Products APIs Data Feeds Web Tools Domain Research & Monitoring Enterprise Packages
WHOIS / WHOIS History
WHOIS / WHOIS History

Provide current and historical ownership information on domains / IPs. Identify all connections between domains, registrants, registrars, and DNS servers.

DNS / DNS History
DNS / DNS History

Look into all current and historical DNS / IP connections between domains and A, MX, NS, and other records. Monitor suspicious changes to DNS records.

IP Geolocation / IP Netblocks
IP Geolocation / IP Netblocks

Get detailed context on an IP address, including its user’s geolocation, time zone, connected domains, connection type, IP range, ASN, and other network ownership details.

Domain Research Suite (DRS)
Domain Research Suite (DRS)

Access our web-based solution to dig into and monitor all domain events of interest.

Domain Research Suite (DRS)
Domain Research Suite (DRS)

Get access to a web-based enterprise-grade solution to search and monitor domain registrations and ownership details for branded terms, fuzzy matches, registrants of interest, and more.

Research
Monitoring
White-Label
Enterprise API Packages
Enterprise API Packages

Our complete set of domain, IP, and DNS intelligence available via API calls as an annual subscription with predictable pricing.

Security Intelligence (SI) Suite
Security Intelligence (SI) Suite

Offers complete access to WHOIS, IP, DNS, and subdomain data for product enrichment, threat hunting and more.

Premium API Services
Premium API Services

Enjoy priority data access with our premium API services topped with extra perks including dedicated team support, enterprise-grade infrastructure, and SLAs for full scalability and high performance.

×
Contact Us
Specifications Pricing Blog
FAQ Datafeed files Output format CSV structure

Datafeed files

The data feed provides a downloadable database of the registered IP Netblocks (IP ranges) with detailed information regarding each range. Some network blocks provided by the API may be missing in the data feed. That happens when a block equals an Autonomous System's route but doesn't have a corresponding WHOIS. Those records have the "parent" field set in the API response.

The database contains IP whois data from major Internet Addresses Registries on a daily basis

The resulting database is a joint dataset, post-processed to get unified and consistent format and data. The output format is JSON or CSV where every row is a separate JSON object or CSV row. It allows parallel processing in your systems.

About 20% of records have partly redacted contact information, due to GDPR.

The datafeeds described below are presented in the following three forms:

  • Full databases — a full database of all the IP Netblocks for a given date in unified and consistent JSON or CSV format. These files are named in format:
    "ip_netblocks.%DATE%.full[.v6].jsonl.gz"
    "ip_netblocks.%DATE%.full.blocks[.v6].csv.gz"
    "ip_netblocks.%DATE%.full.contacts[.v6].csv.gz", e.g. "ip_netblocks.2018-12-19.full.contacts.csv.gz" and "ip_netblocks.2018-12-19.full.contacts.v6.csv.gz"
  • Daily incremental databases — changes in full IP Netblocks database compared to the previous date. Includes added, dropped and modified IP ranges since yesterday. These files are named in format:
    "ip_netblocks.%DATE%.daily.jsonl[.v6].gz"
    "ip_netblocks.%DATE%.daily.blocks[.v6].csv.gz"
    "ip_netblocks.%DATE%.daily.contacts[.v6].csv.gz", e.g. "ip_netblocks.2018-12-19.daily.contacts.csv.gz" and "ip_netblocks.2018-12-19.daily.contacts.v6.csv.gz"
  • Lite databases — a partial database of the IP Netblocks for a given date made for academic purposes. It includes about 5% of a full IPv4 database. It doesn't provide IPv6 records. These files are named in format:
    "ip_netblocks.%DATE%.lite.jsonl.gz"
    "ip_netblocks.%DATE%.lite.blocks.csv.gz"
    "ip_netblocks.%DATE%.lite.contacts.csv.gz", e.g. "ip_netblocks.2018-12-19.lite.contacts.csv.gz"

File storage time: full and daily files are available for 3 months since their creation date. Lite files are available for a week.

A fresh daily incremental database is delivered every day at 02.00 PST.

