How to Use the WhoisFreaks API for Domain Lookups

Introduction

The WhoisFreaks API turns traditional WHOIS lookups into a fast, automated process, giving developers, security teams, and researchers programmatic access to domain intelligence at scale. Through REST endpoints, users can retrieve real-time data on domain ownership, registration details, DNS records, and historical changes.

Designed for easy integration and scalability, it delivers structured JSON responses that work seamlessly with applications, SIEM systems, and threat intelligence platforms. With simple authentication and well-defined endpoints, it enables automated domain monitoring, OSINT investigations, and continuous visibility into domain ecosystems.

In this blog, you will get to know about:

• What the WhoisFreaks API is and what data it covers
• All available API endpoints and what each one returns
• How to authenticate and make your first API call
• Step-by-step walkthroughs for each major lookup type

What Is the WhoisFreaks API?

The WhoisFreaks API is a RESTful service that provides programmatic access to extensive domain intelligence data, including WHOIS records, DNS data, IP intelligence, SSL certificates, domain availability, and threat insights. It supports multiple output formats such as JSON, XML, and CSV, with broad coverage across TLDs, historical datasets, and country-specific records, ensuring accurate and reliable results.

Instead of performing manual lookups, the API enables large-scale domain queries with real-time data fetched directly from authoritative sources. This allows you to automate lookups, integrate domain intelligence into applications, and enhance your security or monitoring systems with up-to-date domain insights.

The API covers data collected across 1500+ domain extensions, including both gTLDs and ccTLDs, with a database of 15+ billion DNS records and 3.7+ billion historical WHOIS records; making it one of the most comprehensive domain intelligence sources available via API today. Registration dates, as part of the ownership information retrieved from WHOIS queries, are crucial for understanding domain registration history and status.

The WhoisFreaks API is used by:

• Security Operations Centers (SOCs) for real-time threat enrichment
• Developers building domain search or verification tools
• Threat Intelligence Teams for infrastructure mapping and actor tracking
• Compliance and Legal Teams for domain ownership verification
• Marketers and Businesses for competitive intelligence and lead generation
• Registrars and Resellers for domain availability and registration data

The breadth and depth of the WHOIS database make it a vital resource for integration into systems and for conducting detailed domain research.

All Available WhoisFreaks API Endpoints

Before diving into individual walkthroughs, here is a complete overview of every API endpoint available. All endpoints return data in structured JSON or XML format. JSON format is the default and preferred option for performance and efficiency.

The domain WHOIS API encompasses multiple lookup and research functions, supporting domain tracking, compliance, security analysis, and automation workflows. Each endpoint queries authoritative servers in real time to retrieve domain registration, name server, and status information, ensuring up-to-date and reliable results.

Authentication: Getting Your API Key

Every request to the WhoisFreaks API requires authentication using an API key. Here is how to get started:

Step 1: Create a Free Account

Visit https://billing.whoisfreaks.com/signup and sign up for a free account. New accounts receive 500 free API credits with no credit card required.

Step 2: Access Your API Key

After signing in, navigate to API Solutions under PRODUCTS and then to the API Keys section. Your unique/primary API key will be displayed there. Copy it and store it securely.

For further details on account creation and getting the API key, you can follow tutorial: Getting Started with WhoisFreaks.

Step 3: Add Your API Key to Requests

Append your API key to every request as a query parameter:

?apiKey=YOUR_API_KEY

Base API URL:

https://api.whoisfreaks.com/

All endpoints are built on top of this base URL.

Payment and Pricing

The WhoisFreaks API uses a flexible, request-based pricing model that scales with your needs, making it suitable for both individual developers and large enterprises. You can start with a free plan that includes API credits; no credit card required; allowing you to explore real-time WHOIS data and core features without commitment.

For higher usage, discounted bulk plans and custom enterprise solutions are available, tailored to specific data and security requirements. Payments are handled securely with support for major methods, ensuring easy access to reliable domain intelligence for monitoring, threat detection, and application development.

How to Use Each API Endpoint: Step-by-Step Walkthroughs

1. WHOIS Lookup API

The WHOIS Lookup API returns the current registration details for any domain, including registration dates, status, and name server information, as well as registrant name, organization, email, phone, registrar, registration date, expiry date, and nameservers.

