Domain Info API

Use Cases

• Investigating expired domains

  Expired domain names do not have current WHOIS records, but they had them at some point. Domain Info lets you find out more about them by restoring the last known details.

• Real-time threat enrichment for SIEM and SOAR

  Enrich WHOIS data instantly, even when it’s incomplete or redacted, to help link suspicious domains to known threat actors and enrich threat intelligence.

• Scaling investigations across large domain sets

  Need complete WHOIS data without manually combining historical records? Domain Info automates this — giving you enriched results in one call.

• Speeding up triage in SOC and threat response workflows

  Give analysts fast, actionable WHOIS context during triage — no need to dig through raw WHOIS history.

Frequently Asked Questions

What is Domain Info API?

Domain Info API is a new API from WhoisXML API that returns WHOIS data for any domain name, active or expired, automatically filling in fields that are redacted or missing by using the latest available historical data.

What is the difference between Domain Info and regular WHOIS lookups?

Regular WHOIS lookups often return redacted or removed data due to privacy policies. Also, they typically return nothing for expired domains. Domain Info checks historical records to see if those fields ever contained public information, and if so, fills them in using the most recent available data available in the WhoisXML API’s historical WHOIS database. This way, it can provide WHOIS data for expired domains and provide more details about those where WHOIS data is redacted.

What is the difference between Domain Info API and WHOIS History API?

Domain Info API returns a single, current WHOIS record enriched with missing details from past records. In contrast, WHOIS History API returns a full timeline of WHOIS records using WhoisXML API’s historical WHOIS Database, each one exactly as it appeared when the snapshot was made.

Where does Domain Info get the historical data it uses to fill in redacted fields?

Domain Info pulls the data from WhoisXML API’s WHOIS history database, maintained since 2010. It includes over 25.5 billion WHOIS records across 774+ million domains and 7,596+ TLDs and ccTLDs.

What types of redacted or missing fields can be restored by Domain Info?

For expired domains, Domain Info API restores entire WHOIS records from the times when the domain was still active (if such a record exists in WhoisXML API’s historical WHOIS database). For active domains, it can fill out every field where instead of actual information, the WHOIS record says “redacted.”

Regularly, domain registrant data such as their name, phone number, street address, city, state, and postal code is “redacted” in the latest WHOIS records. Domain Info API can restore the values that these fields held before redaction, where existing. It’s worth noting though, that in many cases the restored data would still reflect the contacts of the domain privacy service used by the registrar.

Some fields, such as name servers, WHOIS servers, registration dates, are never redacted. In this case, the API takes the latest available WHOIS registration data.

What happens if no historical data is available for the redacted fields?

For many domain names registered after the introduction of GDPR and other privacy-focused regulations, WHOIS details would be redacted from the moment of domain registration. For such domains, no public WHOIS data may have ever been available, so Domain Info cannot recover what was never visible. For domains that have at some point had anything other than “redacted” in those fields, Domain Info would be able to pull the latest available data.

Can Domain Info return DNS, ASN, or IP netblock data?

No, it only returns the data that has ever been in a domain name WHOIS record. Since WHOIS records do not contain IP addresses, hosting provider data, autonomous system number, or IP netblock data, Domain Info would not return this data.

However, you can use other APIs to get this data:

DNS Lookup API to get the associated IP address and other domain name’s DNS records;

IP Netblocks API for getting ASN and IP netblock details.

Does Domain Info return historical data if a domain uses a privacy protection service?

Not always. If a domain uses a privacy service, and the latest WHOIS record includes that service’s contact details, Domain Info will display them as-is. It only pulls from historical data when a field is fully redacted, not when it’s filled with privacy service data.

Does Domain Info API have a graphical user interface?

Yes, you can access Domain Info API from our Domain Research Suite (where it’s called Domain Info Search). You’ll need to create an account with WhoisXML API to work with it.