Products APIs Data Feeds Web Tools Domain Research & Monitoring Enterprise Packages AI Deep Research
WHOIS / WHOIS History
WHOIS / WHOIS History

Provide current and historical ownership information on domains / IPs. Identify all connections between domains, registrants, registrars, and DNS servers.

DNS / DNS History
DNS / DNS History

Look into all current and historical DNS / IP connections between domains and A, MX, NS, and other records. Monitor suspicious changes to DNS records.

IP Geolocation / IP Netblocks
IP Geolocation / IP Netblocks

Get detailed context on an IP address, including its user’s geolocation, time zone, connected domains, connection type, IP range, ASN, and other network ownership details.

Domain Research Suite (DRS)
Domain Research Suite (DRS)

Access our web-based solution to dig into and monitor all domain events of interest.

Domain Research Suite (DRS)
Domain Research Suite (DRS)

Get access to a web-based enterprise-grade solution to search and monitor domain registrations and ownership details for branded terms, fuzzy matches, registrants of interest, and more.

New gTLD Intelligence Services (NGIS)
New gTLD Intelligence Services (NGIS)

Independent, evidence-based DNS and abuse intelligence for applicants, advisors, governments, and counsel participating in the ICANN 2026 New gTLD Program.

Research
Monitoring
White-Label
Predictive Threat Intelligence Feeds
Predictive Threat Intelligence Feeds

Predictive threat intelligence is your best first line of defense. Subscribe to the feeds to strengthen your cybersecurity posture. Contact us today for more information.

WhoisXML API Internet Infrastructure
Internet Infrastructure

Unlock integrated intelligence on Internet properties and their ownership, infrastructure, and other attributes.

Enterprise API Packages
Enterprise API Packages

Our complete set of domain, IP, and DNS intelligence available via API calls as an annual subscription with predictable pricing.

Security Intelligence (SI) Suite
Security Intelligence (SI) Suite

Offers complete access to WHOIS, IP, DNS, and subdomain data for product enrichment, threat hunting and more.

Attack Surface Discovery API
Attack Surface Discovery API

Uncover entire attack surfaces with this API to embed asset discovery, vulnerability scanning, and technology metadata into your platform. Now in early access.

MCP Server
MCP Server

Talk to our APIs using LLMs. Connect your preferred LLM to WhoisXML API and simply chat about WHOIS, DNS, threat intelligence, and more.

Jake AI
Jake AI

I’m your Domain Intelligence Assistant. I make it easy to explore WHOIS, DNS, and threat data from WhoisXML API — I’m cloud-based, fast, and always ready to help.

WhoisXML API Domain Intelligence Advisor (via ChatGPT)
WhoisXML API Domain Intelligence Advisor (via ChatGPT)

A custom GPT for WHOIS, DNS, IP, and threat intelligence research. Connects ChatGPT directly to WhoisXML API to enable fast, conversational investigations and domain insights.

Discover what you really pay for when buying commercial Internet intelligence data.

Download now
×
Contact Us
Specifications Pricing
Datafeed files Output format

Output formats

All data feed files are in the JSON Lines (.jsonl) format — one JSON record per line — and are compressed with zstd (Zstandard).

Domain info files

  • Data included: one enriched domain registration record per domain. If a field is redacted or missing in the current WHOIS or RDAP record, it is filled in with the most recent value available in historical WHOIS records.
  • Filename format: domain_info.%date%.weekly.jsonl.zst
  • Sample: domain_info.2026-07-13.weekly.jsonl.zst

Each record consists of the domain name, the data section with the domain’s registration fields, and five contact sections. Every field is an object carrying the field value, the date it was last confirmed by our system, and a flag showing whether the value was restored from historical records because it is empty or redacted in the current live record.