Endpoint:

GET https://api.whoisfreaks.com/v2.0/whois/live?domainName=google.com&apiKey=YOUR_API_KEY&format=json

Key Parameters:

Sample Response:

{
  "status": true,
  "domain_name": "google.com",
  "query_time": "2026-03-30 10:37:33",
  "whois_server": "https://rdap.verisign.com/com/v1/",
  "domain_registered": "yes",
  "domain_handle": "2138514_DOMAIN_COM-VRSN",
  "create_date": "1997-09-15",
  "update_date": "2024-08-02",
  "expiry_date": "2028-09-13",
  "domain_registrar": {
    "iana_id": "292",
    "handle": "292",
    "status": "accredited",
    "registrar_name": "MarkMonitor Inc",
    "normalized_name": "markmonitor",
    "whois_server": "whois.markmonitor.com",
    "rdap_server": "https://rdap.markmonitor.com/rdap/",
    "website_url": "https://www.markmonitor.com/",
    "email_address": "[email protected]",
    "phone_number": "+12086851750"
  },
  "registrant_contact": {
    "name": "REDACTED REGISTRANT",
    "company": "Google LLC",
    "street": "REDACTED FOR PRIVACY",
    "city": "REDACTED FOR PRIVACY",
    "zip_code": "REDACTED FOR PRIVACY",
    "country_name": "United States",
    "country_code": "US",
    "email_address": "REDACTED FOR PRIVACY",
    "phone": "REDACTED FOR PRIVACY"
  },
  "abuse_contact": {
    "registrar_name": "Markmonitor Inc",
    "email_address": "[email protected]",
    "phone_number": "+12086851750"
  },
  "name_servers": [
    "ns1.google.com",
    "ns2.google.com",
    "ns3.google.com",
    "ns4.google.com"
  ],
  "domain_status": [
    "clientupdateprohibited",
    "clientdeleteprohibited",
    "clienttransferprohibited",
    "serverdeleteprohibited",
    "serverupdateprohibited",
    "servertransferprohibited"
  ],
  "registry_data": {
    "domain_name": "google.com",
    "query_time": "2026-03-30 10:37:31",
    "whois_server": "https://rdap.verisign.com/com/v1/",
    "domain_registered": "yes",
    "create_date": "1997-09-15",
    "update_date": "2019-09-09",
    "expiry_date": "2028-09-14",
    "domain_registrar": {
      "iana_id": "292",
      "handle": "292",
      "registrar_name": "MarkMonitor Inc",
      "whois_server": "whois.markmonitor.com"
    },
    "name_servers": [
      "ns1.google.com",
      "ns2.google.com",
      "ns3.google.com",
      "ns4.google.com"
    ],
    "domain_status": [
      "clientupdateprohibited",
      "clientdeleteprohibited",
      "clienttransferprohibited",
      "serverdeleteprohibited",
      "serverupdateprohibited",
      "servertransferprohibited"
    ]
  }
}

The API queries authoritative servers in real time, ensuring the most up-to-date registration data.

Use it for: Domain ownership verification, registrar identification, expiry monitoring, due diligence.

JSON format is the default and most efficient for most integrations, though XML is available if needed.

2. Historical WHOIS API

The Historical WHOIS API returns all past WHOIS records for a domain, leveraging the WHOIS protocol and the extensive WHOIS database to provide historical registration dates and ownership changes, showing how registration details have changed over time, including previous owners, old registrar transfers, and historical contact information.

Endpoint:

GET https://api.whoisfreaks.com/v1.0/whois?whois=historical&apiKey=YOUR_API_KEY&domainName=google.com

Key Parameters:

Use it for: Domain acquisition due diligence, ownership timeline reconstruction, fraud investigation, threat attribution.

3. Reverse WHOIS API

The Reverse WHOIS API finds all domains registered using a specific piece of WHOIS data, such as an email address, registrant name, phone number, or organization name.

Endpoint:

GET https://api.whoisfreaks.com/v1.0/whois?whois=reverse&apiKey=YOUR_API_KEY&keyword=google

Key Parameters:

Use it for: Brand protection (find all domains registered by competitors), threat actor infrastructure mapping, finding all assets owned by an entity. You can leverage the extensive WHOIS database to retrieve the status and registration dates for all domains associated with a given entity, providing a comprehensive view of domain ownership and history.

4. Bulk WHOIS Lookup API

Bulk WHOIS Lookup in WhoisFreaks is used to retrieve WHOIS data for multiple domains in a single request, eliminating the need for individual queries.

Endpoint:

POST https://api.whoisfreaks.com/v2.0/bulkwhois/live?apiKey=YOUR_API_KEY

Key Parameters:

Body (raw) in JSON format (a max of 100 domains):

{
  "domainNames": [
    "google.com",
    "whoisfreaks.com",
    "jfreaks.com",
    "ipgeolocation.io",
    "apifreaks.com"
  ]
}

It enables efficient large-scale analysis of domain ownership, registrars, and expiration details. This is especially useful for security investigations, portfolio monitoring, and identifying patterns across domains. By handling up to 100 domains per request, it saves time and reduces operational overhead. It is ideal for automation workflows and bulk data processing.

