How Do You Run a Bulk WHOIS Lookup on Multiple Domains?

A bulk WHOIS lookup retrieves WHOIS registration data (registrant, registrar, dates, name servers, status) for many domain names in a single request, instead of querying them one at a time. WhoisFreaks provides three execution methods: a free web tool that handles up to 100 domains per submission, a REST API that processes 100 domains per request and integrates with security platforms, and a file upload method that processes up to 3 million domains per file. Use the web tool for ad hoc analyst work, the API for programmatic workflows, and file upload for portfolio or threat-feed scale.

Introduction

Imagine you are a cybersecurity analyst, and you have just identified 500 suspicious domains from your threat feed. Or you are a brand protection manager who needs to check ownership details on 300 domains that look similar to your company name. Or you are a domain investor evaluating hundreds of expired domains before placing bids.

Now imagine doing each of those lookups one by one, manually. That is the problem bulk WHOIS lookup solves. This guide walks through what it returns, the three ways to run it on the WhoisFreaks platform, and which method fits which workload. The free web tool linked below runs the workflow; this article explains it.

In this post, we will talk about:

• What bulk WHOIS lookup is and how it works
• How to perform a bulk WHOIS lookup using the WhoisFreaks tools and API
• What data it returns and why it matters
• Understanding Bulk WHOIS Results: What to Look For

What Is Bulk WHOIS Lookup?

A bulk WHOIS lookup is the process of retrieving WHOIS registration data for multiple domain names in a single request or automated batch, instead of querying each domain one at a time. Standard WHOIS lookup, defined by RFC 3912, queries one domain at a time. Bulk WHOIS extends that by submitting many domains together and returning structured records (JSON, XML, or CSV) for each one. Security teams, brand protection analysts, and domain investors use bulk WHOIS when their workflow involves dozens, hundreds, or millions of domains and individual lookups do not scale.

The WHOIS protocol (RFC 3912) and its modern replacement RDAP store publicly available registration information for every domain name on the internet. A standard WHOIS record contains:

• Important dates: creation date, last updated date, expiry date
• Registration details: whether the domain is registered, available, or unknown
• Registrant, Administrative, Technical and Billing details: name, organization, email, phone, and postal address (subject to redaction)
• Registrar information: the company through which the domain was registered, including IANA ID
• Domain status codes: active, pending transfer, client hold, and others defined by ICANN
• Nameservers: the DNS servers controlling the domain's zone

When you run a bulk WHOIS lookup, you receive all or some of this data for every domain in your list, returned as a single structured response that is both machine-readable and human readable.

Where the data comes from

WhoisFreaks queries WHOIS records via the WHOIS protocol (RFC 3912) and the newer RDAP protocol from authoritative registries and registrars. Live API and tool requests return real-time records, not cached snapshots. The dataset covers more than 1,500 TLDs, including all gTLDs and the major ccTLDs. Privacy-redacted fields are returned exactly as the registrar publishes them; no PII is reconstructed. Redaction is governed by ICANN's Temporary Specification for gTLD Registration Data (effective May 17, 2018) and the EU GDPR (effective May 25, 2018). Country-code registries set their own publication rules and may return less data than gTLDs.

How to Do a Bulk WHOIS Lookup: Step-by-Step Guide

There are three ways to perform a bulk WHOIS lookup with WhoisFreaks: the free web tool, the REST API, and the file upload method for very large lists. Each method targets a different batch size and integration pattern. The decision matrix at the end of this section maps batch size to method.

Method 1: Web tool (1 to 100 domains, no code)

The simplest way to get started with bulk WHOIS is through the WhoisFreaks web interface; no coding required.

Step 1: Navigate to the Tool

Go to https://whoisfreaks.com/tools/whois/bulk/lookup

Step 2: Enter Your Domain List

In the input field, enter or paste your list of domain names; one domain per line:

google.com
facebook.com
amazon.com
microsoft.com
apple.com

Step 3: Click Search

Click the Search button to initiate the bulk lookup. WhoisFreaks will query WHOIS data for every domain in your list simultaneously.

Step 4: Login/Signup

It will ask you to login. If you don't have an account, you can create one by visiting signup page. Once logged in you will be redirected to bulk domain lookup tool again and it will fetch the data for you.

Step 5: Review Your Results

Results are returned in a structured table showing all WHOIS fields for each domain. You can scan registration dates, registrant details, nameservers, and expiry dates across all domains at a glance.

Step 6: Export Your Data

Download the results as JSON for further analysis in your preferred data tool.

This method fits ad hoc analyst work and small batches of suspicious or auditable domains. For lists above 100 domains or repeatable workflows, use Method 2 (API) or Method 3 (file upload).

