title: DomainTools Lookups and Monitors API service_id: lookups-monitors auth_types: API Key, HMAC Signature source_url: https://docs.domaintools.com/api/lookups-monitors/ api_specification: https://docs.domaintools.com/api/lookups-monitors/lookups-monitors-openapi.yml ## Overview The Lookups and Monitors APIs provide programmatic access to DomainTools' core domain intelligence data. The API base URL is https://api.domaintools.com. Authentication uses the same methods as the Iris API family (API key or HMAC signature). Lookups return enrichment data for a given domain: WHOIS records, hosting history, DNS infrastructure, risk scores, and more. Monitors watch for changes across new domain registrations and infrastructure events, returning alerts when monitored terms or entities appear. ## Key Capabilities Lookup APIs: - Domain Profile, Domain Reputation, Domain Risk Score, Risk Score Evidence - Domain Search (find domains matching a query) - Hosting History, Parsed RDAP, Parsed WHOIS, WHOIS History, WHOIS Lookup - Reverse IP, Reverse IP WHOIS, Reverse Name Server, Reverse WHOIS Monitor APIs: - Brand Monitor: alerts on new registrations containing a monitored term - IP Monitor: alerts when a monitored IP address appears in new registrations - IP Registrant Monitor: tracks registrant changes for IP ranges - Name Server Monitor: alerts when a monitored name server appears in new registrations - Registrant Monitor: alerts when a monitored registrant name appears in new registrations ## Related Resources - Interactive API reference (ReDoc): https://docs.domaintools.com/api/lookups-monitors/api-reference.html - OpenAPI specification: https://docs.domaintools.com/api/lookups-monitors/lookups-monitors-openapi.yml - SwaggerHub: https://app.swaggerhub.com/apis/DomainToolsLLC/DomainTools_APIs/ ## This Documentation This reference covers authentication, error codes, all 15 Lookup API endpoints, and all 5 Monitor API endpoints with parameters, sample responses, and response field descriptions. --- Tip: Quick start with Python Our Python SDK provides native support for this API. Install with pip install domaintools_api --upgrade Access Lookups and Monitors tools via Web at https://research.domaintools.com and API at https://api.domaintools.com. - Links to API documentation are at page bottom. Use the API to get monitor results and lookups. - Documentation is available here for tools with their own web interface. Use the web interface to configure monitors and perform lookups. ## Authentication Authenticate with Iris authentication methods ## API and Web availability - Lookups: - Domain Profile - Domain Reputation - API and web (web via Iris) - Domain Risk Score - API and Web (web via Iris) - Risk Score Evidence - API - Domain Search - API and web - Hosting History - API and web - Parsed Domain RDAP - API and web (web via Iris) - Parsed WHOIS - API - Reverse IP - API and web - Reverse IP WHOIS - API and web - Reverse Name Server - AI and web - Reverse WHOIS - API and web - WHOIS History - API and web - WHOIS Lookup - API - Monitors: - Brand Monitor - API and web - IP Monitor - API and web - IP Registrant Monitor - API only - Name Server Monitor - API and web - Registrant Monitor - API and web Authenticate with Iris API methods. The Lookups and Monitors APIs use standard HTTP status codes to indicate the success or failure of requests. Understanding these codes helps you handle errors gracefully and troubleshoot issues effectively. ## Status Codes | Status Code | Description | | :---------- | :---------- | | 200 | OK - The request was successful. | | 206 | Partial Content - The request was partially successful. Some data is unavailable but the request returned what was available. This typically occurs when backend services are temporarily unavailable or when data for some requested items cannot be retrieved. | | 400 | Bad Request - The request is malformed or contains invalid parameters. Check the error message for details about what needs to be corrected. | | 401 | Unauthorized - Authentication credentials are missing, invalid, or expired. Verify your API key and authentication method. | | 403 | Forbidden - The authenticated account does not have permission to access this resource or endpoint. This may indicate insufficient subscription level or access rights. | | 404 | Not Found - The requested resource does not exist. This may occur when querying for a domain that has never been registered or for data that is not available in our systems. | | 500 | Internal Server Error - An unexpected error occurred on the server. If this persists, contact DomainTools support at enterprisesupport@domaintools.com. | | 503 | Service Unavailable - The service is temporarily unavailable, typically due to maintenance or high load. Implement exponential backoff and retry the request. | ## Error Response Format Error responses follow a consistent JSON structure: ```json { "error": { "code": 400, "message": "Invalid domain name format" } } ``` ## Common Error Scenarios ### Authentication Errors (401) Cause: Missing or invalid API credentials. Solutions: - Verify your API key is correct - Check that your authentication method (header, HMAC, or basic auth) is properly configured - Ensure your API key hasn't expired ### Authorization Errors (403) Cause: Insufficient permissions or subscription level. Solutions: - Verify your account has access to the requested endpoint - Check your subscription includes the API product you're trying to use - Contact your account manager if you need additional access ### Not Found Errors (404) Cause: Requested resource doesn't exist. Common scenarios: - Querying a domain that has never been registered - Requesting historical data that predates our records - Using an invalid endpoint path ### Rate Limiting (503) Cause: Too many requests in a short time period. Solutions: - Implement exponential backoff retry logic - Check your rate limits using the Account Information endpoint - Distribute requests over time rather than in bursts - Consider upgrading your subscription for higher rate limits ## Best Practices 1. Always check status codes: Don't assume success - verify the response status code 2. Parse error messages: Error messages contain specific details about what went wrong 3. Implement retry logic: Use exponential backoff for 500 and 503 errors 4. Log errors: Keep detailed logs of errors for troubleshooting 5. Monitor rate limits: Track your API usage to avoid hitting limits ## Lookups and Monitors Specific Notes ### Exception: Reverse IP WHOIS The Reverse IP WHOIS endpoint does not return 403 (Forbidden) errors. It uses all other standard error codes. Some endpoints may return additional context in their error messages: ### Exception: Parsed WHOIS When parsing fails, the API returns a 206 (Partial Content) status with the raw WHOIS record but without parsed data. The error response includes: ```json { "error": { "code": 206, "message": "We were NOT able to parse the WHOIS record" } } ``` This allows you to still access the raw WHOIS data even when automated parsing fails. ### Exception: Domain History When troubleshooting Domain History requests, you may encounter: - 401 errors: Verify your authentication credentials are correct - 429 errors: You've exceeded rate limits - implement exponential backoff While not in the standard error code list, the Domain History endpoint may return 429 errors when rate limits are exceeded. Implement exponential backoff when encountering this error. ## Rate Limiting To check your current rate limits and usage, use the Account Information endpoint. ## Getting Help If you encounter persistent errors or need assistance: - Review the API Reference for endpoint-specific details - Check the OpenAPI specification for complete API documentation - Contact support at Note: The Domain History API endpoint is specified in the Lookups and Monitors OpenAPI specification. ## Quick start ```bash # Show ownership changes for chat.com curl -H 'X-Api-Key: YOUR_API_KEY' 'https://api.domaintools.com/v1/domain-history/?domain=chat.com&include_fields=registrar' ``` ## Introduction The Domain History API provides access to DomainTools' record of changes to a domain's infrastructure, registration, and content. Track the evolution of domains across their lifecycle and identify significant events such as infrastructure weaponization, service changes, or registration transfers. This API delivers change events that show what changed, when it changed, and the before/after states for each modification. Use field filtering to focus on specific types of changes relevant to your investigation. ## Core concepts ### Change Events Each change event in the response includes: - timestamp: When the change was detected (ISO 8601 format, an international standard for date and time representation) - field: The specific property that changed (e.g., ip, mx, registrar) - before: The complete state before the change - after: The complete state after the change Note: When a domain starts a new registration lifecycle, the before field may be null or empty. The API only tracks changes within a given lifecycle, so previous lifecycle data is not included in history events. ### Registration Source The API uses one of two data sources for registration information: - parsed_whois: Traditional WHOIS data, parsed and normalized - parsed_domain_rdap: RDAP (Registration Data Access Protocol) data, the modern successor to WHOIS The registration_source field indicates which source the API used. By default, the API uses parsed_whois as the registration source. The API switches to RDAP data only when you explicitly request it or when RDAP is the only available source for the domain. ### Active Registration Period The active field in change events indicates whether a domain was actively registered at the time of the change (this field corresponds to the status field in the DomainTools user interface). Use this to distinguish modifications during the current registration period from changes in prior lifecycles. ### Historical Coverage Domain History launched in October 2021. For domains that were active before this date: - No history event records the initial transition to active status - History events only capture changes that occurred after October 2021 - The domain's state at launch serves as the baseline for subsequent change tracking ### Field Filtering Behavior Field filtering operates at the event level, not the property level: - Filtering determines which change events appear in the response - Each returned event includes the complete before and after objects for that field - Filtering doesn't remove properties from the before and after objects ## Use cases ### Detect infrastructure weaponization Pinpoint when a domain's infrastructure was weaponized by isolating changes in IP addresses, name servers, or mail servers. Example workflow: 1. Filter for infrastructure changes using include_fields=ip,nameserver_host,mailserver_host 2. Review the active field to identify changes during the current registration 3. Examine the timeline to determine when the domain was brought online for a campaign ### Monitor service activation Determine when a domain launched a functional service by identifying the first SSL certificate issuance. Example workflow: 1. Filter for SSL changes using include_fields=ssl_hash (or other SSL-related fields) 2. Find the earliest timestamp where an SSL certificate appears in the after state 3. Correlate with other infrastructure changes to understand service deployment ### Identify ownership changes Reveal transfers of domain ownership by comparing registrar and registrant data across distinct registration lifecycles. Example workflow: 1. Filter for registration changes using include_fields=registrar,registrant,create_date,expiration_date 2. Look for changes in registrar or registrant fields 3. Use the active field to distinguish between registration periods ## Authentication The Domain History API supports three authentication methods. ### Header authentication Include your API key in the X-Api-Key header: ```bash curl -H 'X-Api-Key: YOUR_API_KEY' \ 'https://api.domaintools.com/v1/domain-history/?domain=example.com' ``` ### HMAC authentication HMAC (Hash-based Message Authentication Code) authentication provides enhanced security by signing each request with a hash derived from your API secret. See the Authentication Guide for implementation details. ### Open key authentication Pass your credentials as query parameters. This method is less secure and not recommended for production use. See the Authentication Guide for implementation details. ## Request parameters ### Required parameters | Parameter | Description | Example | |-----------|-------------|---------| | domain | The domain name to retrieve history for | domaintools.com | ### Filtering parameters | Parameter | Description | Example | |-----------|-------------|---------| | include_fields | Comma-separated list of fields to include. Only change events matching these fields appear in results. | ip,mx,name_server | | exclude_fields | Comma-separated list of fields to exclude. Change events matching these fields are omitted from results. | ssl_information,web_trackers_information | ### Pagination parameters | Parameter | Description | Default | Example | |-----------|-------------|---------|---------| | page_size | Number of results per page. Maximum is 100 entries per request. | 100 | 50 | | offset | Starting point for results (0-indexed). Controls pagination across large result sets. Note: Real-time delays between paginated requests may result in duplicate data, as new changes can occur between requests. | 0 | 500 | | next | Boolean flag. When set to true, includes a next URL in the response for cursor-based pagination. Authentication parameters must still be included when following the next URL. | false | true | ### Registration data source flags | Parameter | Description | Default | |-----------|-------------|---------| | parsed_whois | Include full parsed WHOIS record in before and after objects | false | | parsed_domain_rdap | Include full parsed Domain RDAP record in before and after objects | false | ### Optional parameters | Parameter | Description | Example | |-----------|-------------|---------| | format | Response format (json, xml, html) | json | | app_partner | Your product name (for debugging) | MySecurityPlatform | | app_name | Your appliance, module, or playbook name | ThreatIntel | | app_version | Your integration version | 2.1.0 | ## Understanding field filtering ### How filtering works Field filtering determines which change events appear in the response based on the field property of each event. When you filter: - The API evaluates each change event's field value - Events matching your filter criteria are included - Events not matching are excluded - Each included event contains its complete before and after objects Important: Filtering doesn't remove properties from the before and after objects. It determines which entire change events are returned. ### Parameter format requirements The include_fields and exclude_fields parameters accept a specific format: Required