5. DNS Lookup API

The DNS Lookup API returns live, real-time DNS records for any domain or hostname; covering all major record types and retrieves authoritative name server information directly from DNS servers.

Endpoint:

Domain name lookup:

GET https://api.whoisfreaks.com/v1.0/domain/dns/live?apiKey=YOUR_API_KEY&domainName=google.com&type=all

IP address lookup:

GET https://api.whoisfreaks.com/v1.0/domain/dns/live?apiKey=YOUR_API_KEY&ipAddress=8.8.8.8&type=ptr

Both (domain and IP lookup)

GET https://api.whoisfreaks.com/v1.0/domain/dns/live?apiKey=YOUR_API_KEY&ipAddress=8.8.8.8&domainName=google.com&type=all

Supported Record Types:

For domainName: a, aaaa, mx, ns, soa, spf, txt, cname or all (for getting all)

For ipAddress: ptr

Key Parameters:

Use it for: Infrastructure mapping, email configuration verification, subdomain enumeration, CDN detection.

6. Historical DNS API

The Historical DNS API returns archived DNS snapshots for any domain, showing how A, AAAA, MX, NS, TXT, CNAME, SOA, and SPF records have changed over time.

Endpoint:

GET https://api.whoisfreaks.com/v1.0/dns/historical?apiKey=YOUR_API_KEY&domainName=google.com&type=ns&page=1

Use it for: Incident response, C2 tracking, phishing investigation, domain history analysis, IP pivot investigations.

7. Reverse DNS API

The Reverse DNS API returns all domain names that have been associated with a specific IP address; both historically and currently.

Endpoint:

GET https://api.whoisfreaks.com/v2.1/dns/reverse?type=aaaa&value=2001:4860:4860::8888&apiKey=YOUR_API_KEY

Use it for: Threat infrastructure clustering, co-hosted domain discovery, malicious IP investigation, attack surface mapping.

8. Subdomains Lookup API

The Subdomains Lookup API returns all known subdomains for a given domain name, pulled from the WhoisFreaks continuously updated subdomain database.

Endpoint:

GET https://api.whoisfreaks.com/v1.0/subdomains?domain=google.com&status=active&apiKey=YOUR_API_KEY

Use it for: Attack surface discovery, subdomain takeover detection, penetration testing reconnaissance, competitor monitoring.

Now that you have got the context on the usage of APIs; to get details on all other endpoints/APIs you can visit WhoisFreaks' Docs for better understanding.

API Response Formats and Pagination

The WhoisFreaks API supports two response formats:

For endpoints that return large datasets (Historical WHOIS, Historical DNS, Reverse WHOIS), responses are paginated:

&page=1 -> First 1 to 100 records
&page=2 -> Next 101 to 200 records
&page=n -> Next [(n-1)*100]+1 to n*100 records

Always check the totalPages, total_Pages, total_pages or any field mentioning total pages in the response to know how many pages of data are available for a given query.

Note: If you exceed your API rate limits, the API will return an error with HTTP error code 429 (Too Many Requests). To get details on rate limits or RPMs you can refer to the Rate Limit section in pricing cards.

API Credit System: How It Works

For a complete guide on how much API credits are consumed for each request you can refer to the Credit Usage API.

New accounts receive 500 free credits upon signup; enough to get started with integration and testing immediately.

Integration and Support

Integrating the WhoisFreaks API is simple due to its developer-friendly design and compatibility with major programming languages and platforms. It enables easy addition of WHOIS lookups, domain tracking, and IP intelligence into applications, supported by comprehensive documentation, tutorials, and code samples for quick implementation.

Ongoing support includes a detailed knowledge base, FAQs, and direct assistance via email, phone, and live chat. With reliable access to real-time data and strong support resources, WhoisFreaks helps developers build efficient solutions for domain analysis, monitoring, and threat intelligence. If you're looking to connect with third-party applications, you can visit the integrations page to explore complete details and available options for seamless connectivity.

Conclusion

The WhoisFreaks API provides reliable, real-time access to comprehensive WHOIS data, including domain registration details, ownership information, and expiration records. It is designed for businesses, developers, and researchers who need scalable access to large volumes of domain intelligence.

With flexible integration and support for both JSON and XML formats, the API can be easily incorporated into a wide range of applications and workflows. Users can monitor domain availability, track ownership changes, and analyze WHOIS records efficiently for operational or security purposes.

Overall, WhoisFreaks API delivers scalable, accurate domain data with strong support and seamless integration, enabling users to enhance domain monitoring, automate workflows, and strengthen security and research capabilities.