Method 2: REST API (100 domains per request, full automation)

For automation, integration into security platforms, or processing large domain lists programmatically, the Bulk WHOIS API is the right method. The endpoint accepts up to 100 domains per request, returns a structured JSON or XML response, and fits SIEM, SOAR, and custom investigation pipelines without translation work. Full request and response details are in the WHOIS API technical reference.

API Endpoint

POST https://api.whoisfreaks.com/v2.0/bulkwhois/live?&apiKey=YOUR_API_KEY&format=json

Request Body

{
  "domainNames": [
    "whoisfreaks.com",
    "facebook.net",
    "ipgeolocation.io"
  ]
}

Key Parameters

Sample Response Structure

{
  "bulk_whois_response": [
    {
      "status": true,
      "domain_name": "facebook.net",
      "query_time": "2026-04-14 07:25:31",
      "whois_server": "https://rdap.verisign.com/net/v1/",
      "domain_registered": "yes",
      "create_date": "2004-04-01",
      "update_date": "2025-04-23",
      "expiry_date": "2034-04-01",
      "domain_registrar": {
        "iana_id": "3237",
        "handle": "3237",
        "status": "accredited",
        "registrar_name": "RegistrarSafe, LLC",
        "normalized_name": "registrarsafe, llc",
        "rdap_server": "https://rdap.registrarsafe.com/"
      },
      "registrant_contact": {
        "name": "Domain Admin",
        "company": "Meta Platforms, Inc",
        "street": "1601 Willow Rd",
        "city": "Menlo Park",
        "state": "CA",
        "zip_code": "94025",
        "country_name": "United States",
        "country_code": "US",
        "email_address": "[email protected]",
        "phone": "+16505434800"
      },
      "technical_contact": {
        "name": "Domain Admin",
        "country_name": "United States",
        "country_code": "US",
        "email_address": "[email protected]",
        "phone": "+16505434800"
      },
      "abuse_contact": {
        "registrar_name": "Abuse Contact",
        "email_address": "[email protected]",
        "phone_number": "+16503087004"
      },
      "name_servers": [
        "b.ns.facebook.com",
        "c.ns.facebook.com",
        "a.ns.facebook.com",
        "d.ns.facebook.com"
      ],
      "domain_status": [
        "clientupdateprohibited",
        "clientdeleteprohibited",
        "clienttransferprohibited",
        "serverdeleteprohibited",
        "serverupdateprohibited",
        "servertransferprohibited"
      ],
      "registry_data": {
        "domain_name": "facebook.net",
        "query_time": "2026-04-14 07:25:30",
        "whois_server": "https://rdap.verisign.com/net/v1/",
        "domain_registered": "yes",
        "create_date": "2004-04-01",
        "update_date": "2025-04-23",
        "expiry_date": "2034-04-01",
        "domain_registrar": {
          "iana_id": "3237",
          "handle": "3237",
          "registrar_name": "RegistrarSafe, LLC"
        },
        "name_servers": [
          "b.ns.facebook.com",
          "c.ns.facebook.com",
          "a.ns.facebook.com",
          "d.ns.facebook.com"
        ],
        "domain_status": [
          "clientupdateprohibited",
          "clientdeleteprohibited",
          "clienttransferprohibited",
          "serverdeleteprohibited",
          "serverupdateprohibited",
          "servertransferprohibited"
        ]
      }
    },
    {
      "status": true,
      "domain_name": "ipgeolocation.io",
      "query_time": "2026-04-14 07:25:31",
      "whois_server": "whois.nic.io",
      "domain_registered": "yes",
      "create_date": "2018-02-26",
      "update_date": "2026-02-01",
      "expiry_date": "2027-02-26",
      "domain_registrar": {
        "iana_id": "1068",
        "status": "accredited",
        "registrar_name": "NameCheap, Inc",
        "normalized_name": "namecheap, inc.",
        "whois_server": "whois.namecheap.com",
        "rdap_server": "https://rdap.namecheap.com/",
        "website_url": "http://www.namecheap.com",
        "email_address": "[email protected]",
        "phone_number": "+19854014545"
      },
      "registrant_contact": {
        "id": "REDACTED",
        "name": "REDACTED",
