Overview
API Concepts Manage API Key
Internet Data
DNSIQ® WHOISIQ™ SSL Certificates Blacklist Lookup Host Attributes
Attack Analytics
Newly Observed Domains Newly Observed Hosts Malware Phishing Scam Content
Digital Footprint
Global Inventory API Global Inventory Schema
Coming Soon
Enrich
PassiveTotal
Actions Artifact Enrichment Exposed Services Monitor Project SSL Certificates Tag Artifact Trackers Host Attributes Passive DNS Whois Bulk Enrichment
Additional Resources
Workspace Management API
RiskIQ.com

Whois

Retrieves the WHOIS data for the specified query

 

What It Looks Like

Get WHOIS

Retrieves the WHOIS data for the specified query

Parameters

Field Field Type Description
queryString the domain being queried
compact_record (optional)Boolean whether to compress the results
history (optional)Boolean whether to return historical results

Curl Example

$ curl -u $USERNAME:$KEY 'https://api.riskiq.net/pt/v2/whois?query=passivetotal.org'
# With history parameter
$ curl -u $USERNAME:$KEY 'https://api.riskiq.net/pt/v2/whois?query=passivetotal.org&history=true'
     		

Sample Response

{
	"tech": {
	"organization": "RiskIQ, Inc.",
	"email": "domains@riskiq.com",
	"name": "Elias Manousos",
	"telephone": "15555555555"
	},
	"whoisServer": "whois.1and1.com",
	"registered": "2014-04-14T13:00:56.000-0700",
	"registrar": "1 & 1 Internet AG",
	"domain": "passivetotal.org",
	"registrant": {
	"organization": "RiskIQ, Inc.",
	"email": "domains@riskiq.com",
	"name": "Elias Manousos",
	"telephone": "15555555555"
	},
	"billing": {},
	"telephone": "15555555555",
	"lastLoadedAt": "2017-03-15T13:34:31.957-0700",
	"nameServers": [
	"ns-1460.awsdns-54.org",
	"ns-218.awsdns-27.com",
	"ns-613.awsdns-12.net",
	"ns-1868.awsdns-41.co.uk"
	],
	"name": "Elias Manousos",
	"registryUpdatedAt": "2017-03-14T11:25:48.000-0700",
	"admin": {
	"organization": "RiskIQ, Inc.",
	"email": "domains@riskiq.com",
	"name": "Elias Manousos",
	"telephone": "15555555555"
	},
	"organization": "RiskIQ, Inc.",
	"zone": {},
	"contactEmail": "domains@riskiq.com",
	"expiresAt": "2018-04-14T13:00:56.000-0700"
}
				

Compact Record Sample Response

{
 	"telephone": "15555555555",
	"registrar": "1 & 1 Internet AG",
	"compact": {
		"fax": {
			"values": [],
			"raw": []
			},
		"city": {
			"values": [],
			"raw": []
		},
		"email": {
			"values": [
				[
				"domains@riskiq.com",
					[
						"registrant",
						"admin",
						"tech"
					]
				]
			],
		"raw": 	[
				"domains@riskiq.com"
				]
		},
		"telephone": {
		"values": [
			[
			"15555555555",
				[
			"registrant",
			"admin",
			"tech"
				]
			]
		],
		"raw": [
			"15555555555"
			]
		},
		"street": {
		"values": [],
		"raw": []
		},
		"country": {
		"values": [],
		"raw": []
		},
		"organization": {
		"values": [
		[
			"RiskIQ, Inc.",
			[
			"registrant",
			"admin",
			"tech"
			]
		]
				],
		"raw": [
			"RiskIQ, Inc."
				]
		},
		"state": {
		"values": [],
		"raw": []
		},
		"name": {
		"values": [
			[
			"Elias Manousos",
			[
			"registrant",
			"admin",
			"tech"
			]
					]
			],
		"raw": [
			"Elias Manousos"
				]
			},
		"postalCode": {
		"values": [],
		"raw": []
							}
		},
		"billing": {},
		"zone": {},
		"admin": {
		"organization": "RiskIQ, Inc.",
		"email": "domains@riskiq.com",
		"telephone": "15555555555",
		"name": "Elias Manousos"
		},
		"registryUpdatedAt": "2017-03-14",
		"organization": "RiskIQ, Inc.",
		"tech": {
		"organization": "RiskIQ, Inc.",
		"email": "domains@riskiq.com",
		"telephone": "15555555555",
		"name": "Elias Manousos"
		},
		"registrant": {
		"organization": "RiskIQ, Inc.",
		"email": "domains@riskiq.com",
		"telephone": "15555555555",
		"name": "Elias Manousos"
		},
		"nameServers": [
			"ns-1460.awsdns-54.org",
			"ns-218.awsdns-27.com",
			"ns-613.awsdns-12.net",
			"ns-1868.awsdns-41.co.uk"
		],
		"contactEmail": "domains@riskiq.com",
		"registered": "2014-04-14",
		"lastLoadedAt": "2017-03-15",
		"expiresAt": "2018-04-14",
		"domain": "passivetotal.org",
		"whoisServer": "whois.1and1.com",
		"name": "Elias Manousos"
}
			 

