IP2WHOIS Information Lookup API for Domain Data

Overview

IP2WHOIS Information Lookup offers an API and a downloadable database designed for programmatic access to WHOIS records. This service enables developers and organizations to retrieve detailed information about domain registrations and associated IP addresses. The API facilitates real-time queries for domain data, which can include registrant contact details, registration and expiration dates, domain status, and nameserver information. This data is critical for use cases such as monitoring domain portfolios, performing cybersecurity threat intelligence, conducting brand protection activities by identifying infringing domains, and enhancing general website intelligence.

The IP2WHOIS API is structured to deliver parsed and organized WHOIS data, simplifying integration compared to direct WHOIS protocol queries that often require extensive parsing logic. It provides a RESTful interface, allowing for queries using domain names or IP addresses, and returns data in JSON or XML formats. This standardized output is beneficial for automated processing and integration into various applications, including security information and event management (SIEM) systems, customer relationship management (CRM) platforms, and internal data analysis tools. The API also supports bulk lookups, which can be advantageous for processing large lists of domains or for initial data ingestion into a database.

For scenarios requiring offline access or extensive local data analysis, IP2WHOIS also offers a downloadable WHOIS database. This database provides a comprehensive collection of domain registration records, updated regularly, allowing users to perform local queries without relying on real-time API calls. This can be particularly useful for researchers, large enterprises with specific compliance needs, or services that require very high query volumes and low latency. The database covers various top-level domains (TLDs) and generic top-level domains (gTLDs), offering a broad spectrum of internet registration data. The service maintains clear developer documentation and offers SDKs in multiple programming languages, aiming to streamline the integration process for a diverse developer audience.

From a technical standpoint, IP2WHOIS manages the complexities of querying various WHOIS servers globally, which often have different data formats and rate limits. By consolidating this process, it provides a unified interface and consistent data structure. This abstraction layer helps developers avoid the overhead of managing multiple WHOIS protocols and parsing diverse responses, allowing them to focus on utilizing the data. The API's capabilities extend to providing historical WHOIS records, which can be vital for investigating domain ownership changes over time, tracking domain squatting, or analyzing the lifecycle of malicious domains. This historical perspective adds another dimension to threat intelligence and forensic analysis efforts.

Key features

• Real-time WHOIS lookup: Access current domain registration details, including registrant contact information, registration dates, expiration dates, and nameservers.
• IP address WHOIS: Retrieve WHOIS data associated with IP addresses, providing information on network owners and allocation details.
• Historical WHOIS data: Access past registration records to track changes in domain ownership and registration details over time.
• Bulk WHOIS lookup: Process multiple domain or IP queries simultaneously, suitable for large datasets and automated analysis.
• Data parsing and standardization: Receive consistently formatted and parsed WHOIS data, simplifying integration and reducing the need for custom parsing logic.
• Multiple data formats: API responses available in JSON and XML for flexible integration into different application environments.
• Developer SDKs: Support for PHP, Python, Ruby, Java, Node.js, .NET, and Go to accelerate development and integration.
• GDPR compliance: Adherence to General Data Protection Regulation (GDPR) standards for data handling and privacy.
• WHOIS database download: Option to download a comprehensive WHOIS database for offline analysis and high-volume local queries.

Pricing

IP2WHOIS offers a free tier for initial exploration and various paid plans based on query volume. As of May 2026, the pricing structure is as follows:

For detailed and up-to-date pricing information, including annual discounts and enterprise solutions, refer to the IP2WHOIS pricing page.

Common integrations

• Security Information and Event Management (SIEM) systems: Integrate WHOIS data into SIEM platforms to enrich security alerts with domain ownership and registration context.
• Threat intelligence platforms: Enhance threat intelligence feeds by automatically querying domain details for suspicious indicators of compromise (IOCs).
• Fraud detection systems: Use domain registration data to identify potentially fraudulent websites or phishing attempts based on registrant information or domain age.
• Brand protection tools: Monitor for new domain registrations that infringe on trademarks by regularly checking WHOIS records.
• CRM and customer onboarding: Verify customer website ownership or gain insights into their online presence during onboarding processes.
• Web analytics and SEO tools: Supplement website analysis with domain age and ownership data for competitive intelligence.
• Custom internal applications: Build bespoke tools for domain portfolio management, research, or automated compliance checks.

Alternatives

• WHOISXMLAPI: Offers a comprehensive suite of WHOIS and domain intelligence APIs, including historical data and parsed WHOIS records.
• Whois.com: Provides a web-based WHOIS lookup tool and API services for domain registration information.
• DomainTools: Provides advanced domain and IP intelligence, including WHOIS data, DNS records, and predictive risk scoring for cybersecurity.
• AWS Route 53 WHOIS Lookup: Provides a basic WHOIS lookup for domains registered through AWS Route 53, offering administrative and technical contact details.
• Azure DNS WHOIS Lookup: Offers WHOIS information for domains managed within Azure DNS, useful for Azure cloud environments.

Getting started

To begin using the IP2WHOIS API, you typically obtain an API key from your account dashboard after registration. The following Python example demonstrates how to perform a basic WHOIS lookup for a domain using the requests library, which is a common approach for interacting with RESTful APIs.

import requests
import json

API_KEY = "YOUR_API_KEY"  # Replace with your actual IP2WHOIS API key
DOMAIN = "apispine.com"  # The domain you want to look up

def get_whois_info(domain, api_key):
    base_url = "https://api.ip2whois.com/v2"
    params = {
        "key": api_key,
        "domain": domain
    }
    try:
        response = requests.get(base_url, params=params)
        response.raise_for_status()  # Raise an HTTPError for bad responses (4xx or 5xx)
        return response.json()
    except requests.exceptions.HTTPError as http_err:
        print(f"HTTP error occurred: {http_err}")
        print(f"Response content: {response.text}")
    except requests.exceptions.ConnectionError as conn_err:
        print(f"Connection error occurred: {conn_err}")
    except requests.exceptions.Timeout as timeout_err:
        print(f"Timeout error occurred: {timeout_err}")
    except requests.exceptions.RequestException as req_err:
        print(f"An error occurred: {req_err}")
    return None

if __name__ == "__main__":
    whois_data = get_whois_info(DOMAIN, API_KEY)
    if whois_data:
        print(json.dumps(whois_data, indent=4))
        # Example of accessing specific data points
        if 'domain' in whois_data:
            print(f"\nDomain Name: {whois_data['domain']['name']}")
            print(f"Registrar: {whois_data['domain']['registrar']['name']}")
            print(f"Creation Date: {whois_data['domain']['creation_date']}")
            print(f"Expiration Date: {whois_data['domain']['expiration_date']}")
        if 'registrant' in whois_data and 'organization' in whois_data['registrant']:
            print(f"Registrant Organization: {whois_data['registrant']['organization']}")
    else:
        print(f"Failed to retrieve WHOIS information for {DOMAIN}.")

This Python script defines a function get_whois_info that takes a domain and your API key, constructs the request URL, and sends a GET request to the IP2WHOIS API. It then prints the JSON response in a formatted way. Remember to replace "YOUR_API_KEY" with your actual API key obtained from the IP2WHOIS developer dashboard. Error handling is included to catch common issues like network problems or API errors. The script also demonstrates how to parse and display specific fields from the returned WHOIS data, such as the domain name, registrar, and creation date, illustrating the structured nature of the API's output.