Whoxy

Whoxy is a WHOIS data aggregation and reverse lookup platform that provides current and historical domain registration records, reverse WHOIS search by registrant email or name, bulk WHOIS lookups via API, and domain monitoring capabilities. Its database covers hundreds of millions of domain records across all major TLDs.

For OSINT investigators, Whoxy's reverse WHOIS capability is its most powerful investigative feature. By searching for a registrant email address, name, or phone number, investigators can retrieve all domains ever registered using that identifying information. This pivot transforms a single data point — often discovered through a breach database, forum post, or document — into a complete domain portfolio for an individual or organization.

Email-based reverse WHOIS is particularly effective because people frequently use personal email addresses to register domains before considering operational security. A single exposed registrant email can map dozens of domains, revealing the full scope of an actor's online presence including business operations, side projects, and infrastructure that would not otherwise be connected.

Whoxy's historical WHOIS records are archived before GDPR and ICANN privacy changes made current WHOIS data widely opaque. Historical records from before privacy protection was applied often contain unredacted registrant names, email addresses, physical addresses, and phone numbers — data that is now systematically hidden in current WHOIS records.

Bulk WHOIS lookup via API enables programmatic processing of large domain lists — useful when an investigation has produced hundreds of domains that need systematic registration data enrichment. API rate limits vary by subscription tier.

Domain monitoring allows investigators to set alerts for WHOIS data changes on specific domains — registration, transfer, expiration, and registrant information changes — supporting proactive tracking of suspect domains.

For corporate investigation, Whoxy can establish the full domain portfolio of a target organization, revealing all domains registered under the corporate name or with corporate email addresses.

Document all reverse WHOIS search parameters, returned domain lists, and query dates. Historical WHOIS data accessed should be preserved as screenshots or exports, as this data may be further restricted by future policy changes.