        "company": "Privacy service provided",
        "street": "REDACTED",
        "city": "REDACTED",
        "state": "Capital Region",
        "zip_code": "REDACTED",
        "country_name": "Iceland",
        "country_code": "IS",
        "email_address": "REDACTED",
        "phone": "REDACTED",
        "fax": "REDACTED"
      },
      "administrative_contact": {
        "id": "REDACTED",
        "name": "REDACTED",
        "company": "REDACTED",
        "street": "REDACTED",
        "city": "REDACTED",
        "state": "REDACTED",
        "zip_code": "REDACTED",
        "country_name": "REDACTED",
        "country_code": "N/A",
        "email_address": "REDACTED",
        "phone": "REDACTED",
        "fax": "REDACTED"
      },
      "technical_contact": {
        "id": "REDACTED",
        "name": "REDACTED",
        "company": "REDACTED",
        "street": "REDACTED",
        "city": "REDACTED",
        "state": "REDACTED",
        "zip_code": "REDACTED",
        "country_name": "REDACTED",
        "country_code": "N/A",
        "email_address": "REDACTED",
        "phone": "REDACTED",
        "fax": "REDACTED"
      },
      "name_servers": [
        "cheryl.ns.cloudflare.com",
        "nash.ns.cloudflare.com"
      ],
      "domain_status": [
        "clienttransferprohibited"
      ],
      "whois_raw_domain": "RAW Data"
    },
    {
      "status": true,
      "domain_name": "whoisfreaks.com",
      "query_time": "2026-04-14 07:25:31",
      "whois_server": "https://rdap.verisign.com/com/v1/",
      "domain_registered": "yes",
      "secure_dns": true,
      "create_date": "2019-03-19",
      "update_date": "2026-02-17",
      "expiry_date": "2027-03-19",
      "domain_registrar": {
        "iana_id": "1068",
        "handle": "1068",
        "status": "accredited",
        "registrar_name": "NameCheap, Inc",
        "normalized_name": "namecheap, inc.",
        "whois_server": "whois.namecheap.com",
        "rdap_server": "https://rdap.namecheap.com/",
        "website_url": "http://www.namecheap.com",
        "email_address": "[email protected]",
        "phone_number": "+16613102107"
      },
      "registrant_contact": {
        "handle": "090bade428c949e7669908d6ac8943b2-Namech",
        "company": "Privacy service provided",
        "street": "Kalkofnsvegur 2",
        "city": "Reykjavik",
        "state": "Capital Region",
        "zip_code": "101",
        "country_name": "Iceland",
        "country_code": "IS",
        "email_address": "[email protected]",
        "phone": "+3544212434"
      },
      "technical_contact": {
        "handle": "b55d6e2a2d2e42058c2408d6ac64a4dc-Namech",
        "company": "Privacy service provided by Withheld for Privacy ehf",
        "street": "Kalkofnsvegur 2",
        "city": "Reykjavik",
        "state": "Capital Region",
        "zip_code": "101",
        "country_name": "Iceland",
        "country_code": "IS",
        "email_address": "[email protected]",
        "phone": "+3544212434"
      },
      "abuse_contact": {
        "registrar_name": "NAMECHEAP INC",
        "email_address": "[email protected]",
        "phone_number": "+19854014545"
      },
      "name_servers": [
        "albert.ns.cloudflare.com",
        "sue.ns.cloudflare.com"
      ],
      "domain_status": [
        "clienttransferprohibited"
      ],
      "registry_data": {
        "domain_name": "whoisfreaks.com",
        "query_time": "2026-04-14 07:25:30",
        "whois_server": "https://rdap.verisign.com/com/v1/",
        "domain_registered": "yes",
        "create_date": "2019-03-19",
        "update_date": "2026-02-17",
        "expiry_date": "2027-03-19",
        "domain_registrar": {
          "iana_id": "1068",
          "handle": "1068",
          "registrar_name": "NameCheap, Inc",
          "whois_server": "whois.namecheap.com",
          "email_address": "[email protected]",
          "phone_number": "+16613102107"
        },
        "name_servers": [
          "albert.ns.cloudflare.com",
          "sue.ns.cloudflare.com"
        ],
        "domain_status": [
          "clienttransferprohibited"
        ]
      }
    }
  ]
}