{
  "domainName": "example.com",
  "data": [
    {"fieldName": "createdDateISO8601", "fieldValue": "2013-07-22T00:00:00+00:00", "auditDate": "2025-05-26T14:47:11+00:00", "isEmptyOrRedactedNow": false},
    {"fieldName": "updatedDateISO8601", "fieldValue": "2013-07-22T00:00:00+00:00", "auditDate": "2025-05-26T14:47:11+00:00", "isEmptyOrRedactedNow": false},
    {"fieldName": "expiresDateISO8601", "fieldValue": "2026-03-22T20:15:53+00:00", "auditDate": "2025-05-26T14:47:11+00:00", "isEmptyOrRedactedNow": false},
    {"fieldName": "createdDateRaw", "fieldValue": "2013-07-22", "auditDate": "2025-05-26T14:47:11+00:00", "isEmptyOrRedactedNow": false},
    {"fieldName": "updatedDateRaw", "fieldValue": "2013-07-22", "auditDate": "2025-05-26T14:47:11+00:00", "isEmptyOrRedactedNow": false},
    {"fieldName": "expiresDateRaw", "fieldValue": "2026-03-22T20:15:53.197Z", "auditDate": "2025-05-26T14:47:11+00:00", "isEmptyOrRedactedNow": false},
    {"fieldName": "nameServers", "fieldValue": "ns1.example.com|ns2.example.com", "auditDate": "2025-05-26T14:47:11+00:00", "isEmptyOrRedactedNow": false},
    {"fieldName": "whoisServer", "fieldValue": "whois.example-registrar.com", "auditDate": "2025-05-26T14:47:11+00:00", "isEmptyOrRedactedNow": false},
    {"fieldName": "registrarName", "fieldValue": "Example Registrar, Inc.", "auditDate": "2025-05-26T14:47:11+00:00", "isEmptyOrRedactedNow": false},
    {"fieldName": "status", "fieldValue": "clientTransferProhibited", "auditDate": "2025-05-26T14:47:11+00:00", "isEmptyOrRedactedNow": false}
  ],
  "registrantContact": [
    {"fieldName": "name", "fieldValue": "John Doe", "auditDate": "2023-03-24T02:14:35+00:00", "isEmptyOrRedactedNow": true},
    {"fieldName": "organization", "fieldValue": "Example Inc.", "auditDate": "2023-03-24T02:14:35+00:00", "isEmptyOrRedactedNow": true},
    {"fieldName": "street", "fieldValue": "123 Example Street", "auditDate": "2023-03-24T02:14:35+00:00", "isEmptyOrRedactedNow": true},
    {"fieldName": "city", "fieldValue": "Jacksonville", "auditDate": "2023-03-24T02:14:35+00:00", "isEmptyOrRedactedNow": true},
    {"fieldName": "state", "fieldValue": "FL", "auditDate": "2023-03-24T02:14:35+00:00", "isEmptyOrRedactedNow": true},
    {"fieldName": "postalCode", "fieldValue": "32256", "auditDate": "2023-03-24T02:14:35+00:00", "isEmptyOrRedactedNow": true},
    {"fieldName": "country", "fieldValue": "UNITED STATES", "auditDate": "2023-03-24T02:14:35+00:00", "isEmptyOrRedactedNow": true},
    {"fieldName": "email", "fieldValue": "[email protected]", "auditDate": "2023-03-24T02:14:35+00:00", "isEmptyOrRedactedNow": true},
    {"fieldName": "telephone", "fieldValue": "13105551234", "auditDate": "2023-03-24T02:14:35+00:00", "isEmptyOrRedactedNow": true},
    {"fieldName": "telephoneExt", "fieldValue": "", "auditDate": "2023-03-24T02:14:35+00:00", "isEmptyOrRedactedNow": true},
    {"fieldName": "fax", "fieldValue": "", "auditDate": "2023-03-24T02:14:35+00:00", "isEmptyOrRedactedNow": true},
    {"fieldName": "faxExt", "fieldValue": "", "auditDate": "2023-03-24T02:14:35+00:00", "isEmptyOrRedactedNow": true}
  ],
  "administrativeContact": [ ... ],
  "technicalContact": [ ... ],
  "billingContact": [ ... ],
  "zoneContact": [ ... ]
}

Record structure

domainName

The associated domain name.
data

The domain’s registration record fields (dates, name servers, registrar, status). An array of field objects (see “Field object structure” below).
registrantContact

Contains registrant contact information. An array of field objects.
administrativeContact

Contains administrative contact information. The structure is the same as for the registrantContact field.
technicalContact

Contains technical contact information. The structure is the same as for the registrantContact field.
billingContact

Contains billing contact information. The structure is the same as for the registrantContact field.
zoneContact

Contains zone contact information. The structure is the same as for the registrantContact field.

Field object structure

Every field in the data and contact sections is an object with the following keys:

fieldName

The name of the field (see the field lists below).
fieldValue

The most informative value available for the field. Taken from the current WHOIS/RDAP record when defined there; otherwise restored from the most recent historical WHOIS record that contained it. An empty string if no value has ever been captured.
auditDate

The date the field’s value was last confirmed or captured by our system, in ISO 8601 format.
isEmptyOrRedactedNow

true if the field is empty or redacted in the current live record — meaning the value shown was restored from historical WHOIS data. false if the value comes from the current record.

Fields of the data section

createdDateISO8601

The date the domain was registered, in ISO 8601 format.
updatedDateISO8601

The date the domain’s registration record was last updated, in ISO 8601 format.
expiresDateISO8601

The date the domain’s registration expires, in ISO 8601 format.
createdDateRaw

The date the WHOIS record for the domain was created initially, in raw format.
updatedDateRaw

The last date the WHOIS record for the domain was updated, in raw format.
expiresDateRaw

The date the WHOIS record for the domain is expired, in raw format.
nameServers

The domain’s name servers, separated by "|".
whoisServer

The WHOIS server the record was collected from.
registrarName

Registrar name
status

Fields of the contact sections

All five contact sections (registrantContact, administrativeContact, technicalContact, billingContact, zoneContact) share the same field list:

name

The contact’s name.
organization

The contact’s organization.
street

The contact’s street address.
city

The contact’s city.
state

The contact’s state or region.
postalCode

The contact’s postal code.
country

The contact’s country.
email

The contact’s email address.
telephone

The contact’s telephone number.
telephoneExt

The contact’s telephone extension.
fax

The contact’s fax number.
faxExt

The contact’s fax extension.

Domain names files

  • Data included: the full list of domain names covered by the data feed, without their registration records.
  • Filename format: domain_names.%date%.weekly.jsonl.zst
  • Filename example: domain_names.2026-07-13.weekly.jsonl.zst
{"domainName": "example.com"}
{"domainName": "example.net"}
{"domainName": "example.org"}
...

Output field description

domainName

The associated domain name.