5-Minute Domain WHOIS

The 5-Minute Domain WHOIS feed provides the most recently updated domain WHOIS records, processed on a 5-minute basis. This feed is available in both raw (unparsed) and parsed formats, making it suitable for various integration and analysis workflows.

Overview

This feed captures all domain WHOIS records that have been updated since the previous 5-minute processing cycle. The feed is available in two versions:

Raw version (5_min_domain_whois): Unparsed WHOIS data as received from registries
Parsed version (5_min_domain_whois_parsed): Structured JSON format with normalized fields

Use this feed when you need to:

Monitor domain registration changes in near real-time
Track WHOIS record updates for threat intelligence
Analyze domain ownership and contact information changes
Build domain registration databases
Detect suspicious registration patterns
Automate domain intelligence workflows

Inclusion criteria: All domain names processed since the previous 5-minute update cycle.

Format: Gzip-compressed tab-separated (TSV) or JSON text files

Size: Up to 10MB per day

Requirements

You need the following to access Threat Feeds:

An Enterprise Account with DomainTools, accessible at https://account.domaintools.com/my-account/
Authentication credentials (API key for header authentication, or API username and key for HMAC or open key authentication)
A way to interact with a REST API delivered through AWS

Obtain your API credentials from your group’s API administrator. API administrators can manage their API keys at https://research.domaintools.com, selecting the drop-down account menu and choosing API admin.

For assistance, contact enterprisesupport@domaintools.com.

Authentication

You can authenticate to the 5-Minute Domain WHOIS API using three different methods. Choose the method that best fits your security requirements and technical environment.

API key (header) authentication

Authenticate your requests by including the API key in the header of each HTTP request. The API key serves as a unique identifier and authenticates your requests.

Required header:

X-Api-Key: $DOMAINTOOLS_API_KEY

Examples:

# Raw WHOIS
curl -H "X-Api-Key: $DOMAINTOOLS_API_KEY" \
  'https://api.domaintools.com/v1/download/5_min_domain_whois/'

# Parsed WHOIS
curl -H "X-Api-Key: $DOMAINTOOLS_API_KEY" \
  'https://api.domaintools.com/v1/download/5_min_domain_whois_parsed/'

HMAC authentication

HMAC authentication is a secure alternative to API key-based methods. It requires signing each request with an HMAC digest derived from your API key, providing integrity and authenticity without exposing credentials directly in the request.

This method is recommended for systems where authentication credentials shouldn’t be stored in plain text or included directly in request URLs.

DomainTools supports MD5, SHA1, and SHA256 for the hashing algorithm. Use SHA256 — it’s the recommended choice and is more resistant to collision attacks than MD5 or SHA1.

Required query parameters:

api_username: Your DomainTools API username
signature: HMAC-SHA256 signature of api_username + timestamp + uri_path
timestamp: Current UTC timestamp in ISO 8601 format (for example, 2025-06-01T15:30:00Z)

Constructing the HMAC signature:

signature = HMAC-SHA256(api_key, api_username + timestamp + uri_path)

Example Python signing function:

import hmac
import hashlib

def sign(api_username, api_key, timestamp, uri):
    params = f"{api_username}{timestamp}{uri}"
    return hmac.new(api_key.encode("utf-8"), params.encode("utf-8"), hashlib.sha256).hexdigest()

Examples:

# Raw WHOIS with HMAC
curl 'https://api.domaintools.com/v1/download/5_min_domain_whois/?api_username=YOUR_USERNAME&signature=HMAC_SIGNATURE&timestamp=2025-01-06T15:30:00Z'

# Parsed WHOIS with HMAC
curl 'https://api.domaintools.com/v1/download/5_min_domain_whois_parsed/?api_username=YOUR_USERNAME&signature=HMAC_SIGNATURE&timestamp=2025-01-06T15:30:00Z'

Open key authentication

This is the easiest authentication scheme to implement, but also the least secure. Each request contains the full API key and API username as query parameters. We recommend using API key header authentication or HMAC authentication instead.

If you’re unsure about your authentication options, contact enterprisesupport@domaintools.com.

Required query parameters:

api_username: Your API username
api_key: Your API key

Examples:

# Raw WHOIS
curl 'https://api.domaintools.com/v1/download/5_min_domain_whois/?api_username=YOUR_USERNAME&api_key=YOUR_API_KEY'

# Parsed WHOIS
curl 'https://api.domaintools.com/v1/download/5_min_domain_whois_parsed/?api_username=YOUR_USERNAME&api_key=YOUR_API_KEY'

Daily Download API

The Daily Download API provides access to 5-minute WHOIS data through temporary AWS S3 file links. Files are organized by date and time, with new files generated every 5 minutes.