The Bulk WHOIS API processes up to 100 domains per request, with each successful domain consuming one API credit. Failed or invalid requests do not deduct credits. For lists larger than 100 domains, paginate the request in batches of 100 (loop over chunks in the language of your choice), or use Method 3 (file upload) to push the entire list in one submission.

Method 3: File upload (up to 3 million domains, async)

For enterprise-scale use cases involving thousands or millions of domains, WhoisFreaks supports file-based bulk WHOIS lookups through the dashboard. The file upload method accepts plain text (.txt) or CSV files with one domain per line, processes them asynchronously, and emails the completed CSV when the job finishes.

Step 1: Prepare the file

Create a plain text or CSV file with one domain per line:

example1.com
example2.com
example3.com

Step 2: Upload via the dashboard

Sign in to the WhoisFreaks dashboard, navigate to Utility > Bulk Whois, select File Upload, and submit. The current limit is 3 million domains per file.

Step 3: Wait for processing

Large files are processed asynchronously. WhoisFreaks emails a notification when results are ready to download.

Step 4: Download the results

Download the completed CSV from the dashboard. Each row is one domain with its full WHOIS field set, ready to load into a spreadsheet, database, or threat intelligence platform.

This method fits threat intelligence database enrichment, large-scale compliance screening, domain portfolio audits, and academic research projects.

Which Method Should You Use? Decision Matrix

Choose the method by batch size and how the results need to be consumed.

Bulk WHOIS returns the current state of registration. For ownership history of a domain over time, use the WHOIS History API. For finding all domains tied to a registrant, use the Reverse WHOIS API.

Bulk WHOIS Lookup vs. Individual WHOIS Lookup

What Data Does Bulk WHOIS Return?

Here is a complete breakdown of the fields returned in a bulk WHOIS response:

Understanding Bulk WHOIS Results: What to Look For

1. Important Dates

These fields define the lifecycle of the domain:

• Creation Date (create_date)
  The date when the domain was originally registered.
• Last Updated Date (update_date)
  The most recent date when any changes were made to the domain record (e.g., contact updates, DNS changes, renewal).
• Expiry Date (expiry_date)
  The date when the domain registration will expire if not renewed.

2. Registration Details

These indicate whether the domain is currently registered:

• Domain Registered (domain_registered)
  Specifies the registration status of the domain.
  Typical values:
  • registered > Domain is taken and active
  • available > Domain is not registered
  • unknown > Status could not be determined
• Status (status)
  Boolean indicator showing if the WHOIS lookup was successful.

3. Contact Information

These represent different roles associated with domain ownership and management. Each contact contains similar fields like name, organization, email, phone, and address.

• Registrant Contact (registrant_contact)
  The legal owner of the domain.
• Administrative Contact (administrative_contact)
  Responsible for administrative decisions related to the domain.
• Technical Contact (technical_contact)
  Handles technical aspects such as DNS configuration and server management.
• Billing Contact (billing_contact)
  Responsible for payments, renewals, and financial matters.

Common fields across all contacts:

• Name
• Company/Organization
• Email Address
• Phone Number
• Mailing Address (street, city, state, zip, country)

4. Registrar Information

Details about the organization through which the domain was registered:

• Registrar Name (registrar_name)
  The company managing the domain registration.
• IANA ID (iana_id)
  Unique identifier assigned to the registrar by IANA.
• WHOIS Server (whois_server)
  Server used to retrieve WHOIS data.
• RDAP Server (rdap_server)
  Modern alternative to WHOIS providing structured data.
• Website URL (website_url)
  Official website of the registrar.
• Contact Info (email_address, phone_number)
  Support contact details for the registrar.

5. Domain Status Codes

These indicate the current state and restrictions applied to the domain:

Common values include:

• active > Domain is functioning normally
• clientTransferProhibited > Transfer to another registrar is blocked
• pendingTransfer > Domain transfer is in progress
• clientHold > Domain is suspended (e.g., due to non-payment or abuse)
• expired > Domain has expired

These statuses are defined by ICANN and registries.

6. Nameservers

• Name Servers (name_servers)
  A list of DNS servers responsible for resolving the domain.

Example:

• ns1.example.com
• ns2.example.com

These control how the domain points to hosting services (websites, email, etc.).

7. Registry Data (Secondary WHOIS Source)

• Registry Data (registry_data)
  Contains similar information as above but retrieved directly from the domain registry (authoritative source).

Includes:

• Dates (creation, update, expiry)
• Registrar details
• Nameservers
• Domain status
• Raw WHOIS data

Conclusion

Bulk WHOIS lookup turns a per-domain manual task into a single structured request. Whether the workflow involves 50 domains from a threat feed, a 500-domain corporate portfolio, or 10,000 lookalike domains for brand monitoring, the registration data comes back the same way: structured, timestamped, ready to filter.

WhoisFreaks supports up to 100 domains per API request and up to 3 million domains per file upload, with results in JSON, XML, or CSV that drop into SIEM, SOAR, and automation tools without translation work. The free web tool covers small ad hoc batches with no setup at all.

The difference between an analyst checking 10 domains by hand and one processing 10,000 through an API is not effort. It is which of the three methods above matches the batch size.

Ready to integrate bulk WHOIS into your stack? Start with the Bulk WHOIS API documentation, or review API credit pricing if your batch volume needs estimating.

Ready to start your bulk WHOIS lookup?

Explore the Bulk WHOIS API documentation