1. All datafeed files

Base path

Samples

Average file sizes

Here are presented approximate files sizes and records numbers.

gzip unpacked records
v4 v6 v4 v6 v4 v6
Full .jsonl 580.3MiB 102.4MiB 8.1GiB 1.2GiB 9.1M 1.2M
Full .blocks.csv 260.0MiB 52.0MiB 2.2GiB 349.9MiB 9.1M 1.2M
Full .contact.csv 93.7MiB 13.6MiB 536.4MiB 68.5MiB 4.6M 535.5K
Daily .jsonl 15.8MiB 344.7KiB 227.0MiB 3.6MiB 244.8K 3.4K
Daily .blocks.csv 7.0MiB 191.2KiB 51.8MiB 1.0MiB 244.8K 3.4K
Daily .contact.csv 3.1MiB 51.9KiB 19.3MiB 164.6KiB 164.6K 1.8K
Lite .jsonl 38.2MiB - 420.1MiB - 454.4K -
Lite .blocks.csv 16.9MiB - 100.5MiB - 454.4K -
Lite .contact.csv 7.3MiB - 32.7MiB - 296.1K -

2. BGP enriched datafeed files

The BGP enriched files include a parent field that is the reference to the block from which the information was borrowed. Its presence indicates that the block was obtained from BGP routing tables.

Base path

Samples

Average file sizes

Here are presented approximate files sizes and records numbers.

gzip unpacked records
BGP v4 BGP v6 BGP v4 BGP v6 BGP v4 BGP v6
Full .jsonl 618.7MiB 117.4MiB 9.7GiB 1.8GiB 10.3M 1.6M
Full .blocks.csv 281.8MiB 63.1MiB 2.5GiB 534.6MiB 10.3M 1.6M
Full .contact.csv 93.7MiB 13.6MiB 536.4MiB 68.5MiB 4.6M 535.5K
Daily .jsonl 16.2MiB 496.8KiB 240.6MiB 7.8MiB 255.3K 6.5K
Daily .blocks.csv 7.3MiB 302.6KiB 61.4MiB 2.4MiB 255.3K 6.5K
Daily .contact.csv 3.1MiB 58.3KiB 19.3MiB 183.9KiB 165.3K 2.0K
Lite .jsonl 43.6MiB - 500.3MiB - 515.3K -
Lite .blocks.csv 19.5MiB - 119.8MiB - 515.3K -
Lite .contact.csv 7.9MiB - 34.3MiB - 315.2K -

3. Regulatory Compliance Data Feeds

Our country-specific IP feeds are designed to help meet regulatory compliance requirements defined by various government agencies and international organizations around the world. The service currently covers OFAC-listed countries, including Comprehensively Sanctioned Countries such as Cuba, Iran, North Korea, Russia, Syria, and several regions of Ukraine (i.e., Crimea, Donetsk, and Luhansk). Upcoming releases will cover location-based lists provided by the International Traffic in Arms Regulations (ITAR) and the Common Foreign and Security Policy (CFSP), among others.

Base path

Samples

Average file sizes

Here are presented approximate files sizes and records numbers.

gzip unpacked records
OFAC v4 OFAC v6 OFAC v4 OFAC v6 OFAC v4 OFAC v6
Full .jsonl 45.8MiB 2.8MiB 760.3MiB 47.6MiB 764.6K 38.6K
Full .blocks.csv 20.5MiB 1.6MiB 155.1MiB 10.2MiB 764.6K 38.6K
Full .contact.csv 5.4MiB 350.5KiB 19.1MiB 1.0MiB 279.1K 15.2K
Daily .jsonl 475.6KiB 6.1KiB 7.6MiB 43.9KiB 7.7K 35
Daily .blocks.csv 236.3KiB 2.9KiB 1.5MiB 11.1KiB 7.7K 35
Daily .contact.csv 53.6KiB 1.5KiB 153.2KiB 3.5KiB 2.3K 57
Lite .jsonl 38.9MiB - 423.2MiB - 454.4K -
Lite .blocks.csv 16.9MiB - 93.7MiB - 454.4K -
Lite .contact.csv 7.7MiB - 34.1MiB - 310.7K -

Downloading via HTTPS

Downloading via FTP

Downloading via FTPS

Read more about the FTPS connection: https://en.wikipedia.org/wiki/FTPS.

Our FTP server supports explicit FTP over TLS encryption. You may configure your FTP client to use explicit FTP over TLS encryption for secure communications.

Our FTPS server is accessed using the same paths and API keys as a regular FTP server, the instructions for which are described above. To connect via FTPS, select the "Require explicit FTP over TLS" encryption option in your FTP client, if it supports it. FileZilla configuration example:

explicit FTP over TLS encryption