format: - Comma-separated list of exact field names - No spaces before or after commas - Field names must match exactly (case-sensitive) Valid examples: ``` include_fields=ip,mx,name_server include_fields=all_ssl,registrar include_fields=ssl_hash ``` What is NOT supported: - Wildcards or patterns (e.g., ssl_, _email) - Regular expressions - Partial matches - Ranges - Spaces in the list (e.g., ip, mx is invalid) - Other delimiters besides commas Only exact field name matches work. If you need multiple related fields, use the aggregate field categories (prefixed with all_) rather than attempting pattern matching. ### Individual vs. aggregate field filtering You can filter change events using either individual field names or aggregate field groups: Individual fields target specific properties: - Use when you need precise control over which change types to include - Example: include_fields=ip,registrar returns only IP address and registrar changes Aggregate fields (prefixed with all_) group related individual fields: - Use when you want all changes within a category - Example: include_fields=all_ssl returns changes for any SSL-related field (ssl_hash, ssl_common_name, ssl_alt_names, ssl_not_before, ssl_not_after) - More efficient than listing multiple individual fields Filtering behavior: - When you specify an aggregate field, the API returns events for any of its included individual fields - You can mix individual and aggregate fields in the same request - Example: include_fields=ip,all_ssl returns IP changes plus all SSL-related changes ### Valid field names Fields are organized by category. Each category shows the aggregate field (if available) that returns events for any of the individual fields in that category. Contact Information: - Aggregate: all_contact_information — Returns events for any contact-related field - Individual fields: contact_name, contact_phone, contact_street, contact_city, contact_state, contact_fax, contact_organization Email: - Aggregate: all_emails — Returns events for any email field - Individual fields: admin_contact_email, billing_contact_email, email_dns_soa, technical_contact_email, registrant_contact_email, additional_whois_email IP and Network: - Aggregate: all_ip — Returns events for any IP-related field - Individual fields: ip, asn, ip_country_code, isp_name Mail Server: - Aggregate: all_mailserver — Returns events for any mail server field - Individual fields: mailserver_host, mailserver_ip Name Server: - Aggregate: all_nameserver — Returns events for any name server field - Individual fields: nameserver_host, nameserver_ip SSL: - Aggregate: all_ssl — Returns events for any SSL field - Individual fields: ssl_hash, ssl_common_name, ssl_alt_names, ssl_not_before, ssl_not_after Web Content: - Aggregate: all_web_content — Returns events for any web content field - Individual fields: redirect, redirect_domain, screenshot_collected_timestamp, server_type, website_response, website_title Web Trackers: - Aggregate: all_web_trackers — Returns events for any web tracker field - Individual fields: adsense, baidu_analytics, facebook, google_analytics, ga4, google_tag_manager, hotjar, matomo, statcounter_project, statcounter_security, yandex_metrica Registration: - Individual fields: create_date, expiration_date, registrant, registrar, registrar_status, active Other: - Aggregate: all_other — Returns events for remaining uncategorized fields ### Discovering available fields To get a complete list of valid field names, provide an invalid field name in your request. The API returns an error message listing all valid options. Example: ```bash curl -H 'X-Api-Key: YOUR_API_KEY' \ 'https://api.domaintools.com/v1/domain-history/?domain=example.com&include_fields=invalid_field_name' ``` ### Filtering examples Include only infrastructure changes: ```bash # Returns events where field: "ip", "mx", or "name_server" curl -H 'X-Api-Key: YOUR_API_KEY' \ 'https://api.domaintools.com/v1/domain-history/?domain=example.com&include_fields=ip,mailserver_host,nameserver_host' ``` Exclude web trackers and SSL information: ```bash # Excludes events where field matches tracking codes or "ssl_info" curl -H 'X-Api-Key: YOUR_API_KEY' \ 'https://api.domaintools.com/v1/domain-history/?domain=example.com&exclude_fields=all_web_trackers,all_ssl' ``` Focus on registration lifecycle events: ```bash # Returns events where field: "create_date", "expiration_date", "registrar", "registrant", or "active" curl -H 'X-Api-Key: YOUR_API_KEY' \ 'https://api.domaintools.com/v1/domain-history/?domain=example.com&include_fields=create_date,expiration_date,registrar,registrant,active' ``` ## Response structure ### Response format ```json { "response": { "domain": "example.com", "count": 1234, "registration_source": "parsed_whois", "changes": [ { "timestamp": "2025-10-14T09:44:26Z", "field": "mx", "before": { ... }, "after": { ... } } ] } } ``` ### Result ordering The API returns change events in the changes array in reverse chronological order, with the most recent changes appearing first. This ordering applies to the timestamp field of each change event. ### Response fields | Field | Description | |-------|-------------| | domain | The domain name queried | | count | Total number of historical changes available | | registration_source | Data source used (parsed_whois or parsed_domain_rdap) | | changes | Array of change events | ### Change event structure Each change event contains: | Field | Description | |-------|-------------| | timestamp | ISO 8601 timestamp when the change was detected | | field | The property that changed | | before | Complete state before the change (EnrichResult object) | | after | Complete state after the change (EnrichResult object) | ### EnrichResult objects The before and after objects contain comprehensive domain profile data representing the state at that point in time. Available properties include: - Domain information: domain, tld, first_seen, active - Infrastructure: ip, mx, name_server, ssl_info - Registration: create_date, expiration_date, registrar, registrant_name, registrant_org - Contacts: admin_contact, billing_contact, registrant_contact, technical_contact - Web content: website_title, website_response, server_type, redirect, redirect_domain - Trackers: adsense, google_analytics, ga4, gtm_codes, fb_codes, and others - Risk: domain_risk (with risk_score and components) - Enrichment: parsed_whois, parsed_domain_rdap (when requested) ## Common workflows ### Get all changes for a domain Retrieve the complete change history without filtering: ```bash curl -H 'X-Api-Key: YOUR_API_KEY' \ 'https://api.domaintools.com/v1/domain-history/?domain=example.com' ``` ### Filter for infrastructure changes only Focus on IP, name server, and mail server modifications: ```bash curl -H 'X-Api-Key: YOUR_API_KEY' \ 'https://api.domaintools.com/v1/domain-history/?domain=example.com&include_fields=ip,nameserver_host,mailserver_host' ``` ### Track registration changes across lifecycles Monitor registrar and registrant modifications: ```bash curl -H 'X-Api-Key: YOUR_API_KEY' \ 'https://api.domaintools.com/v1/domain-history/?domain=example.com&include_fields=registrar,registrant,create_date,expiration_date,active' ``` ### Paginate through large result sets Handle domains with extensive change history: ```bash # First page curl -H 'X-Api-Key: YOUR_API_KEY' \ 'https://api.domaintools.com/v1/domain-history/?domain=example.com&page_size=100&offset=0' # Second page curl -H 'X-Api-Key: YOUR_API_KEY' \ 'https://api.domaintools.com/v1/domain-history/?domain=example.com&page_size=100&offset=100' ``` ### Combine with parsed WHOIS data Include full parsed WHOIS records in the response: ```bash curl -H 'X-Api-Key: YOUR_API_KEY' \ 'https://api.domaintools.com/v1/domain-history/?domain=example.com&parsed_whois=true&include_fields=registrar,registrant' ``` ## Best practices ### Choosing between include_fields and exclude_fields Use include_fields when: - You need a specific subset of change types - You want to focus on a particular investigation area - You're building targeted alerts or monitoring Use exclude_fields when: - You want most changes but need to filter out noise - You're excluding large categories (e.g., web trackers) - You need everything except a few specific types Don't use both parameters in the same request. If both are provided, the API behavior is undefined. ### Pagination strategies For large result sets: 1. Start with a reasonable page_size (100-500) 2. Use the offset parameter to navigate through pages 3. Implement retry logic for network failures 4. Consider rate limits when processing multiple domains For targeted investigations: 1. Use field filtering to reduce result volume 2. Smaller page sizes (50-100) for faster initial response 3. Process pages as needed rather than fetching all data upfront ### Combining with other DomainTools APIs Domain History complements: - Hosting History: Domain History provides granular change events; Hosting History provides summarized infrastructure timeline - WHOIS History: Domain History includes registration changes; WHOIS History provides raw WHOIS records - Iris Investigate: Use Domain History to understand how a domain reached its current state shown in Iris Workflow example: 1. Use Iris Investigate to identify a suspicious domain 2. Query Domain History to understand its evolution 3. Filter for infrastructure changes during active registration 4. Cross-reference with WHOIS History for detailed registration records ### Rate limits and quotas Your subscription level determines rate limits and quotas. Monitor your usage through the Account Information endpoint: ```bash curl -H 'X-Api-Key: YOUR_API_KEY' \ 'https://api.domaintools.com/v1/account/' ``` Best practices: - Implement exponential backoff for rate limit errors (HTTP 429) - Cache results when appropriate to reduce API calls - Use field filtering to minimize response size and processing time - Batch domain queries when investigating multiple domains ## Troubleshooting ### Understanding field names Problem: Unsure which field names are valid for filtering. Solution: Make a request with an invalid field name to receive a complete list: ```bash curl -H 'X-Api-Key: YOUR_API_KEY' \ 'https://api.domaintools.com/v1/domain-history/?domain=example.com&include_fields=show_me_all_fields' ``` The error response includes all valid field names. ### Handling large response sets Problem: Response contains thousands of changes, making it difficult to process. Solution: Use field filtering to focus on relevant changes: ```bash # Instead of retrieving all changes curl -H 'X-Api-Key: YOUR_API_KEY' \ 'https://api.domaintools.com/v1/domain-history/?domain=example.com' # Filter for specific change types curl -H 'X-Api-Key: YOUR_API_KEY' \ 'https://api.domaintools.com/v1/domain-history/?domain=example.com&include_fields=ip,registrar' ``` ### Empty results Problem: Query returns no changes or fewer changes than expected. Possible causes: 1. Domain has no history: Newly registered domains may not have change events yet 2. Historical coverage limitation: For domains active before October 2021, no history event records the initial active status. Only changes after the October 2021 launch are captured. 3. Overly restrictive filtering: Your include_fields or exclude_fields parameters may filter out all events 4. Domain not found: Verify the domain name is correct and uses the apex domain (e.g., example.com, not www.example.com) Solution: Start with an unfiltered query to verify data exists, then add filtering incrementally. ### Pagination issues Problem: Pagination seems to skip results. Solution: Increment the offset parameter by the page_size value for each request. For example, with page_size=100, use offset=0 for the first page, offset=100 for the second page, and offset=200 for the third page. ### Authentication errors Problem: Receiving 401 Unauthorized errors. Solutions: - Verify your API key is correct and active - Check that the X-Api-Key header is properly formatted - For HMAC authentication, ensure the timestamp is current (within 5 minutes) - Confirm your account has access to the Domain History API ### Rate limit errors Problem: Receiving 429 Too Many Requests errors. Solutions: - Implement exponential backoff: wait before retrying - Check your rate limits via the Account Information endpoint - Reduce request frequency - Contact DomainTools support to discuss quota increases ## Additional resources - Domain History API Reference: Complete OpenAPI specification - Authentication Guide: Detailed authentication methods - Hosting History API: Summarized infrastructure timeline - WHOIS History API: Historical WHOIS records - Iris Investigate: Comprehensive domain intelligence platform For additional assistance, contact DomainTools Enterprise Support at . The Domain Profile API provides registration details for a domain name and a preview of data available from DomainTools membership and report products. ## API endpoint ```text https://api.domaintools.com/v1/{domain}/ ``` ## Parameters | Parameter | Type | Description | | --------- | ---- | ----------- | | domain | string | Required. The domain to query. Provided as a path segment in the URL. | | format | string | Response format. Valid values: json (default), html, xml. | ## Example request ```shell curl -X GET \ 'https://api.domaintools.com/v1/domaintools.com/' \ -H 'X-Api-Key: YOUR_API_KEY' ``` ## Sample response ```json { "response": { "registrant": { "name": "DomainTools, LLC", "domains": 5, "product_url": "https://reversewhois.domaintools.com/?all[]=DomainTools%2C+LLC&none[]=" }, "server": { "ip_address": "198.202.211.1", "other_domains": 384286, "product_url": "https://reverseip.domaintools.com/search/?q=domaintools.com" }, "registration": { "created": "1998-08-02", "expires": "2027-08-01", "updated": "2020-01-09", "registrar": "eNom, LLC", "statuses": [ "clientTransferProhibited" ] }, "name_servers": [ { "server": "DNS1.P04.NSONE.NET", "product_url": "https://reversens.domaintools.com/search/?q=DNS1.P04.NSONE.NET" }, { "server": "DNS2.P04.NSONE.NET", "product_url": "https://reversens.domaintools.com/search/?q=DNS2.P04.NSONE.NET" }, { "server": "DNS3.P04.NSONE.NET", "product_url": "https://reversens.domaintools.com/search/?q=DNS3.P04.NSONE.NET" }, { "server": "DNS4.P04.NSONE.NET", "product_url": "https://reversens.domaintools.com/search/?q=DNS4.P04.NSONE.NET" } ], "history": { "registrar": { "earliest_event": "", "events": 0, "product_url": "https://research.domaintools.com/research/hosting-history/?q=domaintools.com" }, "name_server": { "events": 1, "timespan_in_years": 1, "product_url": "https://research.domaintools.com/research/hosting-history/?q=domaintools.com" }, "ip_address": { "events": 92, "timespan_in_years": 22, "product_url": "https://research.domaintools.com/research/hosting-history/?q=domaintools.com" }, "whois": { "records": 7432, "earliest_event": "2001-10-26", "product_url": "https://research.domaintools.com/research/whois-history/search/?q=domaintools.com" } }, "seo": { "score": "", "product_url": "" }, "website_data": { "response_code": "", "title": "", "server": "", "meta": [], "product_url": "https://whois.domaintools.com/domaintools.com" } } } ``` Not