Datafeed files | Specifications | IP Netblocks WHOIS Database | WhoisXML API
Products APIs Data Feeds Web Tools Domain Research & Monitoring Enterprise Packages
WHOIS / WHOIS History
WHOIS / WHOIS History

Provide current and historical ownership information on domains / IPs. Identify all connections between domains, registrants, registrars, and DNS servers.

DNS / DNS History
DNS / DNS History

Look into all current and historical DNS / IP connections between domains and A, MX, NS, and other records. Monitor suspicious changes to DNS records.

IP Geolocation / IP Netblocks
IP Geolocation / IP Netblocks

Get detailed context on an IP address, including its user’s geolocation, time zone, connected domains, connection type, IP range, ASN, and other network ownership details.

Domain Research Suite (DRS)
Domain Research Suite (DRS)

Access our web-based solution to dig into and monitor all domain events of interest.

Domain Research Suite (DRS)
Domain Research Suite (DRS)

Get access to a web-based enterprise-grade solution to search and monitor domain registrations and ownership details for branded terms, fuzzy matches, registrants of interest, and more.

Research
Monitoring
White-Label
Enterprise API Packages
Enterprise API Packages

Our complete set of domain, IP, and DNS intelligence available via API calls as an annual subscription with predictable pricing.

Security Intelligence (SI) Suite
Security Intelligence (SI) Suite

Offers complete access to WHOIS, IP, DNS, and subdomain data for product enrichment, threat hunting and more.

Premium API Services
Premium API Services

Enjoy priority data access with our premium API services topped with extra perks including dedicated team support, enterprise-grade infrastructure, and SLAs for full scalability and high performance.

Multi-Level API User Administration Now Available - Manage individual API keys for team members in your organization.

Learn More
×
Contact Us
Specifications Pricing Blog
FAQ Datafeed files Output format CSV structure

Datafeed files

The data feed provides a downloadable database of the registered IP Netblocks (IP ranges) with detailed information regarding each range. Some network blocks provided by the API may be missing in the data feed. That happens when a block equals an Autonomous System's route but doesn't have a corresponding WHOIS. Those records have the "parent" field set in the API response.

The database contains IP whois data from major Internet Addresses Registries on a daily basis

The resulting database is a joint dataset, post-processed to get unified and consistent format and data. The output format is JSON or CSV where every row is a separate JSON object or CSV row. It allows parallel processing in your systems.

About 20% of records have partly redacted contact information, due to GDPR.

The datafeeds described below are presented in the following three forms:

  • Full databases — a full database of all the IP Netblocks for a given date in unified and consistent JSON or CSV format. These files are named in format:
    "ip_netblocks.%DATE%.full[.v6].jsonl.gz"
    "ip_netblocks.%DATE%.full.blocks[.v6].csv.gz"
    "ip_netblocks.%DATE%.full.contacts[.v6].csv.gz", e.g. "ip_netblocks.2018-12-19.full.contacts.csv.gz" and "ip_netblocks.2018-12-19.full.contacts.v6.csv.gz"
  • Daily incremental databases — changes in full IP Netblocks database compared to the previous date. Includes added, dropped and modified IP ranges since yesterday. These files are named in format:
    "ip_netblocks.%DATE%.daily.jsonl[.v6].gz"
    "ip_netblocks.%DATE%.daily.blocks[.v6].csv.gz"
    "ip_netblocks.%DATE%.daily.contacts[.v6].csv.gz", e.g. "ip_netblocks.2018-12-19.daily.contacts.csv.gz" and "ip_netblocks.2018-12-19.daily.contacts.v6.csv.gz"
  • Lite databases — a partial database of the IP Netblocks for a given date made for academic purposes. It includes about 5% of a full IPv4 database. It doesn't provide IPv6 records. These files are named in format:
    "ip_netblocks.%DATE%.lite.jsonl.gz"
    "ip_netblocks.%DATE%.lite.blocks.csv.gz"
    "ip_netblocks.%DATE%.lite.contacts.csv.gz", e.g. "ip_netblocks.2018-12-19.lite.contacts.csv.gz"

File storage time: full and daily files are available for 3 months since their creation date. Lite files are available for a week.

A fresh daily incremental database is delivered every day at 02.00 PST.