Base URLs

Raw WHOIS:

https://api.domaintools.com/v1/download/5_min_domain_whois/

Parsed WHOIS:

https://api.domaintools.com/v1/download/5_min_domain_whois_parsed/

Daily Download parameters

The Daily Download API supports standard download parameters:

`api_username`

Type: string (required for HMAC and open key auth)

Your DomainTools API username

`api_key`

Type: string (required for open key auth)

Your DomainTools API key

`signature`

Type: string (required for HMAC auth)

HMAC signature of your request

`timestamp`

Type: string (required for HMAC auth)

Current timestamp for HMAC authentication in ISO 8601 format

`limit`

Type: integer (optional)

Limit the list of signed files. Ordering of files is always descending, so the latest files are first.

`page`

Type: integer (optional)

Select which page of results are returned. Pages begin at 0 with latest results.

`prefix`

Type: string (optional)

Filter results by date and time using the file prefix (format: YYYYMMDDHHMM).

Example: ?prefix=202506242000 filters for files from June 24, 2025 at 8:00 PM

Daily Download response structure

The API returns a JSON response with signed URLs for downloadable files:

download_name (string): The feed identifier (5_min_domain_whois or 5_min_domain_whois_parsed)

files (array): List of downloadable file entries

Each file object contains:

name (string): File path
last_modified (string): Last modified date in ISO 8601 format
etag (string): Entity tag (hash of the file)
size (integer): Size in bytes
url (string): Signed AWS download URL (valid for 12 hours)

Daily Download response codes

200: OK - The request was successful

400: Bad request

401: Unauthorized

403: Forbidden

404: No data to download

Daily Download file naming

Files follow this naming pattern:

Parsed version:

YYYYMMDDTTTT.json.gz

Raw version:

YYYYMMDDTTTT.gz

Where:

YYYYMMDD = Date (e.g., 20250624)
TTTT = Time in 24-hour format (e.g., 2000 for 8:00 PM)

Examples:

202506242000.json.gz (parsed, June 24, 2025 at 8:00 PM)
202506242000.gz (raw, June 24, 2025 at 8:00 PM)

File contents

Parsed version fields

The parsed version contains JSON with the following fields:

Domain name
Parse success (y/n)
Server (WHOIS)
Lookup Date
Lookup Time
Create Date
Updated Date
Expires Date
Registrar Name
Registrar Abuse Contact: Phone
Registrar Abuse Contact: Email
Registrar IANA ID
Registrar URL
Registrar WHOIS Server
Admin Name
Admin Org
Admin Street
Admin City
Admin State/Province
Admin Postal Code
Admin Country
Admin Phone
Admin Fax
Admin Email
Billing Name
Billing Org
Billing Street
Billing City
Billing State/Province
Billing Postal Code
Billing Country
Billing Phone
Billing Fax
Billing Email
Registrant Name
Registrant Org
Registrant Street
Registrant City
Registrant State/Province
Registrant Postal Code
Registrant Country
Registrant Phone
Registrant Fax
Registrant Email
Technical Name
Technical Org
Technical Street
Technical City
Technical State/Province
Technical Postal Code
Technical Country
Technical Phone
Technical Fax
Technical Email
Name Server
Registrar Status
Raw WHOIS Data Blob

Raw version format

The raw version contains unparsed WHOIS data as tab-separated values, with the raw WHOIS text for each domain.

Daily Download examples

List available files (parsed version):

curl -H "X-Api-Key: $DOMAINTOOLS_API_KEY" \
  'https://api.domaintools.com/v1/download/5_min_domain_whois_parsed/?limit=10'

Filter by date and hour:

# Get files from June 24, 2025 at 8:00 PM
curl -H "X-Api-Key: $DOMAINTOOLS_API_KEY" \
  'https://api.domaintools.com/v1/download/5_min_domain_whois_parsed/?prefix=202506242000'

Download a specific file:

# Get the file list
curl -H "X-Api-Key: $DOMAINTOOLS_API_KEY" \
  'https://api.domaintools.com/v1/download/5_min_domain_whois_parsed/?limit=1' > files.json

# Download the file
curl -o whois-data.json.gz "$(jq -r '.response.files[0].url' files.json)"

# Decompress and view
gunzip whois-data.json.gz
head whois-data.json

Download raw version:

curl -H "X-Api-Key: $DOMAINTOOLS_API_KEY" \
  'https://api.domaintools.com/v1/download/5_min_domain_whois/?limit=1' > files.json

curl -o whois-raw.gz "$(jq -r '.response.files[0].url' files.json)"

5-Minute Domain WHOIS

Overview

Requirements

Authentication

API key (header) authentication

HMAC authentication

Open key authentication

Daily Download API

Base URLs

Daily Download parameters

api_username

api_key

signature

timestamp

limit

page

prefix

Daily Download response structure

Daily Download response codes

Daily Download file naming

File contents

Parsed version fields

Raw version format

Daily Download examples

Related resources

`api_username`

`api_key`

`signature`

`timestamp`

`limit`

`page`

`prefix`