all data elements in the response are available for all domains. ## Response fields ### registrant | Field | Type | Description | | ----- | ---- | ----------- | | name | string | Registrant name from WHOIS. | | domains | integer | Number of domains associated with this registrant. | | product_url | string | Link to a Reverse WHOIS search for this registrant. | ### server | Field | Type | Description | | ----- | ---- | ----------- | | ip_address | string | Current IP address of the domain. | | other_domains | integer | Number of other domains sharing this IP address. | | product_url | string | Link to a Reverse IP search for this domain. | ### registration | Field | Type | Description | | ----- | ---- | ----------- | | created | string | Registration creation date (YYYY-MM-DD). | | expires | string | Registration expiration date (YYYY-MM-DD). | | updated | string | Date the registration was last updated (YYYY-MM-DD). | | registrar | string | Registrar name. | | statuses | array | EPP status codes for the domain. | ### name_servers Array of name server objects. | Field | Type | Description | | ----- | ---- | ----------- | | server | string | Name server hostname. | | product_url | string | Link to a Reverse Name Server search for this host. | ### history The history object summarizes change counts across four sub-objects: registrar, name_server, ip_address, and whois. Each sub-object contains: | Field | Type | Description | | ----- | ---- | ----------- | | events | integer | Number of recorded change events. | | earliest_event | string | Date of the earliest recorded event (YYYY-MM-DD), if available. | | timespan_in_years | number | Years spanned by the recorded history (name server and IP sub-objects). | | records | integer | Number of historical WHOIS records (WHOIS sub-object only). | | product_url | string | Link to the full history in the DomainTools research portal. | ### website_data | Field | Type | Description | | ----- | ---- | ----------- | | response_code | integer | HTTP response code from the domain's website. | | title | string | HTML title of the domain's website. | | server | string | Web server software reported in the HTTP response. | | meta | array | Meta tags from the domain's website. | | product_url | string | Link to the WHOIS record for this domain. | ## Sample queries - HTML: https://api.domaintools.com/v1/domaintools.com/?format=html - JSON: https://api.domaintools.com/v1/domaintools.com/ - XML: https://api.domaintools.com/v1/domaintools.com/?format=xml The Domain Reputation API returns a risk score for a domain name, with an optional list of reasons contributing to the score. ## API endpoint ```text https://api.domaintools.com/v1/reputation/ ``` ## Parameters | Parameter | Type | Description | | --------- | ---- | ----------- | | domain | string | Required. The domain to query. If you provide a hostname (for example, www.domaintools.com) rather than a domain (for example, domaintools.com), the API attempts to return the risk score for the domain. The response always includes the domain used for the lookup. | | include_reasons | boolean | Return a list of reasons for the risk score. Valid values: true or false. Default: false. | | format | string | Response format. Valid values: json (default), html, xml. | ## Example request ```shell curl -X GET \ 'https://api.domaintools.com/v1/reputation/?domain=domaintools.com&include_reasons=true' \ -H 'X-Api-Key: YOUR_API_KEY' ``` ## Sample response ```json { "response": { "domain": "domaintools.com", "risk_score": 0, "reasons": [ "zerolist" ] } } ``` ## Response fields | Field | Type | Description | | ----- | ---- | ----------- | | domain | string | The domain queried. | | risk_score | number | Risk score from 0 (least risk) to 100 (known risk). | | reasons | array | Reasons contributing to the score. Only present when include_reasons=true. | ### Reason values | Value | Description | | ----- | ----------- | | blocklist | Domain appears on a threat blocklist. | | dns | DNS infrastructure associated with known-bad actors. | | realtime | Real-time signals indicate active malicious behavior. | | registrant | Registrant details associated with known-bad actors. | | zerolist | Domain is on a known-good list. Score is always 0. | ## Sample queries - HTML: https://api.domaintools.com/v1/reputation/?domain=domaintools.com&include_reasons=true&format=html - JSON: https://api.domaintools.com/v1/reputation/?domain=domaintools.com&include_reasons=true - XML: https://api.domaintools.com/v1/reputation/?domain=domaintools.com&include_reasons=true&format=xml Consult the Domain Risk Score documentation for more information on interpreting risk scores. ```text https://api.domaintools.com/v1/risk/ ``` The /v1/risk/ endpoint returns a domain's overall risk score and component scores. It is designed for large-scale enrichment and triage within custom tools or DomainTools SIEM/TIP integrations, and supports a higher query rate than the Risk Score Evidence API. For detailed evidence behind a domain's risk score, use the Risk Score Evidence API (/v1/risk/evidence/). Note: Example domain The examples on this page use example.com. To test with high-risk domains, use Iris Investigate or the Domain Hotlist feed to find currently active domains with elevated risk scores. ## Parameters | Parameter | Description | | --------- | ----------- | | domain | Required. The domain to query. If you provide a hostname (for example, www.domaintools.com) rather than a domain (for example, domaintools.com), the API attempts to return the risk score for the domain. The response always includes the domain used for the lookup. | ## Sample response The following sample is illustrative. Actual responses vary by domain — see Response structure for details. ```json { "response": { "domain": "example.com", "risk_score": 95, "components": [ { "name": "proximity", "risk_score": 63 }, { "name": "threat_profile", "risk_score": 95 }, { "name": "threat_profile_phishing", "risk_score": 3 }, { "name": "threat_profile_malware", "risk_score": 3 }, { "name": "threat_profile_spam", "risk_score": 95 } ] } } ``` ## Response fields | Field | Type | Description | | ----- | ---- | ----------- | | domain | string | The apex domain queried. | | risk_score | integer | Overall risk score, 0–100. The highest of all component scores. | | components | array | Risk components contributing to the overall score. Each object contains a name and risk_score. | ### Response structure The components array varies depending on the domain's risk state: | Domain state | Components returned | | ------------ | ------------------- | | Zero-listed (score 0) | zerolist only | | Low risk, no threat profile | proximity only | | Active risk | All five: proximity, threat_profile, threat_profile_phishing, threat_profile_malware, threat_profile_spam | ### Component names | name value | Description | | ------------ | ----------- | | proximity | Risk based on proximity to known threats or suspicious infrastructure. | | threat_profile | Aggregate risk score from machine learning models. | | threat_profile_malware | ML classifier for malware-related domains. | | threat_profile_phishing | ML classifier for phishing-related domains. | | threat_profile_spam | ML classifier for spam-related domains. | | zerolist | Domain is on a known-good list. Score is always 0. | ## More information Consult the Domain Risk Score documentation for more information on interpreting risk scores and understanding score components. ```text https://api.domaintools.com/v1/risk/evidence/ ``` The /v1/risk/evidence/ endpoint provides the reasons behind a domain's risk score, categorized by evidence type. Use this endpoint for deeper investigation of individual domains. For high-volume enrichment and triage, use the Domain Risk Score API (/v1/risk/), which supports a higher query rate. Note: Example domain The examples on this page use example.com. To test with high-risk domains, use Iris Investigate or the Domain Hotlist feed to find currently active domains with elevated risk scores. ## Parameters | Parameter | Description | | --------- | ----------- | | domain | Required. The domain to query. If you provide a hostname (for example, www.domaintools.com) rather than a domain (for example, domaintools.com), the API attempts to return the risk score for the domain. The response always includes the domain used for the lookup. | ## Sample response The following sample is illustrative. Actual responses vary by domain — see Response structure for details. ```json { "response": { "domain": "example.com", "risk_score": 95, "components": [ { "name": "proximity", "risk_score": 63, "evidence": [ "registrant" ] }, { "name": "threat_profile", "risk_score": 95, "threats": [ "spam" ], "evidence": [ "name server", "registrant", "registrar" ] }, { "name": "threat_profile_phishing", "risk_score": 3 }, { "name": "threat_profile_malware", "risk_score": 3 }, { "name": "threat_profile_spam", "risk_score": 95, "threats": [ "spam" ] } ] } } ``` ## Response fields ### Top-level fields | Field | Type | Description | | ----- | ---- | ----------- | | domain | string | The apex domain queried. | | risk_score | integer | Overall risk score, 0–100. | | components | array | Risk components contributing to the overall score. Each component includes an evidence array explaining the score. | ### Response structure The components array varies depending on the domain's risk state: | Domain state | Components returned | | ------------ | ------------------- | | Zero-listed (score 0) | zerolist only | | Low risk, no threat profile | proximity only | | Active risk | All five: proximity, threat_profile, threat_profile_phishing, threat_profile_malware, threat_profile_spam | ### Component objects Each object in the components array contains the following fields: | Field | Type | Description | | ----- | ---- | ----------- | | name | string | Component identifier. See Component types. | | risk_score | integer | Risk score for this component, 0–100. | | evidence | array of strings | Evidence types supporting the score. Present on proximity and threat_profile when evidence is available. See Evidence types. | | threats | array of strings | Threat categories detected. Present on threat_profile and its sub-classifiers when threats are detected. Possible values: phishing, malware, spam. | ### Component types | Component | name value | Description | | --------- | ------------ | ----------- | | Proximity | proximity | Risk based on proximity to known threats or suspicious infrastructure. | | Threat Profile | threat_profile | Aggregate risk score from machine learning models. | | Threat Profile: Malware | threat_profile_malware | ML classifier for malware-related domains. | | Threat Profile: Phishing | threat_profile_phishing | ML classifier for phishing-related domains. | | Threat Profile: Spam | threat_profile_spam | ML classifier for spam-related domains. | | Zero-listed | zerolist | Domain is on a known-good list. Score is always 0. | ### Evidence types The evidence array contains strings identifying the factors behind a component's score. Observed values include: | Evidence value | Description | | -------------- | ----------- | | age | Domain age characteristics. | | domain name | Lexical properties of the domain name. | | infrastructure | Hosting or DNS infrastructure signals. | | ip address | IP address associations. | | name server | Name server associations. | | registrant | Registrant information or patterns. | | registrar | Registrar associations. | | registration | Registration characteristics. | ## More information Consult the Domain Risk Score documentation for more information on interpreting risk scores and understanding score components. Note: Deprecated This API is deprecated and no longer available for new customers. Domain Search finds currently registered or previously registered domain names that are either currently registered or have been registered in the past under one of the major gTLD's (.com, .net, .org, .info, .us, or .biz), many country code TLDs, or the new gTLDs. You have the option to control whether the results include domain names with hyphens and/or numbers, to limit the length of domain names, and to filter for only active or deleted domains. ``` https://api.domaintools.com/v2/domain-search/?query=domain%20tools ``` ## Domain Search Parameters | Parameters | Allowed Value | Description | | ----- | ----- | ----- | | query | letters, numbers and spaces | Required. Query string — each term in the query string must be at least three characters long. Use spaces to separate multiple terms, but be sure to URL encode the values before passing them to the API. | | exclude_query | letters, numbers and spaces | Terms to exclude from matching — each term in the query string must be at least three characters long. Use spaces to separate multiple terms, but be sure to URL encode the values before passing them to the API. Default: none | | max_length | 2 … 65 | Limit the maximum domain character count. Default: 25 | | min_length | > 1 | Limit the minimum domain character count. Default: 2 | | has_hyphen | true false | Return results with hyphens in the domain name. Default: true | | has_number | true false | Return results with numbers in the domain name. Default: true | | active_only | true false | Return only domains currently registered. Default: false | | deleted_only | true false | Return only domains previously registered but not currently registered. Default: false | | anchor_left | true false | Return only domains that start with the query term. Default: false | | anchor_right | true false | Return only domains that end with the query term. Default: false | | page | > 0 | Sets the page of results to retrieve from the server. Each page is limited to 100 results. Default: 1 | Search results will include the list of domain names that match the query. The currently registered TLDs are held in the tlds response element, while those TLDs that the have ever been registered are held in the hashad_tlds element. ## Sample Response ```json { "response":{ "query_info":{ "active_only":false, "min_length":0, "total_results":477, "exclude_query":"", "has_hyphen":true, "max_length":25, "anchor_right":false, "anchor_left":false, "page":1, "limit":1000, "has_number":true, "deleted_only":false }, "results":[ { "sld":"domaintools", "tlds":["asia","at","be","biz","ca","cc","ch","cl","cm","cn","co","co.il","co.in","co.kr","co.nz","co.uk","co.za","com","com.ar","com.au","com.cn","com.ua","cz","de","dk","es","eu","fr","gr","hu","in","info","ir","it","jp","kr","lu","me","mobi","net","net.au","nl","no","nu","org","pk","pl","pt","pw","ro","se","sx","tel","tk","tv","tw","us","ws","xxx"], "hashad_tlds":["asia","at","be","biz","ca","cc","ch","cl","cm","cn","co","co.il","co.in","co.kr","co.nz","co.uk","co.za","com","com.ar","com.au","com.br","com.cn","com.ua","cz","de","dk","es","eu","fr","gr","hu","in","info","ir","it","jp","kr","lu","me","mobi","mx","name","net","net.au","nl","no","nu","org","org.uk","pk","pl","pro","pt","pw","ro","se","sk","su","sx","tel","tk","tv","tw","us","wdc","ws","xxx"], "char_count":11, "has_hyphen":0, "has_deleted":1, "has_number":0, "tlds_count":59, "has_active":1 }, { "sld":"domain-tools", "tlds":["com","com.au","de","eu","it","net","org","ru","tk"], "hashad_tlds":["asia","biz","cn","co.uk","com","com.au","com.cn","de","eu","info","it","net","org","ru","sk","tk","us"], "char_count":12, "has_hyphen":1, "has_deleted":1, "has_number":0, "tlds_count":9, "has_active":1 }, ... ] } } ``` You must provide your API credentials to use this API. ## Sample Queries - HTML: https://api.domaintools.com/v2/domain-search/?query=domain%20tools&limit=1000&format=html - JSON: https://api.domaintools.com/v2/domain-search/?query=domain%20tools&limit=1000&format=json - XML: https://api.domaintools.com/v2/domain-search/?query=domain%20tools&limit=1000&format=xml The Hosting History API provides a list of changes that have occurred in a Domain Name's IP address and name servers. IP and name server events include the value before and after the change and indicate the type of action that triggered the event. ## API endpoint ```text https://api.domaintools.com/v1/{domain}/hosting-history/ ``` ## Request parameters ### Required parameter | Parameter | Type | Description | |-----------|------|-------------| | domain | string | A valid domain name | ### Optional parameters | Parameter | Type | Description | |-----------|------|-------------| | app_name | string | Appliance, module, or playbook, or any combination of these. | | app_partner | string | Your product name. | | app_version | string | Version of your integration/connector. | | format | string | Specifies the desired response format. This accepts the values HTML, JSON, and XML. | ### Example request ```shell curl -X GET \ 'https://api.domaintools.com/v1/domaintools.com/hosting-history/?format=json' \ -H 'X-Api-Key: YOUR_API_KEY' ``` ## Response format Responses include IP and nameserver history. Each history array contains event objects with action codes: - N — New (first observed IP or nameserver) - C — Change (value changed from pre_ to post_) - D — Not Resolvable (domain stopped resolving) - T — Transfer (nameserver transferred to a new provider) ### Example response The following example is abbreviated. Actual responses may include many entries in each history array. ```json { "response": { "domain_name": "domaintools.com", "ip_history": [ { "domain": "DOMAINTOOLS.COM", "post_ip": "63.247.77.156", "pre_ip": null, "action": "N", "actiondate": "2004-05-03", "action_in_words": "New" }, { "domain": "DOMAINTOOLS.COM", "post_ip": "", "pre_ip": "63.247.77.156", "action": "D", "actiondate": "2005-10-02", "action_in_words": "Not Resolvable" }, { "domain": "DOMAINTOOLS.COM", "post_ip": "66.249.17.251", "pre_ip": "66.249.4.251", "action": "C", "actiondate": "2007-03-10", "action_in_words": "Change" } ], "nameserver_history": [ { "domain": "DOMAINTOOLS.COM", "action": "T", "actiondate": "2020-01-11", "action_in_words": "Transfer", "post_mns": "Nsone.net", "pre_mns": "Dynect.net" } ], "registrar_history": [] } } ``` Note: Deprecated field: registrar_history The registrar_history field is deprecated and always returns an empty array. It is retained in the response for backward compatibility. Do not rely on it for new integrations. ## Sample queries - HTML: https://api.domaintools.com/v1/domaintools.com/hosting-history/?format=html - JSON: https://api.domaintools.com/v1/domaintools.com/hosting-history/ - XML: https://api.domaintools.com/v1/domaintools.com/hosting-history/?format=xml ## Introduction The Parsed Domain RDAP API returns the most recent Domain-RDAP registration record in response to a HTTP GET query. This API compliments the Parsed Whois API as some registries and registrar are beginning to support RDAP as an alternative to Whois for providing domain registration data. Similar to the Parsed Whois API, the Parsed Domain RDAP API provides both parsed field data as well as the original unparsed RDAP record(s) for a domain. ### Blended RDAP Records Domain RDAP records for a given domain may be provided by a domain registry, registrar, or both. Domain registries maintain authoritative information about one or more top-level domains (e.g., .com), while domain registrars manage apex domains (e.g., domaintools.com). When domain information is present from both the registry and registrar, this API presents a blended record containing both sets of results as well the original raw JSON record from both the registry and registrar. ## Authentication The Parsed Domain-RDAP API supports Hash-Based Message Authentication Codes (HMAC) and open key authentication. ### HMAC #### Parameters | Required Parameter | Value | | :---- | :---- | | api_username | Your API username | | timestamp | Current timestamp, in ISO 8601 format, e.g.: 2024-07-01T14:37:59-0800 2024-07-01T22:37:59Z 2024-07-02T10:37:59+1200 | | signature | HMAC signature of your request, using the MD5, SHA1, or SHA256 hashing algorithm | #### Example ``` https://api.domaintools.com/v1/domaintools.com/rdap/parsed/?api_username={YOUR_USERNAME}&signature={SIGNATURE_VALUE}×tamp={TIMESTAMP_VALUE} ``` ### Open Key #### Parameters | Required Parameter | Value | | :---- | :---- | | api_username | Your API username | | api_key | Your API key | #### Example ``` https://api.domaintools.com/v1/domaintools.com/rdap/parsed/?api_username=YOUR_USERNAME&api_key=YOUR_API_KEY ``` Replace YOUR_USERNAME and YOUR_API_KEY from the URL above. ## Base URL https://api.domaintools.com/v1/ ## Endpoint GET /{domain}/rdap/parsed ## Path Parameter Specify your queried domain in the endpoint path: | Parameter | Type | Description | | :---- | :---- | :---- | | Domain | string | The domain name to query (e.g., example.com). | ## Request Example https://api.domaintools.com/v1/example.com/rdap/parsed/?api_username=YOUR_USERNAME&api_key=YOUR_API_KEY ## Response Contents ### Raw and Parsed Records for Registry and/or Registrar Each response begins with either the raw registrar record, the raw registry record, or when useful information is present in both records, the response will contain both the registrar and registry record. In this example, example.com contains only a registry record: ``` { "response": { "domain_rdap": [ { "source": "registry", "timestamp": "2024-10-16T08:20:54Z", "link": "https://rdap.verisign.com/com/v1/domain/example.com", "record": "{RAW REGISTRY RECORD}" } ], "parsed_domain_rdap": {PARSED RECORD} } } ``` In contrast, domaintools.com contains both a registry and a registrar record: ``` { "response": { "domain_rdap": [ { "source": "registry", "timestamp": "2024-10-16T00:00:55Z", "link": "https://rdap.verisign.com/com/v1/domain/domaintools.com", "record": "{RAW REGISTRY RECORD}" }, { "source": "registrar", "timestamp": "2024-10-16T00:01:07Z", "link": "https://enom.rdap.tucows.com/domain/DOMAINTOOLS.COM", "record": "{RAW REGISTRAR RECORD}" } ], "parsed_domain_rdap": {PARSED RECORD}, "record_source": "domaintools.com" } } ``` ## Response Codes and Error Handling Well-formed queries receive a 200 OK response. | Status Code | Description | | :---------- | :---------- | | 400 | No domain provided | | 403 | Authentication failed (forbidden) | | 404 | No data available | | 422 | Domain validation failed (likely not a domain name) | | 500 | Internal server error | | 503 | Service limit reached | ## Full Response Example The following full response for espn.com consists of registry and registrar records. ``` { "response": { "domain_rdap": [ { "source": "registry", "timestamp": "2024-10-14T17:05:43Z", "link": "https://rdap.verisign.com/com/v1/domain/espn.com", "record": "{\"objectClassName\":\"domain\",\"handle\":\"1925816_DOMAIN_COM-VRSN\",\"ldhName\":\"ESPN.COM\",\"links\":[{\"value\":\"https:\\/\\/rdap.verisign.com\\/com\\/v1\\/domain\\/ESPN.COM\",\"rel\":\"self\",\"href\":\"https:\\/\\/rdap.verisign.com\\/com\\/v1\\/domain\\/ESPN.COM\",\"type\":\"application\\/rdap+json\"},{\"value\":\"https:\\/\\/apis.cscglobal.com\\/dbs\\/rdap-api\\/v1\\/domain\\/ESPN.COM\",\"rel\":\"related\",\"href\":\"https:\\/\\/apis.cscglobal.com\\/dbs\\/rdap-api\\/v1\\/domain\\/ESPN.COM\",\"type\":\"application\\/rdap+json\"}],\"status\":[\"client transfer prohibited\",\"server delete prohibited\",\"server transfer prohibited\",\"server update prohibited\"],\"entities\":[{\"objectClassName\":\"entity\",\"handle\":\"299\",\"roles\":[\"registrar\"],\"publicIds\":[{\"type\":\"IANA Registrar ID\",\"identifier\":\"299\"}],\"vcardArray\":[\"vcard\",[[\"version\",{},\"text\",\"4.0\"],[\"fn\",{},\"text\",\"CSC Corporate Domains, Inc.\"]]],\"entities\":[{\"objectClassName\":\"entity\",\"roles\":[\"abuse\"],\"vcardArray\":[\"vcard\",[[\"version\",{},\"text\",\"4.0\"],[\"fn\",{},\"text\",\"\"],[\"tel\",{\"type\":\"voice\"},\"uri\",\"tel:8887802723\"],[\"email\",{},\"text\",\"domainabuse@cscglobal.com\"]]]}]}],\"events\":[{\"eventAction\":\"registration\",\"eventDate\":\"1994-10-04T04:00:00Z\"},{\"eventAction\":\"expiration\",\"eventDate\":\"2025-10-03T04:00:00Z\"},{\"eventAction\":\"last changed\",\"eventDate\":\"2024-08-28T15:12:11Z\"},{\"eventAction\":\"last update of RDAP database\",\"eventDate\":\"2024-10-14T17:05:35Z\"}],\"secureDNS\":{\"delegationSigned\":false},\"nameservers\":[{\"objectClassName\":\"nameserver\",\"ldhName\":\"NS-1045.AWSDNS-02.ORG\"},{\"objectClassName\":\"nameserver\",\"ldhName\":\"NS-122.AWSDNS-15.COM\"},{\"objectClassName\":\"nameserver\",\"ldhName\":\"NS-1936.AWSDNS-50.CO.UK\"},{\"objectClassName\":\"nameserver\",\"ldhName\":\"NS-846.AWSDNS-41.NET\"}],\"rdapConformance\":[\"rdap_level_0\",\"icann_rdap_technical_implementation_guide_0\",\"icann_rdap_response_profile_0\"],\"notices\":[{\"title\":\"Terms of Use\",\"description\":[\"Service subject to Terms of Use.\"],\"links\":[{\"href\":\"https:\\/\\/www.verisign.com\\/domain-names\\/registration-data-access-protocol\\/terms-service\\/index.xhtml\",\"type\":\"text\\/html\"}]},{\"title\":\"Status Codes\",\"description\":[\"For more information on domain status codes, please visit https:\\/\\/icann.org\\/epp\"],\"links\":[{\"href\":\"https:\\/\\/icann.org\\/epp\",\"type\":\"text\\/html\"}]},{\"title\":\"RDDS Inaccuracy Complaint Form\",\"description\":[\"URL of the ICANN RDDS Inaccuracy Complaint Form: https:\\/\\/icann.org\\/wicf\"],\"links\":[{\"href\":\"https:\\/\\/icann.org\\/wicf\",\"type\":\"text\\/html\"}]}]}" }, { "source": "registrar", "timestamp": "2024-10-14T17:05:45Z", "link": "https://apis.cscglobal.com/dbs/rdap-api/v1/domain/ESPN.COM", "record": "{\"rdapConformance\":[\"rdap_level_0\",\"icann_rdap_technical_implementation_guide_0\",\"icann_rdap_response_profile_0\"],\"objectClassName\":\"domain\",\"handle\":\"1925816_DOMAIN_COM-VRSN\",\"ldhName\":\"espn.com\",\"secureDNS\":{\"delegationSigned\":false},\"notices\":[{\"title\":\"Terms of Use\",\"description\":[\"Service subject to Terms of Use.\"],\"links\":[{\"value\":\"https://apis.cscglobal.com/dbs/rdap-api/v1/domain/espn.com\",\"rel\":\"self\",\"href\":\"https://apis.cscglobal.com/dbs/rdap-api/v1/domain/espn.com\",\"type\":\"text/html\"}]},{\"title\":\"Status Codes\",\"description\":[\"For more information on domain status codes, please visit https://icann.org/epp.\"],\"links\":[{\"value\":\"https://apis.cscglobal.com/dbs/rdap-api/v1/domain/espn.com\",\"rel\":\"glossary\",\"href\":\"https://icann.org/epp\",\"type\":\"text/html\"}]},{\"title\":\"RDDS Inaccuracy Complaint Form\",\"description\":[\"URL of the ICANN RDDS Inaccuracy Complaint Form: https://icann.org/wicf.\"],\"links\":[{\"value\":\"https://apis.cscglobal.com/dbs/rdap-api/v1/domain/espn.com\",\"rel\":\"help\",\"href\":\"https://icann.org/wicf\",\"type\":\"text/html\"}]}],\"nameservers\":[{\"objectClassName\":\"nameserver\",\"ldhName\":\"ns-846.awsdns-41.net\"},{\"objectClassName\":\"nameserver\",\"ldhName\":\"ns-1045.awsdns-02.org\"},{\"objectClassName\":\"nameserver\",\"ldhName\":\"ns-1936.awsdns-50.co.uk\"},{\"objectClassName\":\"nameserver\",\"ldhName\":\"ns-122.awsdns-15.com\"}],\"entities\":[{\"objectClassName\":\"entity\",\"handle\":\"299\",\"roles\":[\"registrar\"],\"publicIds\":[{\"type\":\"IANA Registrar ID\",\"identifier\":\"299\"}],\"vcardArray\":[\"vcard\",[[\"version\",{},\"text\",\"4.0\"],[\"fn\",{},\"text\",\"CSC Corporate Domains, Inc.\"],[\"adr\",{\"cc\":\"US\"},\"text\",[\"\",\"\",\"251 Little Falls Drive\",\"Wilmington\",\"DE\",\"19808\",\"\"]],[\"email\",{},\"text\",\"admin@internationaladmin.com\"],[\"tel\",{\"type\":\"voice\"},\"uri\",\"tel:+1.3026365400\"],[\"tel\",{\"type\":\"fax\"},\"uri\",\"tel:+1.3026365400\"]]],\"entities\":[{\"objectClassName\":\"entity\",\"roles\":[\"abuse\"],\"vcardArray\":[\"vcard\",[[\"version\",{},\"text\",\"4.0\"],[\"fn\",{},\"text\",\"Abuse Contact\"],[\"email\",{},\"text\",\"domainabuse@cscglobal.com\"],[\"tel\",{\"type\":\"voice\"},\"uri\",\"tel:+1.8887802723\"]]]}]},{\"objectClassName\":\"entity\",\"roles\":[\"administrative\"],\"vcardArray\":[\"vcard\",[[\"version\",{},\"text\",\"4.0\"],[\"fn\",{},\"text\",\"ESPN, Inc.\"],[\"org\",{},\"text\",\"ESPN, Inc.\"],[\"adr\",{\"cc\":\"US\"},\"text\",[\"\",\"\",\"935 Middle Street\",\"Bristol\",\"CT\",\"06010-1001\",\"\"]],[\"email\",{},\"text\",\"domreg@espn.com\"],[\"tel\",{\"type\":\"voice\"},\"uri\",\"tel:+1.8607662000\"],[\"tel\",{\"type\":\"fax\"},\"uri\",\"tel:+1.8607664502\"]]]},{\"objectClassName\":\"entity\",\"roles\":[\"technical\"],\"vcardArray\":[\"vcard\",[[\"version\",{},\"text\",\"4.0\"],[\"fn\",{},\"text\",\"ESPN, Inc.\"],[\"org\",{},\"text\",\"ESPN, Inc.\"],[\"adr\",{\"cc\":\"US\"},\"text\",[\"\",\"\",\"935 Middle Street\",\"Bristol\",\"CT\",\"06010-1001\",\"\"]],[\"email\",{},\"text\",\"domreg@espn.com\"],[\"tel\",{\"type\":\"voice\"},\"uri\",\"tel:+1.8607662000\"],[\"tel\",{\"type\":\"fax\"},\"uri\",\"tel:+1.8607664502\"]]]},{\"objectClassName\":\"entity\",\"roles\":[\"registrant\"],\"vcardArray\":[\"vcard\",[[\"version\",{},\"text\",\"4.0\"],[\"fn\",{},\"text\",\"ESPN, Inc.\"],[\"org\",{},\"text\",\"ESPN, Inc.