Provide current and historical ownership information on domains / IPs. Identify all connections between domains, registrants, registrars, and DNS servers.
Look into all current and historical DNS / IP connections between domains and A, MX, NS, and other records. Monitor suspicious changes to DNS records.
Get detailed context on an IP address, including its user’s geolocation, time zone, connected domains, connection type, IP range, ASN, and other network ownership details.
Access our web-based solution to dig into and monitor all domain events of interest.
Get access to a web-based enterprise-grade solution to search and monitor domain registrations and ownership details for branded terms, fuzzy matches, registrants of interest, and more.
Detect and block access to and from dangerous domain names before malicious actors can weaponize them. Contact us today for more information.
Unlock integrated intelligence on Internet properties and their ownership, infrastructure, and other attributes.
Our complete set of domain, IP, and DNS intelligence available via API calls as an annual subscription with predictable pricing.
Offers complete access to WHOIS, IP, DNS, and subdomain data for product enrichment, threat hunting and more.
Enjoy priority data access with our premium API services topped with extra perks including dedicated team support, enterprise-grade infrastructure, and SLAs for full scalability and high performance.
Multi-Level API User Administration Now Available - Manage individual API keys for team members in your organization.
Learn More
DNS Database Download gives you access to market-leading repositories of passive DNS (pDNS), also known as historical DNS data, with the highest number of unique fully qualified domain names (FQDNs).
We offer the data through our Premium and Standard databases, each with coverage tiers, update frequencies, and DNS record types.
Gain a 360-degree view of the DNS by accessing intelligence for millions of domain names and their IP resolutions and other DNS records.
We offer different files for each DNS record type, making data processing and integration easier. All files are downloadable in CSV format.
Get full DNS data access and daily, weekly, or monthly DNS record updates to stay on top of the most recent DNS events in line with your business needs.
Access our full premium DNS database with the most extensive DNS coverage, supplemented by daily files to track DNS record changes.
Access our full standard DNS database updated weekly with standard DNS coverage, supplemented by daily files to track DNS record changes.
Maps a domain name to an IPv4 address.
Designates the mail server where emails should be sent.
Points to the authoritative server for the given domain name.
Contains information about a domain in text format.
Maps a domain name to a canonical name.
Contains data for a given domain or DNS zone.
Maps a name to an IPv6 address.
Maps an IP address to a domain name.
Take a look at our product sheet and contact us for pricing and other details.
Request a QuoteStay one step ahead by analyzing passive DNS data to detect and mitigate potential threats, such as new and existing malware variants and threat patterns.
Don’t lose sight of threat actors and their tactics, techniques, and procedures (TTPs) on the Internet. Intensify threat actor monitoring by tracking their historical DNS footprints and exposing malicious connections and infrastructures.
Reduce cyber blind spots by feeding security applications with the most extensive and complete passive DNS data, allowing users to leverage otherwise hidden and untapped intelligence.
Widen asset discovery and vulnerability management—find suspicious and malicious DNS patterns and connections by analyzing historical DNS data and verifying that you or your clients are not vulnerable.
“WhoisXML API’s passive DNS database, even the lite version for academic purposes, has much better subdomain data coverage compared with other commercial and free databases.”
“WhoisXML was the game changer for us. It has revolutionized our ability to disrupt cybercrime in process and at scale by quickly identifying all of the vendors providing material support for scammers using sophisticated website templates that look legitimate. By quickly identifying the vendors unknowingly supporting the criminals, we can provide them with public interest justification to burn down the criminal infrastructure.”
“After thorough testing, we were thrilled to find that Premium DNS 365 consistently identified 10 times more 'active' subdomains compared to other options in the market.”
We are here to listen. For a quick response, please select your request type. By submitting a request, you agree to our Terms of Service and Privacy Policy.