How to Do a Bulk WHOIS Lookup for Multiple Domains

Introduction

Imagine you are a cybersecurity analyst, and you have just identified 500 suspicious domains from your threat feed. Or you are a brand protection manager who needs to check ownership details on 300 domains that look dangerously similar to your company name. Or you are a domain investor evaluating hundreds of expired domains before placing bids.

Now imagine doing each of those lookups; one by one; manually. That is exactly the problem bulk WHOIS lookup solves.

In this post, we will talk about:

• What bulk WHOIS lookup is and how it works
• How to perform a bulk WHOIS lookup using the WhoisFreaks tools and API
• What data it returns and why it matters
• Understanding Bulk WHOIS Results: What to Look For

What Is Bulk WHOIS Lookup?

A bulk WHOIS lookup is the process of retrieving WHOIS registration data for multiple domain names in a single query or automated batch, rather than looking up each domain individually one at a time.

Standard WHOIS lookup works well when you need information on a single domain. But when your workflow involves tens, hundreds, or thousands of domains; whether for threat investigation, compliance screening, portfolio management, or market research; individual lookups simply do not scale. Bulk WHOIS solves this by processing large lists of domains simultaneously and returning structured data for each one.

he WHOIS protocol stores publicly available registration information about every domain name on the internet. A standard WHOIS record contains:

• Important dates: creation date, last updated date, expiry date
• Registration details: As if domain is registered or not
• Registrant, Administrative, Technical and Billing details: name, organization, email, phone, address, and some other fields
• Registrar information: the company through which the domain was registered
• Domain status codes: active, pending transfer, client hold, etc.
• Nameservers: the DNS servers controlling the domain's zone

When you run a bulk WHOIS lookup, you get all or some of this data; for every domain in your list; returned in a single structured, machine-readable as well as human-readable response.

How to Do a Bulk WHOIS Lookup: Step-by-Step Guide

There are three ways to perform a bulk WHOIS lookup with WhoisFreaks; the free web tool, the REST API, and the file upload method for very large lists.

Method 1: Using the WhoisFreaks Bulk WHOIS Lookup Tool (Web)

The simplest way to get started with bulk WHOIS is through the WhoisFreaks web interface; no coding required.

Step 1: Navigate to the Tool

Go to https://whoisfreaks.com/tools/whois/bulk/lookup

Step 2: Enter Your Domain List

In the input field, enter or paste your list of domain names; one domain per line:

google.com
facebook.com
amazon.com
microsoft.com
apple.com

Step 3: Click Search

Click the Search button to initiate the bulk lookup. WhoisFreaks will query WHOIS data for every domain in your list simultaneously.

Step 4: Login/Signup

It will ask you to login. If you don't have an account, you can create one by visiting signup page. Once logged in you will be redirected to bulk domain lookup tool again and it will fetch the data for you.

Step 5: Review Your Results

Results are returned in a structured table showing all WHOIS fields for each domain. You can scan registration dates, registrant details, nameservers, and expiry dates across all domains at a glance.

Step 6: Export Your Data

Download the results as JSON for further analysis in your preferred data tool.

Method 2: Using the WhoisFreaks Bulk WHOIS API (Programmatic)

For automation, integration into security platforms, or processing large domain lists programmatically, the Bulk WHOIS API is the right choice.

API Endpoint:

POST https://api.whoisfreaks.com/v2.0/bulkwhois/live?&apiKey=YOUR_API_KEY&format=json

Request Body:

{
  "domainNames": [
    "whoisfreaks.com",
    "facebook.net",
    "ipgeolocation.io"
  ]
}

Key Parameters:

Sample Response Structure:

{
  "bulk_whois_response": [
    {
      "status": true,
      "domain_name": "facebook.net",
      "query_time": "2026-04-14 07:25:31",
      "whois_server": "https://rdap.verisign.com/net/v1/",
      "domain_registered": "yes",
      "create_date": "2004-04-01",
      "update_date": "2025-04-23",
      "expiry_date": "2034-04-01",
      "domain_registrar": {
        "iana_id": "3237",
        "handle": "3237",
        "status": "accredited",
        "registrar_name": "RegistrarSafe, LLC",
        "normalized_name": "registrarsafe, llc",
        "rdap_server": "https://rdap.registrarsafe.com/"
      },
      "registrant_contact": {
        "name": "Domain Admin",
        "company": "Meta Platforms, Inc",
        "street": "1601 Willow Rd",
        "city": "Menlo Park",
        "state": "CA",
        "zip_code": "94025",
        "country_name": "United States",
        "country_code": "US",
        "email_address": "[email protected]",
        "phone": "+16505434800"
      },
      "technical_contact": {
        "name": "Domain Admin",
        "country_name": "United States",
        "country_code": "US",
        "email_address": "[email protected]",
        "phone": "+16505434800"
      },
      "abuse_contact": {
        "registrar_name": "Abuse Contact",
        "email_address": "[email protected]",
        "phone_number": "+16503087004"
      },
      "name_servers": [
        "b.ns.facebook.com",
        "c.ns.facebook.com",
        "a.ns.facebook.com",
        "d.ns.facebook.com"
      ],
      "domain_status": [
        "clientupdateprohibited",
        "clientdeleteprohibited",
        "clienttransferprohibited",
        "serverdeleteprohibited",
        "serverupdateprohibited",
        "servertransferprohibited"
      ],
      "registry_data": {
        "domain_name": "facebook.net",
        "query_time": "2026-04-14 07:25:30",
        "whois_server": "https://rdap.verisign.com/net/v1/",
        "domain_registered": "yes",
        "create_date": "2004-04-01",
        "update_date": "2025-04-23",
        "expiry_date": "2034-04-01",
        "domain_registrar": {
          "iana_id": "3237",
          "handle": "3237",
          "registrar_name": "RegistrarSafe, LLC"
        },
        "name_servers": [
          "b.ns.facebook.com",
          "c.ns.facebook.com",
          "a.ns.facebook.com",
          "d.ns.facebook.com"
        ],
        "domain_status": [
          "clientupdateprohibited",
          "clientdeleteprohibited",
          "clienttransferprohibited",
          "serverdeleteprohibited",
          "serverupdateprohibited",
          "servertransferprohibited"
        ]
      }
    },
    {
      "status": true,
      "domain_name": "ipgeolocation.io",
      "query_time": "2026-04-14 07:25:31",
      "whois_server": "whois.nic.io",
      "domain_registered": "yes",
      "create_date": "2018-02-26",
      "update_date": "2026-02-01",
      "expiry_date": "2027-02-26",
      "domain_registrar": {
        "iana_id": "1068",
        "status": "accredited",
        "registrar_name": "NameCheap, Inc",
        "normalized_name": "namecheap, inc.",
        "whois_server": "whois.namecheap.com",
        "rdap_server": "https://rdap.namecheap.com/",
        "website_url": "http://www.namecheap.com",
        "email_address": "[email protected]",
        "phone_number": "+19854014545"
      },
      "registrant_contact": {
        "id": "REDACTED",
        "name": "REDACTED",
        "company": "Privacy service provided",
        "street": "REDACTED",
        "city": "REDACTED",
        "state": "Capital Region",
        "zip_code": "REDACTED",
        "country_name": "Iceland",
        "country_code": "IS",
        "email_address": "REDACTED",
        "phone": "REDACTED",
        "fax": "REDACTED"
      },