\"],[\"adr\",{\"cc\":\"US\"},\"text\",[\"\",\"\",\"935 Middle Street\",\"Bristol\",\"CT\",\"06010-1001\",\"\"]],[\"email\",{},\"text\",\"domreg@espn.com\"],[\"tel\",{\"type\":\"voice\"},\"uri\",\"tel:+1.8607662000\"],[\"tel\",{\"type\":\"fax\"},\"uri\",\"tel:+1.8607664502\"]]]}],\"events\":[{\"eventAction\":\"registration\",\"eventDate\":\"1994-10-04T00:00:00Z\"},{\"eventAction\":\"expiration\",\"eventDate\":\"2025-10-03T04:00:00Z\"},{\"eventAction\":\"last update of RDAP database\",\"eventDate\":\"2024-10-14T12:55:47Z\"}],\"status\":[\"server delete prohibited\",\"server update prohibited\",\"server transfer prohibited\",\"client transfer prohibited\"]}" } ], "parsed_domain_rdap": { "domain": "espn.com", "handle": "1925816_DOMAIN_COM-VRSN", "domain_statuses": [ "server delete prohibited", "server update prohibited", "server transfer prohibited", "client transfer prohibited" ], "creation_date": "1994-10-04T00:00:00+00:00", "last_changed_date": "2024-08-28T15:12:11+00:00", "expiration_date": "2025-10-03T04:00:00+00:00", "registrar": { "name": "CSC Corporate Domains, Inc.", "iana_id": "299", "contacts": [ { "handle": null, "name": "Abuse Contact", "org": null, "email": "domainabuse@cscglobal.com", "phone": "tel:+1.8887802723", "street": null, "city": null, "postal": null, "region": null, "country": null, "fax": null, "roles": [ "abuse" ] } ] }, "contacts": [ { "handle": null, "name": "ESPN, Inc.", "org": "ESPN, Inc.", "email": "domreg@espn.com", "phone": "tel:+1.8607662000", "street": "935 Middle Street", "city": "Bristol", "postal": "06010-1001", "region": "CT", "country": "US", "fax": "tel:+1.8607664502", "roles": [ "administrative" ] }, { "handle": null, "name": "ESPN, Inc.", "org": "ESPN, Inc.", "email": "domreg@espn.com", "phone": "tel:+1.8607662000", "street": "935 Middle Street", "city": "Bristol", "postal": "06010-1001", "region": "CT", "country": "US", "fax": "tel:+1.8607664502", "roles": [ "technical" ] }, { "handle": null, "name": "ESPN, Inc.", "org": "ESPN, Inc.", "email": "domreg@espn.com", "phone": "tel:+1.8607662000", "street": "935 Middle Street", "city": "Bristol", "postal": "06010-1001", "region": "CT", "country": "US", "fax": "tel:+1.8607664502", "roles": [ "registrant" ] } ], "dnssec": { "signed": false }, "nameservers": [ "ns-846.awsdns-41.net", "ns-1045.awsdns-02.org", "ns-1936.awsdns-50.co.uk", "ns-122.awsdns-15.com" ], "conformance": [ "rdap_level_0", "icann_rdap_technical_implementation_guide_0", "icann_rdap_response_profile_0" ], "emails": [ "admin@internationaladmin.com", "domainabuse@cscglobal.com", "domreg@espn.com" ], "email_domains": [ "cscglobal.com", "espn.com", "internationaladmin.com" ], "unclassified_emails": [ "admin@internationaladmin.com" ] }, "record_source": "espn.com" } } ``` The Parsed WHOIS API provides parsed information extracted from the raw WHOIS record. The API is optimized to quickly retrieve the WHOIS record, group important data together and return a well-structured format. The Parsed WHOIS API is ideal for anyone wishing to search for, index, or cross-reference data from one or multiple WHOIS records. ``` https://api.domaintools.com/v1/domaintools.com/whois/parsed ``` The successful retrieval and parsing of a record will always return at least two key pieces of information in its response; the most recent WHOIS record of the domain or IP address range you requested and the parsed out data represented in JSON or XML format. In rare cases, parsing a record may not be successful. If that occurs, the system will respond with an 206 (partial content) and return an error code with error message. It will still return the WHOIS record even if it has failed to parse. ## Parsed Data Format The Parsed WHOIS API formatting returns a JSON or XML structure that contains key-value pairing data grouped together by similar data characteristics. Some key data points for domains include contact information for registrant, admins, tech, billing information, registrar information, registrar, name servers, and important date information about the record like expiration, created, and updated. In addition, each piece of data that is parsed is normalized to a consistent format to ensure consistency. Normalization affects dates, country and phone number data as well as lowercases all data parsed. In the event that a normalization could not be applied, the original parsed data is returned for that specific key/value pairing. IP addresses have their own set of parsed and normalized data points such as network ranges and contact information for each range. Note that not all data elements will be available for all domains or IP addresses. What is available depends on the WHOIS record returned for that domain or IP address. ## Sample Response: Successful Parsed Record for a Domain ```json { response: { registrant: "DomainTools, LLC", registration: { created: "1998-08-02", expires: "2014-08-01", updated: "2014-06-27", registrar: "NAME TRANCE LLC", statuses: [ "clientTransferProhibited" ] }, name_servers: [ "NS1.P09.DYNECT.NET", "NS2.P09.DYNECT.NET", "NS3.P09.DYNECT.NET", "NS4.P09.DYNECT.NET" ], parsed_whois: { domain: "domaintools.com", created_date: "1998-08-02T00:00:00", updated_date: "2013-11-02T06:39:18", expired_date: "2014-08-02T00:00:00", statuses: [ ], name_servers: [ "ns1.p09.dynect.net", "ns2.p09.dynect.net", "ns3.p09.dynect.net", "ns4.p09.dynect.net" ], registrar: { name: "CheapRegistrar (R627)", abuse_contact_phone: "", abuse_contact_email: "", iana_id: "", url: "http://www.cheap-registrar.com", whois_server: "" }, contacts: { registrant: { name: "Domain Administrator", org: "DomainTools, LLC", street: [ "2211 5th Avenue", "Suite 201" ], city: "Seattle", state: "WA", postal: "98121", country: "US", phone: "12068389035", fax: "12068389056", email: "memberservices@domaintools.com" }, admin: { name: "Domain Administrator", org: "DomainTools, LLC", street: [ "2211 5th Avenue", "Suite 201" ], city: "Seattle", state: "WA", postal: "98121", country: "US", phone: "12068389035", fax: "12068389056", email: "memberservices@domaintools.com" }, tech: { name: "Domain Administrator", org: "DomainTools, LLC", street: [ "2211 5th Avenue", "Suite 201" ], city: "Seattle", state: "WA", postal: "98121", country: "US", phone: "12068389035", fax: "12068389056", email: "memberservices@domaintools.com" }, billing: { name: "", org: "", street: [ ], city: "", state: "", postal: "", country: "", phone: "", fax: "", email: "" } }, other_properties: { } } whois: { date: "2014-07-20", record: "Domain Name: DOMAINTOOLS.COMnRegistrar URL: http://www.cheap-registrar.comnUpdated Date: 2013-11-02 06:39:18nCreation Date: 1998-08-02 00:00:00nRegistrar Expiration Date: 2014-08-02 00:00:00nRegistrar: CheapRegistrar (R627)nRegistrant Name: Domain AdministratornRegistrant Organization: DomainTools, LLCnRegistrant Street: 2211 5th AvenuenRegistrant Street: Suite 201nRegistrant City: SeattlenRegistrant State/Province: WAnRegistrant Postal Code: 98121nRegistrant Country: USnRegistrant Phone: +1.2068389035nRegistrant Fax: +1.2068389056nRegistrant Email: memberservices@domaintools.comnAdmin Name: Domain AdministratornAdmin Organization: DomainTools, LLCnAdmin Street: 2211 5th AvenuenAdmin Street: Suite 201nAdmin City: SeattlenAdmin State/Province: WAnAdmin Postal Code: 98121nAdmin Country: USnAdmin Phone: +1.2068389035nAdmin Fax: +1.2068389056nAdmin Email: memberservices@domaintools.comnTech Name: Domain AdministratornTech Organization: DomainTools, LLCnTech Street: 2211 5th AvenuenTech Street: Suite 201nTech City: SeattlenTech State/Province: WAnTech Postal Code: 98121nTech Country: USnTech Phone: +1.2068389035nTech Fax: +1.2068389056nTech Email: memberservices@domaintools.comnName Server: NS1.P09.DYNECT.NETnName Server: NS2.P09.DYNECT.NETnName Server: NS3.P09.DYNECT.NETnName Server: NS4.P09.DYNECT.NETn" }, } } ``` ## Sample Response: Failed Parsed Record for a Domain ```json { response: { error: { code: 206, message: "We were NOT able to parse the WHOIS record." }, registrant: "DomainTools, LLC", registration: { created: "1998-08-02", expires: "2014-08-01", updated: "2014-06-27", registrar: "NAME TRANCE LLC", statuses: [ "clientTransferProhibited" ] }, name_servers: [ "NS1.P09.DYNECT.NET", "NS2.P09.DYNECT.NET", "NS3.P09.DYNECT.NET", "NS4.P09.DYNECT.NET" ], whois: { date: "2014-07-20", record: "Domain Name: DOMAINTOOLS.COMnRegistrar URL: http://www.cheap-registrar.comnUpdated Date: 2013-11-02 06:39:18nCreation Date: 1998-08-02 00:00:00nRegistrar Expiration Date: 2014-08-02 00:00:00nRegistrar: CheapRegistrar (R627)nRegistrant Name: Domain AdministratornRegistrant Organization: DomainTools, LLCnRegistrant Street: 2211 5th AvenuenRegistrant Street: Suite 201nRegistrant City: SeattlenRegistrant State/Province: WAnRegistrant Postal Code: 98121nRegistrant Country: USnRegistrant Phone: +1.2068389035nRegistrant Fax: +1.2068389056nRegistrant Email: memberservices@domaintools.comnAdmin Name: Domain AdministratornAdmin Organization: DomainTools, LLCnAdmin Street: 2211 5th AvenuenAdmin Street: Suite 201nAdmin City: SeattlenAdmin State/Province: WAnAdmin Postal Code: 98121nAdmin Country: USnAdmin Phone: +1.2068389035nAdmin Fax: +1.2068389056nAdmin Email: memberservices@domaintools.comnTech Name: Domain AdministratornTech Organization: DomainTools, LLCnTech Street: 2211 5th AvenuenTech Street: Suite 201nTech City: SeattlenTech State/Province: WAnTech Postal Code: 98121nTech Country: USnTech Phone: +1.2068389035nTech Fax: +1.2068389056nTech Email: memberservices@domaintools.comnName Server: NS1.P09.DYNECT.NETnName Server: NS2.P09.DYNECT.NETnName Server: NS3.P09.DYNECT.NETnName Server: NS4.P09.DYNECT.NETn" }, } } ``` ## Sample Response: Successful Parsed Record for an IP Address ```json { "response": { "registrant": "AT&T Services, Inc.", "record_source": "12.0.0.1" "parsed_whois": { "networks": [ { "id": "NET-12-0-0-0-1", "range": { "from": "12.0.0.0", "to": "12.255.255.255", "cidr": ["12.0.0.0/8"], "count": 16777216 }, "asn": [""], "name": "ATT", "org": "AT&T Services, Inc. (ATTW-Z)", "parent": "NET12 (NET-12-0-0-0-0)", "parent_id": "NET-12-0-0-0-0", "customer": "", "country": "", "phone": [], "descr": ["For abuse issues contact abuse@att.net"], "contact_keys": { "org": ["ATTW-Z"], "tech": ["IAA17-ARIN"] }, "status": "Direct Allocation", "remarks": [], "notify_email": [], "mnt_keys": {}, "created_date": "1983-08-23", "updated_date": "2013-12-19", "changed_by": [], "source": "", "ref": "http://whois.arin.net/rest/net/NET-12-0-0-0-1", "other": {} }, { "id": "NET-12-0-0-0-2", "range": { "from": "12.0.0.0", "to": "12.0.0.255", "cidr": ["12.0.0.0/24"], "count": 256 }, "asn": [""], "name": "ATT-LIN850-0", "org": "ATT LINCROFT ORT (ALO-3)", "parent": "ATT (NET-12-0-0-0-1)", "parent_id": "NET-12-0-0-0-1", "customer": "", "country": "", "phone": [], "descr": [], "contact_keys": { "org": ["ALO-3"] }, "status": "Reassigned", "remarks": [], "notify_email": [], "mnt_keys": {}, "created_date": "2004-01-06", "updated_date": "2004-01-06", "changed_by": [], "source": "", "ref": "http://whois.arin.net/rest/net/NET-12-0-0-0-2", "other": {} } ], "contacts": [ { "id": "IAA17-ARIN", "type": "person", "name": "IP Address Administration", "address": [], "country": "", "phone": ["17324202071"], "fax": [], "email": ["addrmgt@qsun.att.com"], "descr": [], "contact_keys": {}, "remarks": [], "notify_email": [], "abuse_mailbox": [], "mnt_keys": {}, "created_date": "", "updated_date": "", "changed_by": [], "source": "", "ref": "http://whois.arin.net/rest/poc/IAA17-ARIN", "other": {} }, { "id": "ATTAB-ARIN", "type": "person", "name": "ATT Abuse", "address": [], "country": "", "phone": ["19193198130"], "fax": [], "email": ["abuse@att.net"], "descr": [], "contact_keys": {}, "remarks": [], "notify_email": [], "abuse_mailbox": [], "mnt_keys": {}, "created_date": "", "updated_date": "", "changed_by": [], "source": "", "ref": "http://whois.arin.net/rest/poc/ATTAB-ARIN", "other": {} }, { "id": "IPSWI-ARIN", "type": "person", "name": "IP SWIP", "address": [], "country": "", "phone": ["18886136330"], "fax": [], "email": ["swipid@icorefep1.ims.att.com"], "descr": [], "contact_keys": {}, "remarks": [], "notify_email": [], "abuse_mailbox": [], "mnt_keys": {}, "created_date": "", "updated_date": "", "changed_by": [], "source": "", "ref": "http://whois.arin.net/rest/poc/IPSWI-ARIN", "other": {} }, { "id": "CMU8-ARIN", "type": "person", "name": "Muhlhausen, Carl", "address": [], "country": "", "phone": ["17325763052"], "fax": [], "email": ["ledzep@att.com"], "descr": [], "contact_keys": {}, "remarks": [], "notify_email": [], "abuse_mailbox": [], "mnt_keys": {}, "created_date": "", "updated_date": "", "changed_by": [], "source": "", "ref": "http://whois.arin.net/rest/poc/CMU8-ARIN", "other": {} }, { "id": "ALO-3", "type": "organization", "name": "ATT LINCROFT ORT", "address": [ "12976 HOLLENBERG", "BRIDGETON", "MO", "63044" ], "country": "us", "phone": [], "fax": [], "email": [], "descr": [], "contact_keys": { "abuse": ["CMU8-ARIN"], "tech": ["CMU8-ARIN"] }, "remarks": [], "notify_email": [], "abuse_mailbox": [], "mnt_keys": {}, "created_date": "2003-08-22", "updated_date": "2011-09-24", "changed_by": [], "source": "", "ref": "http://whois.arin.net/rest/org/ALO-3", "other": {} }, { "id": "ICC-ARIN", "type": "person", "name": "IP Team", "address": [], "country": "", "phone": ["18886136330"], "fax": [], "email": ["rm-ipspecialist@att.com"], "descr": [], "contact_keys": {}, "remarks": [], "notify_email": [], "abuse_mailbox": [], "mnt_keys": {}, "created_date": "", "updated_date": "", "changed_by": [], "source": "", "ref": "http://whois.arin.net/rest/poc/ICC-ARIN", "other": {} }, { "id": "JB3310-ARIN", "type": "person", "name": "Borkenhagen, Jay C.", "address": [], "country": "", "phone": ["17324202526"], "fax": [], "email": ["jayb@att.com"], "descr": [], "contact_keys": {}, "remarks": [], "notify_email": [], "abuse_mailbox": [], "mnt_keys": {}, "created_date": "", "updated_date": "", "changed_by": [], "source": "", "ref": "http://whois.arin.net/rest/poc/JB3310-ARIN", "other": {} }, { "id": "ATTW-Z", "type": "organization", "name": "AT&T Services, Inc.", "address": [ "200 S. Laurel AVE.", "MIDDLETOWN", "NJ", "07748" ], "country": "us", "phone": [], "fax": [], "email": [], "descr": [ "Contact AT&T Abuse ( abuse@att.net ) for policy abuse issues.", "All policy abuse issues sent to other POCs will be disregarded." ], "contact_keys": { "abuse": [ "ATTAB-ARIN" ], "tech": [ "IPSWI-ARIN", "ICC-ARIN", "JB3310-ARIN" ] }, "remarks": [], "notify_email": [], "abuse_mailbox": [], "mnt_keys": {}, "created_date": "2009-12-18", "updated_date": "2013-01-18", "changed_by": [], "source": "", "ref": "http://whois.arin.net/rest/org/ATTW-Z", "other": {} } ], "routes": [], "referral_servers": [], "other_properties": [] }, "whois": { "date": "2015-11-07", "record": "NetRange: 12.0.0.0 - 12.255.255.255nCIDR: 12.0.0.0/8nNetName: ATTnNetHandle: NET-12-0-0-0-1nParent: NET12 (NET-12-0-0-0-0)nNetType: Direct AllocationnOriginAS: nOrganization: AT&T Services, Inc. (ATTW-Z)nRegDate: 1983-08-23nUpdated: 2013-12-19nComment: For abuse issues contact abuse@att.netnRef: http://whois.arin.net/rest/net/NET-12-0-0-0-1nnOrgName: AT&T Services, Inc.nOrgId: ATTW-ZnAddress: 200 S. Laurel AVE.nCity: MIDDLETOWNnStateProv: NJnPostalCode: 07748nCountry: USnRegDate: 2009-12-18nUpdated: 2013-01-18nComment: Contact AT&T Abuse ( abuse@att.net ) for policy abuse issues.nComment: All policy abuse issues sent to other POCs will be disregarded.nRef: http://whois.arin.net/rest/org/ATTW-ZnnOrgTechHandle: ICC-ARINnOrgTechName: IP TeamnOrgTechPhone: +1-888-613-6330 nOrgTechEmail: rm-ipspecialist@att.comnOrgTechRef: http://whois.arin.net/rest/poc/ICC-ARINnnOrgAbuseHandle: ATTAB-ARINnOrgAbuseName: ATT AbusenOrgAbusePhone: +1-919-319-8130 nOrgAbuseEmail: abuse@att.netnOrgAbuseRef: http://whois.arin.net/rest/poc/ATTAB-ARINnnOrgTechHandle: JB3310-ARINnOrgTechName: Borkenhagen, Jay C.nOrgTechPhone: +1-732-420-2526 nOrgTechEmail: jayb@att.comnOrgTechRef: http://whois.arin.net/rest/poc/JB3310-ARINnnOrgTechHandle: IPSWI-ARINnOrgTechName: IP SWIPnOrgTechPhone: +1-888-613-6330 nOrgTechEmail: swipid@icorefep1.ims.att.comnOrgTechRef: http://whois.arin.net/rest/poc/IPSWI-ARINnnRTechHandle: IAA17-ARINnRTechName: IP Address AdministrationnRTechPhone: +1-732-420-2071 nRTechEmail: addrmgt@qsun.att.comnRTechRef: http://whois.arin.net/rest/poc/IAA17-ARINnnNetRange: 12.0.0.0 - 12.0.0.255nCIDR: 12.0.0.0/24nNetName: ATT-LIN850-0nNetHandle: NET-12-0-0-0-2nParent: ATT (NET-12-0-0-0-1)nNetType: ReassignednOriginAS: nOrganization: ATT LINCROFT ORT (ALO-3)nRegDate: 2004-01-06nUpdated: 2004-01-06nRef: http://whois.arin.net/rest/net/NET-12-0-0-0-2nnOrgName: ATT LINCROFT ORTnOrgId: ALO-3nAddress: 12976 HOLLENBERGnCity: BRIDGETONnStateProv: MOnPostalCode: 63044nCountry: USnRegDate: 2003-08-22nUpdated: 2011-09-24nRef: http://whois.arin.net/rest/org/ALO-3nnOrgTechHandle: CMU8-ARINnOrgTechName: Muhlhausen, Carl nOrgTechPhone: +1-732-576-3052 nOrgTechEmail: ledzep@att.comnOrgTechRef: http://whois.arin.net/rest/poc/CMU8-ARINnnOrgAbuseHandle: CMU8-ARINnOrgAbuseName: Muhlhausen, Carl nOrgAbusePhone: +1-732-576-3052 nOrgAbuseEmail: ledzep@att.comnOrgAbuseRef: http://whois.arin.net/rest/poc/CMU8-ARINn" }, } } ``` ## Sample Response: Failed Parsed Record for an IP Address ```json { "response": { "error": { "code": 206, "message": "We were NOT able to parse the WHOIS record." }, "record_source": "195.234.156.0" "whois": { date: "2015-11-09", record: "inetnum: 193.0.0.0 - 195.255.255.255nnetname: EU-ZZ-193ndescr: To determine the registration information for a morendescr: specific range, please try a more specific query.ndescr: If you see this object as a result of a single IP query,ndescr: it means the IP address is currently in the free pool ofndescr: address space managed by the RIPE NCC.ncountry: EU # Country is in fact world widenadmin-c: IANA1-RIPEntech-c: IANA1-RIPEnstatus: ALLOCATED UNSPECIFIEDnmnt-by: RIPE-NCC-HM-MNTncreated: 2010-03-11T11:17:15Znlast-modified: 2015-09-23T13:18:26Znsource: RIPEn" }, } } ``` ## Error Codes If a problem in parsing a record occurs, the response object will contain two keys identified as code and message with corresponding values: | Error Code | Message | | ----- | ----- | | 206 | Message: "We were NOT able to parse the WHOIS record". Parsing was unsuccessful due to an unknown formatting of the WHOIS record. | | 404 | Message: "We have no recent WHOIS information available for this domain/IP Address". Typically this error occurs when you request to parse a record for a domain that has not been registered. | ## Sample Queries - HTML: https://api.domaintools.com/v1/domaintools.com/whois/parsed/?format=html - JSON: https://api.domaintools.com/v1/domaintools.com/whois/parsed/ - XML: https://api.domaintools.com/v1/domaintools.com/whois/parsed/?format=xml The Reverse IP API provides a list of domain names that share the same Internet host (i.e. the same IP address). You can request an IP address directly, or you can provide a domain name; if you provide a domain name, the API will respond with the list of other domains that share the same IP. ## Understanding Reverse IP Results The Reverse IP tool tracks a single IP address per domain in the legacy system. When a domain resolves to multiple IP addresses, only one IP (typically the "lowest" IP address) is tracked. This means: - Results represent a subset of all domains on a given IP address, not an exhaustive list - For shared hosting environments with many domains, you may see only a portion of the total domains - The domain_count response value indicates the total number of domains known for that IP, which may exceed the number of domains actually returned in the results ## Use Cases and Limitations ### Appropriate Use Cases The Reverse IP API is best suited for: - Investigative research on specific domains and their hosting relationships - Finding related domains on smaller shared hosting environments - Initial reconnaissance and infrastructure mapping - Understanding hosting patterns for domains of interest ### Limitations for High-Volume IPs The Reverse IP API is not designed for: - Exhaustive enumeration of large content delivery networks (CDNs) or cloud hosting providers such as Cloudflare, Amazon Web Services, or Google Cloud - Complete audits or inventories of high-volume IP addresses that may host millions of domains - Bulk data extraction at scale For IP addresses hosting very large numbers of domains (such as those used by major CDN providers), the Reverse IP API will return only a subset of domains. Full enumeration of all domains on high-volume IPs is not possible with this tool. ## Alternative Tools Depending on your use case, consider these alternative DomainTools products: ### Iris Investigate API The Iris dataset tracks all actively resolved IP addresses for apex domains and is updated daily. Iris is designed for investigative pivoting and finding related infrastructure but is not intended for mass enumeration of millions of domains. Learn more about Iris Investigate ### DNSDB DNSDB provides broader historical DNS data coverage and can return more comprehensive results for reverse IP lookups. However, DNSDB has its own limitations: - Result limits (approximately 4 million records per query) - API access is more scalable than the web interface but still has constraints - Requires separate DNSDB API access Learn more about DNSDB ## Best Practices ### Request IP Addresses Directly When possible, query using explicit IP addresses rather than domain names. This provides more predictable results and avoids uncertainty when domains resolve to multiple IPs: - Preferred: https://api.domaintools.com/v1/64.246.165.240/host-domains/ - Less predictable: https://api.domaintools.com/v1/domaintools.com/reverse-ip/ ### Interpret Results Appropriately - When domain_count exceeds the number of returned domains, recognize that you're seeing a subset - Focus on the domains that are returned rather than trying to obtain a complete list - For investigative purposes, prioritize analyzing recent and relevant domains ### Combine Tools for Comprehensive Investigation For thorough infrastructure analysis: 1. Use Reverse IP for initial quick lookups 2. Pivot to Iris Investigate for current, comprehensive IP resolution data 3. Query DNSDB for historical context and broader coverage when needed ### Understanding Result Limits The limit parameter controls how many domains are returned per IP address. However: - System-level limits may also apply based on your service level - Setting a higher limit will not return domains beyond what is tracked in the database - For high-volume IPs, increasing the limit will still return only a subset of total domains ## API Usage ``` https://api.domaintools.com/v1/domaintools.com/reverse-ip/ https://api.domaintools.com/v1/64.246.165.240/host-domains/ ``` When a domain name resolves to multiple IP addresses, the ip_addresses response node will have several containers, each with an ip_address, domain_count and domain_names node. Otherwise, those nodes will be included directly as children of the ip_addresses node. ## Reverse IP Parameters | Optional Parameters | Value | | ----- | ----- | | limit | Limits the size of the domain list that can appear in a response. The limit is applied per-IP address, not for the entire request. | ### Using the Limit Parameter The optional limit parameter controls the size of the result list: - Domains that resolve to multiple IP addresses may return more than the limit you set if your request is for a domain name instead of an IP address - We recommend requesting explicit IP addresses whenever possible to avoid this uncertainty - The limit is applied per IP address in the response, not to the total number of results ### Understanding Limited Results If the domain_count response value is greater than the count of elements in the domain_names list, your query has been limited. This means: - You're seeing only the first set of domains on that IP address, listed alphabetically - The limit may come from your service level, the limit parameter you set in your request, or system-level constraints - For high-volume IPs: Increasing the limit will not provide complete results because the underlying data only tracks one IP per domain This is expected behavior, not an error. The tool is designed for investigative research on specific hosting relationships, not exhaustive enumeration. ## Sample Response ```json { response: { ip_addresses: [ { domain_count: 1, domain_names: ['DOMAINTOOLS.NET'], ip_address: '199.30.228.77' }, { domain_count: 3, domain_names: ['DOMAINTOOLS.COM', 'SANTASFAVORITEWHOIS.COM', 'WHOISSUGGEST.COM'], ip_address: '8.247.14.160' }, ... ] } } ``` ## Sample Queries - HTML: https://api.domaintools.com/v1/domaintools.com/reverse-ip/?format=html - JSON: https://api.domaintools.com/v1/domaintools.com/reverse-ip/ - XML: https://api.domaintools.com/v1/domaintools.com/reverse-ip/?format=xml The Reverse IP Whois API provides a list of IP ranges that are owned by an Organization. You can enter an organization’s name and receive a list of all of the organization’s currently owned IP ranges. ``` https://api.domaintools.com/v1/reverse-ip-whois/?query=google https://api.domaintools.com/v1/reverse-ip-whois/?ip=127.0.0.1 ``` ## Reverse IP Whois Parameters | Parameters | Description | | ---------- | ----------- | | ip | Required for single IP result. Returns the most recent cached IP Whois record for the allocated range the IP is in. | | query | Required for lists of ranges. A space separated list of free text query terms. Returns the list of IP ranges that satisfy the query. The query terms have the following rules: +term: Term must be included in the results; -term: Term must not be included in the results; term*: Term as a prefix must be included in the results; No modifiers: The search performed is a phrase search. For example, if you provide a query of google inc then only results that include both terms in the order provided will be included. Search terms are case-insensitive. Search terms should be url encoded, including modifiers. E.g. + should be encoded as %2b to avoid interpretation as a space. | | country | Limits results to IP addresses allocated to an entity with a particular country. Valid options are ISO 3166-1 two character country codes. Default: (All country codes) | | server | Limits results to ranges from a particular Whois server. Valid options are whois.arin.net, whois.apnic.net, whois.ripe.net, whois.lacnic.net, or whois.afrinic.net. Default: (All whois servers) | | include_total_count | Returns the total number of results for a query. This should typically be used only for the first page of a large result set. Valid options are "true" and "false". Default: false | | page | Providing the page number allows access to additional pages of data. Results are returned 1000 ranges at a time. The maximum allowed value is 5. Default: 1 | | ip_version | Limits the query search results to a particular IP version. If omitted, the default is to query against IPv4. Valid options are 4 or 6. Default: 4 | ## Sample query= Response ```json { "response": { "has_more_pages": true, "page": 1, "total_count": 1105, "record_count": 1000, "records": [ { "ip_from": "1.179.248.0", "ip_to": "1.179.255.255", "record_ip": "1.179.249.17", "record_date": "2015-05-15", "server": "whois.apnic.net", "organization": "Static IP address for Google-caching servers", "country": "TH", "range": "1.179.248.0/21" }, { "ip_from": "4.3.2.0", "ip_to": "4.3.2.255", "record_ip": "4.3.2.1", "record_date": "2015-05-17", "server": "whois.arin.net", "organization": "Google Inc.", "country": "US", "range": "4.3.2.0/24" }, ... ] } } ``` ## Sample ip= Response ```json { "response": { "ip_from": "127.0.0.0", "ip_to": "127.255.255.255", "ip_from_alloc": "127.0.0.0", "ip_to_alloc": "127.255.255.255", "record_ip": "127.161.0.128", "record_date": "2015-05-18", "server": "whois.arin.net", "organization": "Internet Assigned Numbers Authority", "country": "US", "range": "127.0.0.0/8", "whois_record": "NetRange: 127.0.0.0 - 127.255.255.255 CIDR: 127.0.0.0/8 NetName: SPECIAL-IPV4-LOOPBACK-IANA-RESERVED NetHandle: NET-127-0-0-0-1 Parent: () NetType: IANA Special Use OriginAS: Organization: Internet Assigned Numbers Authority (IANA) RegDate: Updated: 2013-08-30 Comment: Addresses starting with "127." are used when one program needs to talk to another program running on the same machine using the Internet Comment: Protocol. 127.0.0.1 is the most commonly used address and is called the "loopback" address. Comment: Comment: These addresses were assigned by the IETF, the organization that develops Internet protocols, in the Standard document, RFC 1122, which can Comment: be found here: Comment: http://datatracker.ietf.org/doc/rfc1122 Ref: http://whois.arin.net/rest/net/NET-127-0-0-0-1 OrgName: Internet Assigned Numbers Authority OrgId: IANA Address: 12025 Waterfront Drive Address: Suite 300 City: Los Angeles StateProv: CA PostalCode: 90292 Country: US RegDate: Updated: 2012-08-31 Ref: http://whois.arin.net/rest/org/IANA OrgTechHandle: IANA-IP-ARIN OrgTechName: ICANN OrgTechPhone: +1-310-301-5820 OrgTechEmail: abuse@iana.org OrgTechRef: http://whois.arin.net/rest/poc/IANA-IP-ARIN OrgAbuseHandle: IANA-IP-ARIN OrgAbuseName: ICANN OrgAbusePhone: +1-310-301-5820 OrgAbuseEmail: abuse@iana.org OrgAbuseRef: http://whois.arin.net/rest/poc/IANA-IP-ARIN " } } ``` The Reverse Name Server API provides a list of domain names that share the same primary or secondary name server. You can provide a domain name and the API will provide the list of domain names pointed to the same name servers as those listed as the primary and secondary name servers on the domain name you requested. ``` https://api.domaintools.com/v1/domaintools.net/name-server-domains/ https://api.domaintools.com/v1/dailychanges.com/name-server-domains/ ``` ## Reverse Name Server Parameters | Optional Parameters | Value | | ----- | ----- | | limit | Limits the size of the domain list than can appear in a response. http://api.domaintools.com/v1/domaintools.net/name-server-domains/?limit=10 | Use the optional limit parameter to control the size of the result list. If the domain_count response node is greater than the count of elements in the domain_list node, your query has been limited to only the first set of domains on that IP address, listed alphabetically. The limit may come from your service level or the limit parameter you set in your request. ## Sample Response ```json { response: { name_server: { hostname: 'domaintools.net', primary: 159, secondary: 0, total: 159 }, primary_domains: ['bulk-check.com', 'bulkcheck.com', 'dmaintools.com', 'doamintools.com', ... ], secondary_domains: [] } } ``` ## Sample Queries - HTML: https://api.domaintools.com/v1/domaintools.net/name-server-domains/?format=html - JSON: https://api.domaintools.com/v1/domaintools.net/name-server-domains/ - XML: https://api.domaintools.com/v1/domaintools.net/name-server-domains/?format=xml` The Reverse Whois API provides a list of domain names that share the same Registrant Information. You can enter terms that describe a domain owner, like an email address or a company name, and you'll get a list of domain names that have your search terms listed in the Whois record. ``` https://api.domaintools.com/v1/reverse-whois/?terms=DomainTools%20LLC|Seattle&mode=purchase ``` ## Reverse Whois Parameters | Parameters | Description | | ----- | ----- | | terms | Required. List of one or more terms to search for in the Whois record, separated with the pipe character (\|). | | exclude | Domain names with