WhoisFreaks

Show how much of the WhoisFreaks API key's allowance is used: pay-as-you-go credits bought and used, and the subscription's status, request limit, requests used and surcharge requests. Use this before a large job (a bulk lookup, many pages of reverse WHOIS or typosquatting results) to check there is enough left, or when a lookup fails with a plan or credit limit error. Returns the key (masked), its credits and its subscription usage; a part the account does not have is left out. Behavior: read-only. Reads the usage of your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request); it looks nothing up and changes nothing. If the key is invalid the result is a short message (HTTP 401) instead of data.

Get the registry WHOIS record for an autonomous system (ASN): the network operator behind a set of IP routes. Use this when you have an AS number (for example from ipWhoisLookup or ipGeolocation output) and need the operator's name, country, contacts or the IP prefixes it announces. If you only have an IP address, call ipWhoisLookup first to get its ASN. Returns the organisation name and description, country of registration, announced IPv4 and IPv6 prefixes, peering information, admin and technical contacts, and AS sets and blocks. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Resolve the current DNS records of up to 100 domains, and the PTR records of up to 100 IP addresses, in one request. Use this instead of calling dnsLookup many times, for example to check the mail servers of a list of domains or to name a list of IPs from logs. Provide domainNames, ipAddresses, or both. For one domain or IP use dnsLookup. Lists longer than 100 go in several calls; files of up to 3 million entries are handled by the Bulk Tool in the WhoisFreaks billing dashboard, not by this tool. Costs 1 credit per domain or IP. A large batch can take a few minutes. Returns one entry per domain or IP, with the same record fields as dnsLookup. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Check whether many domain names can be registered, in one request: either up to 100 full domain names, or one name across up to 100 extensions (TLDs). Use this to pick an available name across extensions such as .com, .io and .ai (pass domain and tlds), or to check a list of candidate names (pass domainNames). For one name, or for name ideas, use domainAvailability with suggestions=true. Uses API credits for each domain checked. An invalid name returns its own error entry while the other names still return results. Returns each domain with its availability: AVAILABLE, UNAVAILABLE or UNKNOWN. Availability can change at any moment, and this check does not reserve anything. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Look up the location and network of up to 100 IPv4 or IPv6 addresses in one request. Use this instead of calling ipGeolocation many times, for example to map the visitors or attackers in a log. For one IP use ipGeolocation. For threat signals on many IPs use bulkIpSecurity. Costs 1 credit per IP answered. Returns one entry per IP, with the same fields as ipGeolocation. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Check the reputation of up to 100 IPv4 or IPv6 addresses in one request: VPN, proxy, Tor, relay, spam, known-attacker and bot signals for each. Use this instead of calling ipSecurity many times, for example to screen the IPs behind a wave of sign-ups or failed logins. For one IP use ipSecurity. For location only use bulkIpGeolocation. Costs 1 credit per IP answered. An invalid IP returns its own error entry while the other IPs still return results. Returns one entry per IP, with the same fields as ipSecurity. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Get the current WHOIS records of up to 100 domains in one request, queried live. Use this instead of calling liveWhoisLookup many times, for example to audit a domain portfolio or enrich a list of domains taken from logs. For one domain use liveWhoisLookup. Lists of more than 100 domains go in several calls; files of up to 3 million domains are handled by the Bulk Tool in the WhoisFreaks billing dashboard, not by this tool. Costs 1 credit per domain. A large batch can take a few minutes. Returns one WHOIS record per domain, with the same fields as liveWhoisLookup. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Get the historical DNS records of a domain, showing how its A, MX, NS and other records changed over time. Use this for investigations and migrations: earlier hosting IPs (for example the origin IP behind a CDN), past mail servers, or name server changes. For the current records only use dnsLookup. For ownership changes use whoisHistory. Costs 2 credits per page. Returns past records with the dates they were observed. Results are paginated: raise page to get more, and filter by type to reduce output. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Resolve a domain's current DNS records live: A, AAAA, MX, NS, CNAME, SOA, TXT and SPF. With ipAddress it also does a reverse (PTR) lookup of an IP address. Use this to see where a domain points now: its IP addresses, mail servers, name servers, or TXT records such as SPF, DKIM and DMARC. For how records changed over time use dnsHistory. To go the other way and find domains that use a given IP, mail server or name server use reverseDnsLookup. For many domains or IPs at once use bulkDnsLookup. type=all (the default) returns every record type in one call; pass one type or a short list such as mx,txt to keep the result small. cnameDepth follows CNAME chains, for example for www hosts behind a CDN. Returns the records grouped by type. A domain with no records of the requested type returns an empty list or a "no data found" message. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Check whether a domain name is available to register, using both DNS and WHOIS data. Use this before suggesting or buying a domain name. Set suggestions=true to also get alternative names with other extensions, each marked available or not; count sets how many (5-100). To check a list of names, or one name across many extensions, use bulkDomainAvailability. For details about who owns a registered domain use liveWhoisLookup. Costs 1 credit, plus 1 credit per 5 suggestions. Returns the availability (AVAILABLE or UNAVAILABLE), or with suggestions a list of names each with domainAvailability true or false. Availability can change at any moment, and this check does not reserve the domain. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Find registered domains that look like typo variants of a brand name (typosquats such as paypa1.com or paypal-secure.net), or that match a wildcard pattern, across more than 1,500 TLDs. Use this for brand protection, phishing detection, or tracking look-alike registrations. Provide exactly one of keyword or pattern. For subdomains that imitate a brand on unrelated domains, such as login.paypa1.example.com, use subdomainTyposquatting. To find domains whose name simply contains a word use reverseWhoisLookup with keyword. To judge how risky a result is use domainReputation; for its owner use liveWhoisLookup. Costs 5 credits per page (100 domains by default). A search can take up to two minutes. Returns each domain with its creation, expiry and last-seen dates and whether it has been dropped, plus the total count. When there are more, the result has a nextPageToken: pass it as pageToken, with the same keyword or pattern, to get the next page. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Assess how risky a domain is, live: a verdict (safe, low_risk, suspicious, malicious or unknown) with its confidence and severity, a trust score with the positive and negative signals behind it, DGA (algorithmically generated name) analysis, matches in threat-intelligence feeds, email security (SPF, DKIM, DMARC and mail servers), and a recommended action. Use this to triage a suspicious domain from an email, a log or a domainDiscovery result before deciding whether to block it. For the domain's owner use liveWhoisLookup, for its certificate sslLookup, and for an IP address ipSecurity. Costs 5 credits. An unknown or unregistered domain still returns an assessment; lookups that failed are listed under errors and only leave out their signals. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Look up where an IPv4 or IPv6 address is located and which network it belongs to. Use this for country, region, city, coordinates, ISP, ASN, connection type and local currency, for example to localise a visitor or see where a server is hosted. The location is an estimate and is most reliable at country level. For many IPs at once use bulkIpGeolocation. For VPN, proxy, Tor and threat signals use ipSecurity. For the registered owner of the IP block and its abuse contact use ipWhoisLookup. Private and reserved addresses (10.x, 192.168.x, 127.x and similar) cannot be geolocated and return a "non-routable IP" (HTTP 423) message. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Check the reputation of an IPv4 or IPv6 address: VPN, proxy (including residential), Tor exit node, privacy relay, spam and known-attacker activity, bots by type and operator, and whether it belongs to a cloud provider or a corporate secure web gateway. Use this for fraud checks, sign-up or login screening, or triaging a suspicious IP from logs. For many IPs at once use bulkIpSecurity. For location and ISP only use ipGeolocation. For the registered owner and abuse contact use ipWhoisLookup. Returns a threat score from 0 to 100, a flag and confidence score for each signal, provider names where known, and the IP's location, network (route, anycast, CDN) and ASN. A clean result means no signals were found, not that the IP is guaranteed safe. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Get the registry WHOIS record for an IPv4 or IPv6 address: who the IP block is allocated to. Use this to find the owning organisation, CIDR range, AS number and abuse contact of an IP, for example to report abuse. For city, ISP and coordinates use ipGeolocation. For VPN, proxy, Tor and threat signals use ipSecurity. For details about the autonomous system itself use asnWhoisLookup. For domains hosted on the IP use reverseDnsLookup. Returns the network range (inetnum/inet6num) and CIDR, owning organisation and ASN, admin, technical and abuse contacts, route objects, and the raw WHOIS text. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Get the current WHOIS registration record for a domain, queried live from WHOIS servers and RDAP. Use this to find who owns a domain now, its registrar, creation and expiry dates, name servers or status. For past owners and changes over time use whoisHistory. For many domains at once use bulkWhoisLookup. To find domains owned by a person, email or company use reverseWhoisLookup. To check whether an unregistered name can be bought use domainAvailability. Pass a bare domain (example.com), not a URL. Returns registrar and registry details, creation/update/expiry dates, registrant, admin and technical contacts (often privacy-redacted), name servers, domain status flags and the raw WHOIS text. When the registrar does not answer, the result is marked as a partial record (HTTP 206); when no live lookup works, as the latest stored record (HTTP 210). Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Find domains whose DNS records point to a given value: an IP address or range, mail server, name server or other record value. Use this to see which other sites share a hosting IP, which domains use a mail server or name server, or to map infrastructure during an investigation. Set type to match the value: a for an IPv4 address or range (default), aaaa for IPv6, mx for a mail server, ns for a name server. For a domain's own records use dnsLookup. For the registered owner of an IP block use ipWhoisLookup. exact=false (the default) enables '*' wildcard matching, for example *.cloudflare.com. sort=desc with sortBy=lastSeen puts the most recently seen domains first. Costs 5 credits per page of up to 100 domains. Popular IPs and name servers can match millions of domains, so use page and stop once you have enough. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Find domains whose WHOIS records contain a given email, registrant name or company, or whose name contains a keyword, across 4.6 billion WHOIS records. Use this to map everything a person or organisation has registered, for example when investigating a phishing actor or auditing a company's domain portfolio. Provide exactly one of email, owner, company or keyword. To look up the owner of one known domain use liveWhoisLookup. To find look-alike domains of a brand (typosquats) use domainDiscovery. mode=mini returns a short summary per domain and 100 domains per page, against 50 full records per page in the default mode. Costs 5 credits per page, so prefer mini when you only need the list of domains. Results are paginated: the response gives the total pages, and page selects the next one. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Get the SSL/TLS certificate a domain currently serves, fetched live. Use this to check expiry dates, the issuer, covered hostnames (SANs) or key type, or to debug HTTPS errors. Set chain=true to include intermediate and root certificates when diagnosing trust-chain problems, and sslRaw=true only when you need the raw OpenSSL output, which is long. For DNS records use dnsLookup; for domain ownership use liveWhoisLookup; for an overall risk verdict on the domain use domainReputation. Costs 1 credit, plus 1 credit per 2 certificates with chain=true. Returns each certificate's subject (common name, organisation), issuer, validity dates, serial number, signature algorithm, key algorithm and size, and extensions: covered hostnames (SANs), key usages, issuer and OCSP URLs, and certificate policies. A domain with no certificate returns a "no data found" (HTTP 404) message. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

List the known subdomains of a domain (for example api.example.com or mail.example.com) from the WhoisFreaks subdomain database. Use this for attack-surface mapping, finding exposed services, or auditing a company's hosts. It looks up subdomains already discovered by WhoisFreaks rather than scanning the target, so it only knows subdomains that have been observed. To get a subdomain's DNS records use dnsLookup. To find look-alike domains of a brand use domainDiscovery, and look-alike subdomains on other domains use subdomainTyposquatting. status=active keeps only subdomains that currently resolve; after and before (YYYY-MM-DD) filter by when a subdomain was discovered. Costs 2 credits per page. Results are paginated, so large domains may need several pages. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Find subdomains, on any domain, that contain a typo variant of a brand name or match a wildcard pattern as one of their labels, for example login.paypa1.example.com. Phishing pages often hide a brand inside a subdomain of an unrelated domain, so these hosts never show up in domainDiscovery. Use this for brand protection and phishing hunting. Provide exactly one of keyword or pattern. For the subdomains of one domain use subdomainLookup. To judge how risky a result's domain is use domainReputation. Costs 5 credits per page (100 subdomains by default). Returns each subdomain with its registrable domain, whether it is active, and its first-seen, last-seen and inactive-from dates, plus the total count. When there are more, the result has a nextPageToken: pass it as pageToken, with the same keyword or pattern, to get the next page. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).

Get the historical WHOIS records of a domain: deduplicated snapshots ordered from newest to oldest, going back as far as 1986. Use this to see previous owners, registrar transfers, past contacts, name server changes, or when a domain expired and was re-registered. For only the current record use liveWhoisLookup. For DNS changes over time use dnsHistory. Costs 2 credits. Every record comes back in one response; there are no pages. Returns a list of snapshots, each with the registrar, dates, contacts and name servers recorded at that time. A domain with no recorded history returns a "no data found" message. Behavior: read-only. Makes one request to the WhoisFreaks API using your WhoisFreaks API key (the WHOISFREAKS_API_KEY environment variable, or on the hosted server the key sent with the request) and uses that account's API credits; nothing is created or changed. If the call fails, the result is a short message instead of data, for example: key invalid, or plan or credits used up (HTTP 401), domain extension not supported (HTTP 403), no data found (HTTP 404), or rate limit reached (HTTP 429).