      "administrative_contact": {
        "id": "REDACTED",
        "name": "REDACTED",
        "company": "REDACTED",
        "street": "REDACTED",
        "city": "REDACTED",
        "state": "REDACTED",
        "zip_code": "REDACTED",
        "country_name": "REDACTED",
        "country_code": "N/A",
        "email_address": "REDACTED",
        "phone": "REDACTED",
        "fax": "REDACTED"
      },
      "technical_contact": {
        "id": "REDACTED",
        "name": "REDACTED",
        "company": "REDACTED",
        "street": "REDACTED",
        "city": "REDACTED",
        "state": "REDACTED",
        "zip_code": "REDACTED",
        "country_name": "REDACTED",
        "country_code": "N/A",
        "email_address": "REDACTED",
        "phone": "REDACTED",
        "fax": "REDACTED"
      },
      "name_servers": [
        "cheryl.ns.cloudflare.com",
        "nash.ns.cloudflare.com"
      ],
      "domain_status": [
        "clienttransferprohibited"
      ],
      "whois_raw_domain": "RAW Data"
    },
    {
      "status": true,
      "domain_name": "whoisfreaks.com",
      "query_time": "2026-04-14 07:25:31",
      "whois_server": "https://rdap.verisign.com/com/v1/",
      "domain_registered": "yes",
      "secure_dns": true,
      "create_date": "2019-03-19",
      "update_date": "2026-02-17",
      "expiry_date": "2027-03-19",
      "domain_registrar": {
        "iana_id": "1068",
        "handle": "1068",
        "status": "accredited",
        "registrar_name": "NameCheap, Inc",
        "normalized_name": "namecheap, inc.",
        "whois_server": "whois.namecheap.com",
        "rdap_server": "https://rdap.namecheap.com/",
        "website_url": "http://www.namecheap.com",
        "email_address": "[email protected]",
        "phone_number": "+16613102107"
      },
      "registrant_contact": {
        "handle": "090bade428c949e7669908d6ac8943b2-Namech",
        "company": "Privacy service provided",
        "street": "Kalkofnsvegur 2",
        "city": "Reykjavik",
        "state": "Capital Region",
        "zip_code": "101",
        "country_name": "Iceland",
        "country_code": "IS",
        "email_address": "[email protected]",
        "phone": "+3544212434"
      },
      "technical_contact": {
        "handle": "b55d6e2a2d2e42058c2408d6ac64a4dc-Namech",
        "company": "Privacy service provided by Withheld for Privacy ehf",
        "street": "Kalkofnsvegur 2",
        "city": "Reykjavik",
        "state": "Capital Region",
        "zip_code": "101",
        "country_name": "Iceland",
        "country_code": "IS",
        "email_address": "[email protected]",
        "phone": "+3544212434"
      },
      "abuse_contact": {
        "registrar_name": "NAMECHEAP INC",
        "email_address": "[email protected]",
        "phone_number": "+19854014545"
      },
      "name_servers": [
        "albert.ns.cloudflare.com",
        "sue.ns.cloudflare.com"
      ],
      "domain_status": [
        "clienttransferprohibited"
      ],
      "registry_data": {
        "domain_name": "whoisfreaks.com",
        "query_time": "2026-04-14 07:25:30",
        "whois_server": "https://rdap.verisign.com/com/v1/",
        "domain_registered": "yes",
        "create_date": "2019-03-19",
        "update_date": "2026-02-17",
        "expiry_date": "2027-03-19",
        "domain_registrar": {
          "iana_id": "1068",
          "handle": "1068",
          "registrar_name": "NameCheap, Inc",
          "whois_server": "whois.namecheap.com",
          "email_address": "[email protected]",
          "phone_number": "+16613102107"
        },
        "name_servers": [
          "albert.ns.cloudflare.com",
          "sue.ns.cloudflare.com"
        ],
        "domain_status": [
          "clienttransferprohibited"
        ]
      }
    }
  ]
}