Whois records that match these terms will be excluded from the result set. Separate multiple terms with the pipe character (\|). | | scope | Sets the scope of the report to include only current Whois records, or to include both current and historic records. Value must be current (the default) or historic. | | mode | quote: only lists the size and retail price of the query if you have per-domain pricing access; purchase: includes the complete list of domain names that match the query. | ## Sample Response ```json { response: { domain_count: { current: 310, historic: 412 }, domains: ['bulk-check.com', 'bulkcheck.com', 'comaintools.com', 'dailychanges.com', ... ], report_price: { current: 299, historic: 299 } } } ``` ## Sample Queries - HTML: https://api.domaintools.com/v1/reverse-whois/?terms=DomainTools%20LLC|Seattle&mode=purchase&format=html - JSON: https://api.domaintools.com/v1/reverse-whois/?terms=DomainTools%20LLC|Seattle&mode=purchase - XML: https://api.domaintools.com/v1/reverse-whois/?terms=DomainTools%20LLC|Seattle&mode=purchase&format=xml The Whois History API endpoint features the following capabilities: * Returns the most recent historical records first, sorting them in ascending or descending (default) order based on the record date field. * Allows investigators to retrieve and consume relevant historical records that are part of investigations via pagination and offsetting of results. The API endpoint response will only provide up to 100 historical Whois records at a time. Please use the new offset parameter to retrieve the next set of historical records using the pagination functionality. No other updates are required to the URI formation. Please review the Product Service Levels and Whois History Parameters section below for optimal implementation. ## Data availability Enterprise API accounts may receive less-redacted registrant data than the Iris Investigate UI returns for the same domain. DomainTools applies stricter privacy filtering in the UI for registrants in certain jurisdictions. This is expected behavior. The is_private field in each record indicates whether DomainTools has identified privacy service use or data redaction (1 = redacted, 0 = public). ## API Endpoint ``` https://api.domaintools.com/v1/DOMAIN/whois/history/ URI: /v1/{{QUERY}}/whois/history/ ``` The URI pattern in this API is different from most other DomainTools APIs, which follow a different URI formation. For more information about API endpoint authentication parameters and methods, please consult authentication. ## Product Service Levels A product service level authorizes your API account to access an API product and defines the price and usage limits for that access. If your account is not authorized to access a certain product, contact DomainTools member services for help. Your API account is provisioned for a maximum number of historical records you can retrieve monthly. Account usage is tracked based on the number of historical records retrieved across all domain queries in a given month, and not per API request. Use the pagination and limit capabilities to effectively manage your monthly consumption. ## Whois History Parameters | Parameters | Description | | ----- | ----- | | domain | Required. Input the domain for which the Whois data is desired. Usage: Only provide the domain as SLD.TLD format (e.g. domaintools.com). If you provide a hostname/subdomain (e.g. www.domaintools.com or mail.domaintools.com), only the SLD.TLD (domaintools.com) will be used. Data type: String. | | sort | An optional parameter. Sort the records returned in either ascending or descending order. Usage: date_asc: Date ascending. API will return the oldest historical record first, sorting them from oldest-to-newest; date_desc: Date descending. API will return the latest historical record first, sorting them from newest-to-oldest. The default option will sort records in descending order (date_desc). Data type: String. For example, add the date_asc parameter and set the limit to 5 to retrieve the 5 oldest historical records associated with this domain. | | limit | An optional parameter. Specify the maximum number of records to retrieve in an API query. Usage: Any value between 1 to 100. For example, to retrieve a maximum of 2 historical records associated with a domain, add limit=2 If the limit is 0, no historical records are provided. If the limit is more than 100, only the first 100 records are provided. To retrieve subsequent records, pagination must be used. The API does not provide validation of the limit parameter value. The default value is 100. Data type: Integer. | | offset | An optional parameter. Allows users to paginate results if there are more than 100 results. Up to 100 results are provided per API query. Pagination begins with the offset=m parameter, where m is the number of records to skip. For example, when accessing page 3 of historical records for a given domain, this would necessitate the parameter offset=200. If you use the limit parameter Usage: The default value is 0 (no records are skipped). Use this parameter to skip results. For example, if the API record_count is 150, set the offset value to 100 to skip the first 100 results and see the rest of the 50 results. To retrieve a maximum of 20 subsequent historical records using pagination, add both the offset and limit parameters: offset=100&limit=20. Data type: Integer. | | mode | An optional parameter that changes the mode of the API result and supports the following: check_existence: checks if the domain exists in the DomainTools database. Returns a result of true or false; count: Returns a record_count of how many historical records are associated with the queried domain; list: This is the default for this parameter and returns the historical records associated with the domain. Data type: String. Note: Querying the API with mode as check_existence or count does not return any historical data and hence does not impact your monthly account limits. Only when querying with mode as list, will the API return the historical records, and will it count toward your account limit. Please refer to Product Service Levels for additional information. | | format | An optional parameter to obtain the API response in XML, JSON, or HTML formats; accepts html, xml, json. Default value is json. Data type: String. | ## Sample Queries ### Retrieve the Oldest (in Ascending Order) Historical Records of a Domain No charge sample query: ``` https://api.domaintools.com/v1/domaintools.com/whois/history/?sort=date_asc ``` #### Sample Response ```json { "response": { "record_count": 744, "history": [ { "date": "2001-10-26", "is_private": 0, "whois": { "registrant": "VRW2", "registration": { "created": "1998-08-02", "expires": "2002-08-02", "registrar": "NETWORK SOLUTIONS, INC.", "statuses": [ "ACTIVE" ] }, "name_servers": [ "DNS1.INTERLAND.NET" ], "server": "whois.networksolutions.com", "record": "Registrant:nVRW2n 7770 Regents Road \#113/194n San Diego, CA 92122n USnn Domain Name: DOMAINTOOLS.COMnn Administrative Contact:n Whiting, Van R vwhiting@NABR.NETn IPE Advisory Servicesn 7770 Regents Road Suite 113/194n San Diego, CA 92122n 18585347622 (FAX) 18585340756n Technical Contact:n James, Caio cjames@YEAT.COMn Yeat Choice Technologiesn PO Box 782n Orangevale, CA 95662n (619) 678-8745 (FAX) (916)729-9343n n Record last updated on 26-Oct-2001n Record expires on 02-Aug-2002n Record created on 02-Aug-1998n Database last updated on 11-Jan-2002 15:00:24 ESTnn Domain servers in listed order:nn DNS1.INTERLAND.NET 64.224.20.132n DNS2.INTERLAND.NET 64.224.20.133n DNS3.INTERLAND.NET 64.224.20.134n" } }, ... { "date": "2019-01-18", "is_private": 0, "whois": { "registrant": "REDACTED FOR PRIVACY", "registration": { "created": "1998-08-02", "expires": "2027-08-01", "updated": "2017-09-21", "registrar": "eNom, Inc.", "statuses": [ "clientTransferProhibited" ] }, "name_servers": [ "NS1.P09.DYNECT.NET", "NS2.P09.DYNECT.NET", "NS3.P09.DYNECT.NET", "NS4.P09.DYNECT.NET" ], "server": "whois.enom.com", "record": "Domain Name: domaintools.comnRegistry Domain ID: 1697312_DOMAIN_COM-VRSNnRegistrar WHOIS Server: WHOIS.ENOM.COMnRegistrar URL: WWW.ENOM.COMnUpdated Date: 2017-09-21T13:20:39.00ZnCreation Date: 1998-08-02T04:00:00.00ZnRegistrar Registration Expiration Date: 2027-08-01T04:00:00.00ZnRegistrar: ENOM, INC.nRegistrar IANA ID: 48nDomain Status: clienttransferprohibited https://www.icann.org/epp\#clienttransferprohibitednDomain Status: registrar-lock\* https://www.icann.org/epp\#registrar-lock\*nRegistrant Name: REDACTED FOR PRIVACYnRegistrant Organization: REDACTED FOR PRIVACYnRegistrant Street: REDACTED FOR PRIVACYnRegistrant Street: nRegistrant City: REDACTED FOR PRIVACYnRegistrant State/Province: REDACTED FOR PRIVACYnRegistrant Postal Code: REDACTED FOR PRIVACYnRegistrant Country: REDACTED FOR PRIVACYnRegistrant Phone: REDACTED FOR PRIVACYnRegistrant Phone Ext: nRegistrant Fax: REDACTED FOR PRIVACYnRegistrant Email: REDACTED FOR PRIVACYnAdmin Name: REDACTED FOR PRIVACYnAdmin Organization: REDACTED FOR PRIVACYnAdmin Street: REDACTED FOR PRIVACYnAdmin Street: nAdmin City: REDACTED FOR PRIVACYnAdmin State/Province: REDACTED FOR PRIVACYnAdmin Postal Code: REDACTED FOR PRIVACYnAdmin Country: REDACTED FOR PRIVACYnAdmin Phone: REDACTED FOR PRIVACYnAdmin Phone Ext: nAdmin Fax: REDACTED FOR PRIVACYnAdmin Email: REDACTED FOR PRIVACYnTech Name: REDACTED FOR PRIVACYnTech Organization: REDACTED FOR PRIVACYnTech Street: REDACTED FOR PRIVACYnTech Street: nTech City: REDACTED FOR PRIVACYnTech State/Province: REDACTED FOR PRIVACYnTech Postal Code: REDACTED FOR PRIVACYnTech Country: REDACTED FOR PRIVACYnTech Phone: REDACTED FOR PRIVACYnTech Phone Ext: nTech Fax: REDACTED FOR PRIVACYnTech Email: REDACTED FOR PRIVACYnName Server: NS1.P09.DYNECT.NETnName Server: NS2.P09.DYNECT.NETnName Server: NS3.P09.DYNECT.NETnName Server: NS4.P09.DYNECT.NETnDNSSEC: UNSIGNEDnRegistrar Abuse Contact Email: ABUSE@ENOM.COMnRegistrar Abuse Contact Phone: \+1.4259744689nURL of the ICANN WHOIS Data Problem Reporting System: HTTP://WDPRS.INTERNIC.NET/n" } } ] } } ``` ### Retrieve Subsequent Historical Records Associated with a Domain No charge sample query: ``` https://api.domaintools.com/v1/domaintools.com/whois/history/?offset=100 ``` #### Sample Response Snippet ```json { "response": { "record_count": 744, "history": [ { "date": "2020-09-25", "is_private": 0, "whois": { ... { "date": "2020-09-24", "is_private": 0, "whois": { "registrant": "REDACTED FOR PRIVACY", "registration": { ... } } ] } } ``` ### Retrieve A Maximum of 20 Subsequent Historical Records Using Pagination No charge sample query: ``` https://api.domaintools.com/v1/domaintools.com/whois/history/?offset=100&limit=20 ``` #### Sample Response Snippet ```json { "response": { "record_count": 744, "history": [ { "date": "2020-09-25", "is_private": 0, "whois": { ... ) { "date": "2020-09-06", "is_private": 0, "whois": { "registrant": "REDACTED FOR PRIVACY", "registration": { ... } } ] } } ``` ### Other Sample Responses - HTML: https://api.domaintools.com/v1/domaintools.com/whois/history/?format=html - JSON: https://api.domaintools.com/v1/domaintools.com/whois/history/ - XML: https://api.domaintools.com/v1/domaintools.com/whois/history/?format=xml ## Interpreting the Response | Response | Description | | -------- | ----------- | | response | The container for the response of this API call. | | record_count | The number of records in this API response ‘page’. The default number of records per response is 100. Use the offset parameter to obtain subsequent records. | | date| The date of the Whois record, in YYYY-MM-DD format. | | is_private | Can be 0 (a publicly available record), or 1 (record with redactions made to it). Use this to filter for records where DomainTools has identified the use of Whois privacy services or other instances of data redaction. DomainTools identification of privacy services or redacted data is on a best-effort basis only. | | whois | Marks the container containing the metadata and the actual Whois historical record. Certain field values may be missing if the data was not available when the record was stored in our system. This container has the following properties: registrant, registration, created, expires, registrar, statuses. | | name_servers | Hostname of the name server associated with the domain. | | server | The server from which the Whois records are sourced in this result. | | record` | Marks the beginning container of the Whois record. The record is unparsed. | ## Use Cases for Whois History API Dataset The API does not include Whois records with identical data unless those records are necessary to understand the history of the domain name. For example, consider this hypothetical domain history: 1. A domain name was registered in January 2020. DomainTools stores that initial Whois record. 2. The contact information for that domain name changed in March 2020 and DomainTools stores the new record. 3. No changes are made to that record for the next several months; however, DomainTools continues to store identical snapshots of the record. 4. The domain name was sold in January 2021, and DomainTools stores the new ownership record. In the above scenario, these records would indicate the following: * Length of ownership: The time between the first record (initial registration in January 2020\) and the record representing the last record archived for the first owner. * Indication of no ownership changes: The record showing the March 2020 contact information update and subsequent records of snapshots of this March record may indicate that no ownership changes have occurred. * Indication of domain ownership change and the time window of such a change: The dates between the last record archived for the first owner record and the first record showing new domain ownership indicates a time window when the ownership of the domain changed. The WHOIS Lookup API provides the ownership record for a domain name or IP address with basic registration details. ``` https://api.domaintools.com/v1/domaintools.com/whois/ ``` The response includes the most recent WHOIS record available for the domain name or IP address you provide in the URL. This ensures a consistently fast response without a dependency on external servers and usually returns a record updated within the last few days. You can use the date property in the WHOIS response node to check the age of the record and confirm it was updated recently enough for your needs. In rare cases, you may request a domain for which the system has no recent WHOIS record. If that occurs, the system responds with an error. ## Sample Response ```json { "response": { "registrant": "DomainTools, LLC", "registration": { "created": "1998-08-02", "expires": "2027-08-01", "updated": "2020-01-09", "registrar": "eNon, LLC", "statuses": [ "clientTransferProhibited" ] }, "name_servers": [ "NS1.P09.DYNECT.NET", "NS2.P09.DYNECT.NET", "NS3.P09.DYNECT.NET", "NS4.P09.DYNECT.NET" ], "whois": { "date": "2022-09-28", "record": "Domain Name: domaintools.com\nRegistry Domain ID: 1697312_DOMAIN_COM-VRSN\nRegistrar WHOIS Server: WHOIS.ENOM.COM\nRegistrar URL: WWW.ENOM.COM\nUpdated Date: 2020-01-09T23:06:29.00Z\nCreation Date: 1998-08-02T04:00:00.00Z\nRegistrar Registration Expiration Date: 2027-08-01T04:00:00.00Z\nRegistrar: ENOM, INC.