last updated, normalized to YYYY-MM-DD HH:MM:SS UTC.
expiresDateParsed	The date the domain name expires, normalized to YYYY-MM-DD HH:MM:SS UTC.
createdDateRaw	The "created" date as printed by the WHOIS server.
updatedDateRaw	The "updated" date as printed by the WHOIS server.
expiresDateRaw	The "expires" date as printed by the WHOIS server.
audit	Audit dates for the record.
audit.createdDate	When the record was collected (the collector's last visit to the domain). The snapshot contains every record whose audit.createdDate falls in the 365 days ending on the export reference date.
audit.updatedDate	When the record was last touched by our system.
nameServers	Array of name server host names.
whoisServer	The WHOIS server the record was collected from.
registrarName	Registrar name.
registrarIANAID	Registrar ID assigned by ICANN (integer); 0 when unknown.
status	Domain status codes, space-separated. See https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en
registryDataRawText	The raw WHOIS record from the registry, lines joined with "\|".
whoisRecordRawText	The raw WHOIS record from the registrar, lines joined with "\|".
cleanText	The raw WHOIS record with comment strings removed, lines joined with "\|".
contactEmail	Contact email. Typically the same as the registrant email.
registrantContact	Contains the registrant information: name — name organization — organization street — street address (the whole street, lines joined with "\|") city — city state — state / province postalCode — postal code country — country email — email telephone — telephone telephoneExt — telephone extension fax — fax faxExt — fax extension rawText — the slice of the raw WHOIS record with this contact's data, lines joined with "\|"
administrativeContact	Contains the administrative contact information, with the same fields as registrantContact.
technicalContact	Contains the technical contact information, with the same fields as registrantContact.
billingContact	Contains the billing contact information, with the same fields as registrantContact.
zoneContact	Contains the zone contact information, with the same fields as registrantContact.

regular and simple variants

The slim variants leave fields out entirely: the key is not written, it is not an empty string.

Field	regular	simple
registryDataRawText, whoisRecordRawText, cleanText	absent	absent
registrarIANAID	present	absent
registrantContact, administrativeContact	present	present, without rawText
technicalContact, billingContact, zoneContact	present	absent
all other fields	present	present

Each .csv.zst part starts with a header row. Fields are double-quoted. Embedded newlines in raw texts are replaced by |. The columns are the legacy formats, with header and order identical to the previous product generation. Column groups of the full variant (96 columns), in file order:

domainName, registrarName, contactEmail, whoisServer, nameServers,
createdDate, updatedDate, expiresDate,                                    # raw
standardRegCreatedDate, standardRegUpdatedDate, standardRegExpiresDate,   # normalized
status, RegistryData_rawText, WhoisRecord_rawText, Audit_auditUpdatedDate,
<contact>_rawText, _email, _name, _organization, _street1, _street2, _street3, _street4,
  _city, _state, _postalCode, _country, _fax, _faxExt, _telephone, _telephoneExt
  × 5 contacts: registrant, administrativeContact, billingContact, technicalContact, zoneContact,
registrarIANAID

Output field description

domainName	Domain name.
registrarName	Registrar name.
contactEmail	Contact email. Typically the same as the registrant email.
whoisServer	The WHOIS server the record was collected from.
nameServers	Name servers separated by "\|", with a trailing "\|".
createdDate	The "created" date as printed by the WHOIS server.
updatedDate	The "updated" date as printed by the WHOIS server.
expiresDate	The "expires" date as printed by the WHOIS server.
standardRegCreatedDate	The "created" date normalized to YYYY-MM-DD HH:MM:SS UTC.
standardRegUpdatedDate	The "updated" date normalized to YYYY-MM-DD HH:MM:SS UTC.
standardRegExpiresDate	The "expires" date normalized to YYYY-MM-DD HH:MM:SS UTC.
status	Domain status codes, space-separated. See https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en
RegistryData_rawText	The raw WHOIS record from the registry, lines joined with "\|".
WhoisRecord_rawText	The raw WHOIS record from the registrar, lines joined with "\|".
Audit_auditUpdatedDate	When the record was collected by our system, in YYYY-MM-DD HH:MM:SS UTC. Same value as audit.updatedDate in JSON.
registrant_*	Sixteen columns with the registrant information, in this order: registrant_rawText — The slice of the raw WHOIS record with this contact's data, lines joined with "\|". registrant_email — Email registrant_name — Name registrant_organization — Organization registrant_street1 — Street address. The whole street goes here, lines joined with "\|". registrant_street2 — Always empty; kept for column parity with earlier releases. registrant_street3 — Always empty; kept for column parity with earlier releases. registrant_street4 — Always empty; kept for column parity with earlier releases. registrant_city — City registrant_state — State / province registrant_postalCode — Postal code registrant_country — Country registrant_fax — Fax registrant_faxExt — Fax extension registrant_telephone — Telephone registrant_telephoneExt — Telephone extension
administrativeContact_*	Sixteen columns with the administrative contact information: the same columns, in the same order, as registrant_*.
billingContact_*	Sixteen columns with the billing contact information: the same columns, in the same order, as registrant_*.
technicalContact_*	Sixteen columns with the technical contact information: the same columns, in the same order, as registrant_*.
zoneContact_*	Sixteen columns with the zone contact information: the same columns, in the same order, as registrant_*.
registrarIANAID	Registrar ID assigned by ICANN; empty when unknown.

regular and simple variants

The slim variants drop columns; the remaining columns keep the order above. These are the same column sets as the legacy per-TLD tree's regular and simple formats.

regular — 94 columns: full without RegistryData_rawText and WhoisRecord_rawText.
simple — 43 columns: regular without every *_rawText column, without the billingContact_*, technicalContact_* and zoneContact_* columns and without registrarIANAID.

# simple, 43 columns
domainName, registrarName, contactEmail, whoisServer, nameServers,
createdDate, updatedDate, expiresDate,
standardRegCreatedDate, standardRegUpdatedDate, standardRegExpiresDate,
status, Audit_auditUpdatedDate,
<contact>_email, _name, _organization, _street1, _street2, _street3, _street4,
  _city, _state, _postalCode, _country, _fax, _faxExt, _telephone, _telephoneExt
  × 2 contacts: registrant, administrativeContact

WHOIS / WHOIS History

DNS / DNS History

IP Geolocation / IP Netblocks

Domain/WHOIS

DNS/IP

Intelligence

Other

Domain/WHOIS

DNS/IP

Intelligence

Other

Domain/WHOIS

DNS/IP

Intelligence

Other

Research

Monitoring

White-Label

Monthly database

Samples

Sample vs Full Dataset

Data availability

Naming convention

Full

Regular

Simple

Folder structure

File structure

Output field description

regular and simple variants

Output field description

regular and simple variants

Have questions?