Access to database files

This data feed subscription is licensed to you or your organization only, you may not resell or relicense the data without explicit written permission from Whois API, Inc. Any violation will be prosecuted to the fullest extent of the law.

Update time

The daily update is ready for download at 12:00 UTC.

The datasets come in the following forms

Depending on the subscription plan, you receive different datasets. They contain different data and have different formats. You can find a detailed description of the differences between datasets on the pricing page.

Here are the key details for the different subscription plans:

Starter

• Data included: newly registered domains without WHOIS records. No historical data.
• Filename format: fwmd.%DATE%.starter.[daily].data.csv.gz
• Filename example: fwmd.2026-07-08.starter.daily.data.csv

Pro

• Data included: newly registered domains with WHOIS records and with 365 days of historical data.
• Filename format: fwmd.%DATE%.pro.[daily].data.csv.gz
• Filename example: fwmd.2026-07-08.pro.daily.data.csv

Enterprise

• Data included: newly registered domains with WHOIS records and with all available historical data.
• Filename format: fwmd.%DATE%.enterprise.[daily].data.csv.gz
• Filename example: fwmd.2026-07-08.enterprise.daily.data.csv

Enterprise plan customers also have access to the First Watch Least Reputable Domains files:

• Data included: a narrower subset of the domains included in the regular First Watch files, intended for use cases with an even stricter false-positive tolerance.
• Filename format: fwlrd.%DATE%.enterprise.[daily].data.csv.gz
• Filename example: fwlrd.2026-07-08.enterprise.daily.data.csv

How to download the datafeed files

Recommended decompression tool

When working with large compressed files, we recommend using unpigz rather than gunzip. Based on our performance tests, gunzip can be almost 2x slower than unpigz for large files. For this reason, unpigz is the preferred decompression tool.

Downloading via HTTPS

• Base path: https://download.whoisxmlapi.com/datafeeds/
• Username and password: equal to your personal API Key which you can obtain from the My Products page.
• Folder: First_Watch_Malicious_Domains_Data_Feed

Downloading via FTP

• Host: datafeeds.whoisxmlapi.com
• Port: 21210
• Username: 'user'
• Password: equal to your personal API Key which you can obtain from the My Products page.
• Base path: ftp://datafeeds.whoisxmlapi.com:21210
• Folder: First_Watch_Malicious_Domains_Data_Feed

Downloading via FTPS

Read more about the FTPS connection: https://en.wikipedia.org/wiki/FTPS.

Our FTP server supports explicit FTP over TLS encryption. You may configure your FTP client to use explicit FTP over TLS encryption for secure communications.

Our FTPS server is accessed using the same paths and API keys as a regular FTP server, the instructions for which are described above. To connect via FTPS, select the "Require explicit FTP over TLS" encryption option in your FTP client, if it supports it. FileZilla configuration example:

Developer resources

• Importing and Indexing First Watch Malicious Domains Data Feed into MySQL