\nRegistrar IANA ID: 48\nDomain Status: clientTransferProhibited https://www.icann.org/epp\#clientTransferProhibited\nRegistrant Name: REDACTED FOR PRIVACY\nRegistrant Organization: REDACTED FOR PRIVACY\nRegistrant Street: REDACTED FOR PRIVACY\nRegistrant Street: \nRegistrant City: REDACTED FOR PRIVACY\nRegistrant State/Province: WA\nRegistrant Postal Code: REDACTED FOR PRIVACY\nRegistrant Country: US\nRegistrant Phone: REDACTED FOR PRIVACY\nRegistrant Phone Ext: \nRegistrant Fax: REDACTED FOR PRIVACY\nRegistrant Email: https://tieredaccess.com/contact/5653a2cd-5657-4853-9332-a4a49cdec6cc\nAdmin Name: REDACTED FOR PRIVACY\nAdmin Organization: REDACTED FOR PRIVACY\nAdmin Street: REDACTED FOR PRIVACY\nAdmin Street: \nAdmin City: REDACTED FOR PRIVACY\nAdmin State/Province: REDACTED FOR PRIVACY\nAdmin Postal Code: REDACTED FOR PRIVACY\nAdmin Country: REDACTED FOR PRIVACY\nAdmin Phone: REDACTED FOR PRIVACY\nAdmin Phone Ext: \nAdmin Fax: REDACTED FOR PRIVACY\nAdmin Email: REDACTED FOR PRIVACY\nTech Name: REDACTED FOR PRIVACY\nTech Organization: REDACTED FOR PRIVACY\nTech Street: REDACTED FOR PRIVACY\nTech Street: \nTech City: REDACTED FOR PRIVACY\nTech State/Province: REDACTED FOR PRIVACY\nTech Postal Code: REDACTED FOR PRIVACY\nTech Country: REDACTED FOR PRIVACY\nTech Phone: REDACTED FOR PRIVACY\nTech Phone Ext: \nTech Fax: REDACTED FOR PRIVACY\nTech Email: REDACTED FOR PRIVACY\nName Server: DNS1.P04.NSONE.NET.\nName Server: DNS2.P04.NSONE.NET.\nName Server: DNS3.P04.NSONE.NET.\nName Server: DNS4.P04.NSONE.NET.\nDNSSEC: unsigned\nRegistrar Abuse Contact Email: ABUSE@ENOM.COM\nRegistrar Abuse Contact Phone: \+1.4259744689\nURL of the ICANN WHOIS Data Problem Reporting System: HTTP://WDPRS.INTERNIC.NET/\n" 22 }, "record_source": "domaintools.com" } } ``` Not all data elements in the response are available for all domains. What is available depends on the WHOIS record returned for that domain. ## Sample Queries - HTML: https://api.domaintools.com/v1/domaintools.com/whois/?format=html - JSON: https://api.domaintools.com/v1/domaintools.com/whois/ - XML: https://api.domaintools.com/v1/domaintools.com/whois/?format=xml The Brand Monitor API will search across all new domain registrations worldwide, and return result sets consisting of domain names that contain a customer's brand or monitored word/string. The Brand Monitor API looks at country code TLDS and new generic TLDs, as well as the usual suspects of .COM, .NET,.ORG, etc. ``` https://api.domaintools.com/v1/mark-alert/?query=domaintools ``` By default, the active data set is the list of domain names registered on the day you submit your API query. You should design your system to submit one API query per day for each term you want to monitor. If you experience a temporary failure in your processing routines, you can catch up on missing alerts up to six days back by providing the days_back parameter in your request. ## Brand Monitor Parameters | Parameters | Description | | ----- | ----- | | query | Required. One or more terms, where the pipe character (\|) may be used as a logical AND to require that all strings be present in order to match. For example, domain \| tools will match domaintools but will not match domain or tools.| | exclude | Domain names with these words will be excluded from the result set. For exclusions of multiple terms, use the (\|)character as a logical AND. In such a case, a domain would have to contain all of the excluded strings in order to be excluded from matching. To exclude individual terms, create separate exclude parameters.| | domain_status | Sets the scope of domain names to search. By default, the API will search both new domain names and domains which are now on-hold (pending delete). To narrow your search to only one of these status codes, set this parameter to either new or on-hold.| | days_back | Use this parameter in exceptional circumstances where you need to search domains registered up to six days prior to the current date. Set the value to an integer in the range of 1-6. | For best results, schedule your daily update to occur no sooner than 3am Pacific time. This ensures the data has been fully processed and is ready for your use. Because each query consumes resources regardless of whether a match is found, your API account will be charged for each request you submit to the API even if no domain names match your query. ## Sample Response ```json { response: { query: "finance", exclude: "auto|best", new: true, on-hold: true, date: "2011-03-02", total: 2, alerts: \[ { domain: "24hourfinance.info", status: "on-hold" }, { domain: "actionis-finance.com", status: "new" }, ... \] } } ``` The IP Monitor API searches the daily activity of all our monitored TLDs on any given IP address. New, Deleted and Transferred domains records can be queried up to 6 days in the past. ``` https://api.domaintools.com/v1/ip-monitor/?query=65.55.53.233\&page=1 ``` We are unable to provide a functioning test URL for this product because the data changes each day. See below for a sample response. By default, the active data set is new or updated domain records on the day you submit your API query. You should design your system to submit one API query per day for each name server you want to monitor. If you experience a temporary failure in your processing routines, you can catch up on missing alerts up to six days back by providing the days_back parameter in your request. Results are limited to 1000 records per page. To view additional pages, include the page parameter in your request. ## IP Monitor Parameters | Parameters | Description | | ----- | ----- | | query | Required. The IP Address you wish to query ( i.e. 65.55.53.233 ). | | days_back | Use this parameter in exceptional circumstances where you need to search domain changes up to six days prior to the current date. Set the value to an integer in the range of 1-6. (default 0) | | page | If the result set is larger than 1000 records for a given day, request additional pages with this parameter. Set the value to an integer up to a maximum of the returned page_count value. (default 1) | For best results, schedule your daily update to occur no sooner than 3am Pacific time. This ensures the data has been fully processed and is ready for your use. Because each query consumes resources regardless of whether a match is found, your API account will be charged for each request you submit to the API even if no domain names match your query. ## Sample Response ```json { "response": { "limit": 1000, "date": "2013-11-18", "ip_address": "65.49.88.146", "total": "18551", "page": 1, "page_count": 19, "alerts": [ { "previous_ip_address": "64.62.224.253", "new_ip_address": "65.49.88.146", "action": "Transfer In", "domain": "0--5.COM" }, { "previous_ip_address": "64.62.224.253", "new_ip_address": "65.49.88.146", "action": "Transfer In", "domain": "000045.COM" }, ... ] } } ``` The IP Registrant Monitor API searches the ownership (Whois) records of IP address allocations for specific search terms. The product is ideal for monitoring specific IP owners (such as "DomainTools") to be alerted whenever their information appears in a newly-allocated IP address range. The API will also alert you to IP ranges that no longer match a specific term. ``` https://api.domaintools.com/v1/ip-registrant-monitor/?query=google ``` We are unable to provide a functioning test URL for this product because the data changes each day. See below for a sample response. By default, the active data set is new or updated IP Whois records on the day you submit your API query. You should design your system to submit one API query per day for each registrant you want to monitor. If you experience a temporary failure in your processing routines, you can catch up on missing alerts up to six days back by providing the days_back parameter in your request. ## IP Registrant Monitor Parameters | Parameters | Description | | ----- | ----- | | query | Required. A space separated list of free text query terms. Returns the list of IP ranges that satisfy the query. The query terms have the following rules: +term: Term must be included in the results; -term: Term must not be included in the results; term*: Term as a prefix must be included in the results; No modifiers: The search performed is a phrase search. For example, if you provide a query of google inc then only results that include both terms in the order provided will be included. Search terms are case-insensitive. Search terms should be URL encoded, including modifiers. E.g. + should be encoded as %2b to avoid interpretation as a space. | | country | Limits results to IP addresses allocated to an entity with a particular country. Valid options are ISO 3166-1 two character country codes. Default: (All country codes) | | server | Limits results to ranges from a particular Whois server. Valid options are whois.arin.net, whois.apnic.net, whois.ripe.net, whois.lacnic.net, or whois.afrinic.net. Default: (All whois servers) | | include_total_count | Returns the total number of results for a query. This should typically be used only for the first page of a large result set. Valid options are "true" and "false". Default: false | | page | Providing the page number allows access to additional pages of data. Results are returned 1000 ranges at a time. The maximum allowed value is 5. Default: 1 | | search_type | Type of changes to return. Valid options are all, additions, removals, modifications. Default: all | ## Sample Response ```json { "response": { "record_count": 99, "modified": [], "page": 1, "added": [ { "ip_to": "51.255.100.255", "organization": "INTERNAL USAGE", "record_ip": "51.255.100.255", "record_date": "2016-01-05", "range": "51.255.100.224/27", "ip_from": "51.255.100.224", "server": "whois.ripe.net", "country": "FR" }, { "ip_to": "51.254.170.239", "organization": "PrivateCloud id \-831", "record_ip": "51.254.170.224", "record_date": "2016-01-05", "range": "51.254.170.224/28", "ip_from": "51.254.170.224", "server": "whois.ripe.net", "country": "FR" }, ... ], "removed": [ { "ip_to": "46.105.155.183", "record_ip": "46.105.155.177", "record_date": "2015-03-09", "range": "46.105.155.176/29", "ip_from": "46.105.155.176", "organization": "usertestro", "server": "whois.ripe.net", "country": "FR" }, { "ip_to": "37.59.91.175", "record_ip": "37.59.91.163", "record_date": "2015-02-13", "range": "37.59.91.160/28", "ip_from": "37.59.91.160", "organization": "SP\&PS", "server": "whois.ripe.net", "country": "FR" }, ... ], "has_more_pages": false, "date": "2016-01-06", "query": "ovh" } } ``` The Name Server Monitor API searches the daily activity of all our monitored TLDs on any given name server. New, Deleted and Transferred domains records can be queried up to 6 days in the past. ``` https://api.domaintools.com/v1/name-server-monitor/?query=DNSPOD.NET\&page=1 ``` We are unable to provide a functioning test URL for this product because the data changes each day. See below for a sample response. By default, the active data set is new or updated domain records on the day you submit your API query. You should design your system to submit one API query per day for each name server you want to monitor. If you experience a temporary failure in your processing routines, you can catch up on missing alerts up to six days back by providing the days_back parameter in your request. Results are limited to 1000 records per page. To view additional pages, include the page parameter in your request. ## Name Server Monitor Parameters | Parameters | Description | | ----- | ----- | | query | Required. The hostname of the Name Server you wish to query ( i.e. dynect.net ). | | days_back | Use this parameter in exceptional circumstances where you need to search domain changes up to six days prior to the current date. Set the value to an integer in the range of 1-6. (default 0) | | page | If the result set is larger than 1000 records for a given day, request additional pages with this parameter. Set the value to an integer up to a maximum of the returned page_count value. (default 1) | For best results, schedule your daily update to occur no sooner than 3am Pacific time. This ensures the data has been fully processed and is ready for your use. Because each query consumes resources regardless of whether a match is found, your API account will be charged for each request you submit to the API even if no domain names match your query. ## Sample Response ```json { "response": { "limit": 1000, "date": "2013-11-20", "name_server": "DNSPOD.NET", "total": "12502", "page": 1, "page_count": 13, "alerts": [ { "new_name_server": "expiredns.com", "old_name_server": "dnspod.net", "action": "Transfer Out", "domain": "00000ok.com" }, { "new_name_server": "dnspod.net", "old_name_server": "domaincontrol.com", "action": "Transfer In", "domain": "0000500.com" }, ... ] } } ``` The Registrant Monitor API searches the ownership (Whois) records of domain names for specific search terms. The product is ideal for monitoring specific domain owners (such as "DomainTools LLC") to be alerted whenever their information appears in a newly-registered domain name. The API will also alert you to domains that no longer match a specific term. ``` https://api.domaintools.com/v1/registrant-alert/?query=domaintools ``` By default, the active data set is new or updated Whois records on the day you submit your API query. You should design your system to submit one API query per day for each registrant you want to monitor. If you experience a temporary failure in your processing routines, you can catch up on missing alerts up to six days back by providing the days_back parameter in your request. ### Registrant Monitor Parameters | Parameters | Description | | ----- | ----- | | query | Required. One or more terms separated by the pipe character (\|). | | exclude | Whois records with these words will be excluded from the result set. Separate multiple terms with the pipe character (\|). | | days_back | Use this parameter in exceptional circumstances where you need to search domains registered up to six days prior to the current date. Set the value to an integer in the range of 1-6. | | limit | Limit the number of matched domain names that are returned in your result set. | For best results, schedule your daily update to occur no sooner than 3am Pacific time. This ensures the data has been fully processed and is ready for your use. Because each query consumes resources regardless of whether a match is found, your API account will be charged for each request you submit to the API even if no domain names match your query. ## Sample Response ```json { response: { query: "DomainTools", limit: 500, total: 2, date: "2011-03-02", alerts: [ { domain: "reversewhois.com", match_type: "added" current_owner: "DomainTools LLC" created: "2011-02-01" modified: "2011-03-02" last_owner: "" }, { domain: "external-systems.com", match_type: "removed" current_owner: "Domain Administration" created: "1999-10-17" modified: "2011-03-02" last_owner: "DomainTools LLC" }, ... ] } } ```