Search WHOIS Keyword

Search WHOIS data for a keyword.

Parameters

Field Field Type Description
queryString the value of the field being queried

Curl Example

$ curl -u $USERNAME:$KEY 'https://api.riskiq.net/pt/v2/whois/search/keyword?query=riskiq'
			

Sample Response

{
	"queryValue": "riskiq",
	"results": [
	{
	  "matchType": "domain",
	  "fieldMatch": "name",
	  "focusPoint": "riskiq.co.za"
	},
	...
	{
	  "matchType": "domain",
	  "fieldMatch": "organization",
	  "focusPoint": "riskiq.com.au"
	}
	]
}
				

Search WHOIS

Searches WHOIS data by field and query.

Parameters

Field Field Type Description
queryString the value of the field being queried.
For exact matches, put the query inside quotes. For example: “ns1.passivetotal.org”
fieldString the field to query
Allowed values: "email", "domain", "name", "organization", "address", "phone", "nameserver"

Curl Example

$ curl -u $USERNAME:$KEY 'https://api.riskiq.net/pt/v2/whois/search?query=domains@riskiq.com&field=email'
			

Sample Response

{
	  "results": [
		{
		"telephone": "15555555555",
		"nameServers": [
		"ns1.mediatemple.net",
		"ns2.mediatemple.net"
		],
		"billing": {
		"organization": "RiskIQ, Inc.",
		"email": "domains@riskiq.com",
		"telephone": "15555555555",
		"name": "Elias Manousos"
		},
		"zone": {},
		"admin": {
		"organization": "RiskIQ, Inc.",
		"email": "domains@riskiq.com",
		"telephone": "15555555555",
		"name": "Elias Manousos"
		},
		"registryUpdatedAt": "2016-05-06T09:32:28.000-0700",
		"organization": "RiskIQ, Inc.",
		"tech": {
		"organization": "RiskIQ, Inc.",
		"email": "domains@riskiq.com",
		"telephone": "15555555555",
		"name": "Elias Manousos"
		},
		"registrant": {
		"organization": "RiskIQ, Inc.",
		"email": "domains@riskiq.com",
		"telephone": "15555555555",
		"name": "Elias Manousos"
		},
		"contactEmail": "domains@riskiq.com",
		"registered": "2010-05-21T02:25:52.000-0700",
		"lastLoadedAt": "2017-01-02T20:19:36.847-0800",
		"expiresAt": "2018-05-21T02:25:52.000-0700",
		"domain": "malvertisingdb.info",
		"whoisServer": "whois.godaddy.com",
		"name": "Elias Manousos",
		"registrar": "GoDaddy.com, LLC"
		},
		...
		]
}