Provide current and historical ownership information on domains / IPs. Identify all connections between domains, registrants, registrars, and DNS servers.
Look into all current and historical DNS / IP connections between domains and A, MX, NS, and other records. Monitor suspicious changes to DNS records.
Get detailed context on an IP address, including its user’s geolocation, time zone, connected domains, connection type, IP range, ASN, and other network ownership details.
Access our web-based solution to dig into and monitor all domain events of interest.
Get access to a web-based enterprise-grade solution to search and monitor domain registrations and ownership details for branded terms, fuzzy matches, registrants of interest, and more.
Independent, evidence-based DNS and abuse intelligence for applicants, advisors, governments, and counsel participating in the ICANN 2026 New gTLD Program.
Predictive threat intelligence is your best first line of defense. Subscribe to the feeds to strengthen your cybersecurity posture. Contact us today for more information.
Unlock integrated intelligence on Internet properties and their ownership, infrastructure, and other attributes.
Our complete set of domain, IP, and DNS intelligence available via API calls as an annual subscription with predictable pricing.
Offers complete access to WHOIS, IP, DNS, and subdomain data for product enrichment, threat hunting and more.
Uncover entire attack surfaces with this API to embed asset discovery, vulnerability scanning, and technology metadata into your platform. Now in early access.
Talk to our APIs using LLMs. Connect your preferred LLM to WhoisXML API and simply chat about WHOIS, DNS, threat intelligence, and more.
I’m your Domain Intelligence Assistant. I make it easy to explore WHOIS, DNS, and threat data from WhoisXML API — I’m cloud-based, fast, and always ready to help.
A custom GPT for WHOIS, DNS, IP, and threat intelligence research. Connects ChatGPT directly to WhoisXML API to enable fast, conversational investigations and domain insights.
One Universal API Credit Pool
Simplify API credit purchasing and usage with one balance that works across our product portfolio.
The classic per-TLD layout of the previous product generation (gzip-compressed CSV, full / regular / simple formats), released quarterly, for scripts written against that layout.
whois_database/v57/ # domain_list_quarterly/v43/ has the same shape
├── README.txt | README.html | README.pdf # per-release manual: sizes, listings, coverage, top stats
├── docs/
│ ├── v57.tlds # all TLDs in the release, one comma-separated line
│ └── v57.csvs # same content
├── v43.csvs # ccTLD tree only: the same list at the root
└── csv/
├── domains/<tld>/
│ ├── domain_names_v57_<tld>.csv.gz # one domain per line, no header
│ ├── verified_domain_names_v57_<tld>.csv.gz # identical to domain_names_
│ ├── missing_domain_names_v57_<tld>.csv.gz # empty (see below)
│ ├── reserved_domain_names_v57_<tld>.csv.gz # empty
│ ├── thin_domain_names_v57_<tld>.csv.gz # empty
│ └── *.md5, *.sha256 for each
├── tlds/{full,regular,simple}/
│ └── csvs.<tld>.<format>.tar.gz (+ .md5, .sha256) # one tarball per TLD per format
└── tlds_combined/
└── <format>-v<N>.tar.gz.NNNN (+ .md5, .sha256) # every TLD of the tree in one tar, split in 1GiB parts
| File | Description |
|---|---|
| Per-TLD tarball | csv/tlds/%FORMAT%/csvs.%TLD%.%FORMAT%.tar.gz, %FORMAT% = full | regular | simple. Unpacks to %FORMAT%/%TLD%/%N%.csv: 100,000 data rows per file (1.csv, 2.csv, …), header in every file. |
| Combined parts | csv/tlds_combined/%FORMAT%-v%N%.tar.gz.%NNNN%: slices of one tar stream with every TLD of the tree, not standalone archives. Concatenate before extracting: cat full-v57.tar.gz.* | tar xzf -. Counts in v57 / v43: gTLD full 271 / regular 36 / simple 29 parts; ccTLD 48 / 12 / 10. |
| Domain lists | csv/domains/%TLD%/domain_names_v%N%_%TLD%.csv.gz, one domain per line, no header. The missing_, reserved_ and thin_ lists are empty, because this database lists only domains it holds a WHOIS record for; README section 4.1 shows 100% coverage for every TLD. |
| Checksums | Every data file has .md5 and .sha256 sidecars, compatible with md5sum -c / sha256sum -c. |
The formats have the same columns as the CSV variants of the Monthly database: full = 96 columns, regular = 94 columns (without RegistryData_rawText, WhoisRecord_rawText), simple = 43 columns (additionally without every *_rawText, the billing/technical/zone contacts and registrarIANAID). Column descriptions are on the Monthly database page.
Files are gzip-compressed: use unpigz rather than gunzip, which can be almost 2x slower on large files.
We are here to listen. For a quick response, please select your request type. By submitting a request, you agree to our Terms of Service and Privacy Policy.