1. All datafeed files

Base path

Samples

Average file sizes

Here are presented approximate files sizes and records numbers.

gzip unpacked records
v4 v6 v4 v6 v4 v6
Full .jsonl 610.0MiB 111.5MiB 8.3GiB 1.4GiB 9.1M 1.3M
Full .blocks.csv 263.3MiB 58.5MiB 1.8GiB 394.3MiB 9.1M 1.3M
Full .contact.csv 102.8MiB 13.7MiB 619.3MiB 73.1MiB 5.2M 568.3K
Daily .jsonl 1.4MiB 339.3KiB 18.7MiB 3.7MiB 18.2K 3.6K
Daily .blocks.csv 676.4KiB 202.3KiB 4.9MiB 1.2MiB 18.2K 3.6K
Daily .contact.csv 186.4KiB 43.2KiB 761.8KiB 176.0KiB 7.7K 1.6K
Lite .jsonl 39.1MiB - 425.9MiB - 455.8K -
Lite .blocks.csv 17.0MiB - 94.4MiB - 455.8K -
Lite .contact.csv 7.5MiB - 34.5MiB - 308.2K -

2. BGP enriched datafeed files

The BGP enriched files include a parent field that is the reference to the block from which the information was borrowed. Its presence indicates that the block was obtained from BGP routing tables.

Base path

Samples

Average file sizes

Here are presented approximate files sizes and records numbers.

gzip unpacked records
BGP v4 BGP v6 BGP v4 BGP v6 BGP v4 BGP v6
Full .jsonl 650.6MiB 137.3MiB 9.9GiB 2.5GiB 10.4M 2.1M
Full .blocks.csv 286.3MiB 77.5MiB 2.2GiB 715.7MiB 10.4M 2.1M
Full .contact.csv 102.8MiB 13.7MiB 619.3MiB 73.1MiB 5.2M 568.3K
Daily .jsonl 1.5MiB 378.9KiB 21.9MiB 4.9MiB 20.7K 4.4K
Daily .blocks.csv 741.2KiB 232.4KiB 6.2MiB 1.7MiB 20.7K 4.4K
Daily .contact.csv 189.8KiB 44.1KiB 770.4KiB 178.9KiB 7.8K 1.6K
Lite .jsonl 44.8MiB - 508.4MiB - 520.1K -
Lite .blocks.csv 19.8MiB - 114.5MiB - 520.1K -
Lite .contact.csv 8.1MiB - 36.0MiB - 326.7K -

3. Regulatory Compliance Data Feeds

Our country-specific IP feeds are designed to help meet regulatory compliance requirements defined by various government agencies and international organizations around the world. The service currently covers OFAC-listed countries, including Comprehensively Sanctioned Countries such as Cuba, Iran, North Korea, Russia, Syria, and several regions of Ukraine (i.e., Crimea, Donetsk, and Luhansk). Upcoming releases will cover location-based lists provided by the International Traffic in Arms Regulations (ITAR) and the Common Foreign and Security Policy (CFSP), among others.

Base path

Samples

Average file sizes

Here are presented approximate files sizes and records numbers.

gzip unpacked records
OFAC v4 OFAC v6 OFAC v4 OFAC v6 OFAC v4 OFAC v6
Full .jsonl 46.1MiB 3.3MiB 762.5MiB 55.9MiB 763.7K 46.0K
Full .blocks.csv 20.5MiB 1.9MiB 156.8MiB 12.5MiB 763.7K 46.0K
Full .contact.csv 5.3MiB 369.4KiB 18.7MiB 1.0MiB 273.5K 15.6K
Daily .jsonl 97.8KiB 9.3KiB 1.4MiB 68.0KiB 1.3K 60
Daily .blocks.csv 48.4KiB 5.1KiB 342.6KiB 22.5KiB 1.3K 60
Daily .contact.csv 10.2KiB 2.0KiB 27.6KiB 4.7KiB 459 80
Lite .jsonl 3.2MiB - 37.9MiB - 37.9K -
Lite .blocks.csv 1.4MiB - 7.8MiB - 37.9K -
Lite .contact.csv 450.9KiB - 1.3MiB - 19.3K -

Downloading via HTTPS

Downloading via FTP

Downloading via FTPS

Read more about the FTPS connection: https://en.wikipedia.org/wiki/FTPS.

Our FTP server supports explicit FTP over TLS encryption. You may configure your FTP client to use explicit FTP over TLS encryption for secure communications.

Our FTPS server is accessed using the same paths and API keys as a regular FTP server, the instructions for which are described above. To connect via FTPS, select the "Require explicit FTP over TLS" encryption option in your FTP client, if it supports it. FileZilla configuration example:

explicit FTP over TLS encryption