The Bulk WHOIS API processes up to 100 domains per request, with each domain consuming 1 API credit. For lists larger than 100 domains, simply paginate your requests in batches of 100.

Method 3: File Upload for Very Large Domain Lists

For enterprise-scale use cases involving thousands or millions of domains, WhoisFreaks supports file-based bulk WHOIS lookups through the dashboard.

Step 1: Prepare Your File

Create a plain text file (.txt) or CSV file with one domain per line:

example1.com
example2.com
example3.com

Step 2: Upload via Dashboard

Log into your WhoisFreaks dashboard, navigate to Utility -> Bulk Whois, select the file upload and submit your file for processing. WhoisFreaks supports file uploads containing up to 3 million domain names.

Step 3: Wait for Processing

Large files are processed asynchronously. You will receive a notification when your results are ready to download.

Step 4: Download Results

Download the completed results as a structured CSV file for analysis.

This method is ideal for: threat intelligence database enrichment, large-scale compliance screening, domain portfolio audits, and academic research projects.

Bulk WHOIS Lookup vs. Individual WHOIS Lookup

What Data Does Bulk WHOIS Return?

Here is a complete breakdown of the fields returned in a bulk WHOIS response:

Understanding Bulk WHOIS Results: What to Look For

1. Important Dates

These fields define the lifecycle of the domain:

• Creation Date (create_date)
  The date when the domain was originally registered.
• Last Updated Date (update_date)
  The most recent date when any changes were made to the domain record (e.g., contact updates, DNS changes, renewal).
• Expiry Date (expiry_date)
  The date when the domain registration will expire if not renewed.

2. Registration Details

These indicate whether the domain is currently registered:

• Domain Registered (domain_registered)
  Specifies the registration status of the domain.
  Typical values:
  • registered > Domain is taken and active
  • available > Domain is not registered
  • unknown > Status could not be determined
• Status (status)
  Boolean indicator showing if the WHOIS lookup was successful.

3. Contact Information

These represent different roles associated with domain ownership and management. Each contact contains similar fields like name, organization, email, phone, and address.

• Registrant Contact (registrant_contact)
  The legal owner of the domain.
• Administrative Contact (administrative_contact)
  Responsible for administrative decisions related to the domain.
• Technical Contact (technical_contact)
  Handles technical aspects such as DNS configuration and server management.
• Billing Contact (billing_contact)
  Responsible for payments, renewals, and financial matters.

Common fields across all contacts:

• Name
• Company/Organization
• Email Address
• Phone Number
• Mailing Address (street, city, state, zip, country)

4. Registrar Information

Details about the organization through which the domain was registered:

• Registrar Name (registrar_name)
  The company managing the domain registration.
• IANA ID (iana_id)
  Unique identifier assigned to the registrar by IANA.
• WHOIS Server (whois_server)
  Server used to retrieve WHOIS data.
• RDAP Server (rdap_server)
  Modern alternative to WHOIS providing structured data.
• Website URL (website_url)
  Official website of the registrar.
• Contact Info (email_address, phone_number)
  Support contact details for the registrar.

5. Domain Status Codes

These indicate the current state and restrictions applied to the domain:

Common values include:

• active > Domain is functioning normally
• clientTransferProhibited > Transfer to another registrar is blocked
• pendingTransfer > Domain transfer is in progress
• clientHold > Domain is suspended (e.g., due to non-payment or abuse)
• expired > Domain has expired

These statuses are defined by ICANN and registries.

6. Nameservers

• Name Servers (name_servers)
  A list of DNS servers responsible for resolving the domain.

Example:

• ns1.example.com
• ns2.example.com

These control how the domain points to hosting services (websites, email, etc.).

7. Registry Data (Secondary WHOIS Source)

• Registry Data (registry_data)
  Contains similar information as above but retrieved directly from the domain registry (authoritative source).

Includes:

• Dates (creation, update, expiry)
• Registrar details
• Nameservers
• Domain status
• Raw WHOIS data

Conclusion

Bulk WHOIS lookup transforms domain intelligence from a slow, manual process into a fast, scalable, and fully automated workflow. Whether you are screening 50 suspicious domains from a threat feed, auditing a 500-domain corporate portfolio, or researching 10,000 newly registered lookalike domains for brand protection, bulk WHOIS gives you the registration data you need; across every domain; in a fraction of the time.

With WhoisFreaks supporting up to 100 domains per API request, file uploads of up to 3 million domains, clean CSV output, and full compatibility with SIEM, SOAR, and workflow automation platforms, you have everything you need to integrate bulk WHOIS into your existing processes today.

The difference between an analyst who manually checks 10 domains and one who programmatically processes 10,000 is not effort; it is the right tool.

Ready to start your bulk WHOIS lookup?

Explore the Bulk WHOIS API documentation