Connect Your AI Agent with WhoisFreaks for Slack

Discover subdomains for a given domain using passive DNS data from 6.3B+ indexed hostnames. Returns active, inactive, and historical subdomain records. Use this action for attack surface mapping, security audits, or competitor research. Returns JSON or XML output. See the documentation

Retrieve details about a domain's SSL certificate (e.g. google.com). Note that this action accepts JSON or XML format values, always requests the full certificate chain (chain=true), and suppresses the raw OpenSSL response (sslRaw=false) for cleaner outputs. See the documentation

Retrieve details about a domain by keyword, email, registrant name or company. Must enter one and only one of keyword, email, owner, or company. See the documentation

Score a single IPv4 or IPv6 address against real-time threat data. Returns a composite threat score (0-100), VPN/proxy/Tor/bot classification, provider names with confidence scores, district-level geolocation, and ASN/ISP details. Use this action for threat intelligence, access control, or fraud prevention workflows. Accepts JSON or XML output. See the documentation

Retrieve information about an IP address. See the documentation

Retrieve geolocation details (country, city, region, ASN, ISP, coordinates) for a single IP address. Supports both IPv4 and IPv6 addresses. Use this action to enrich events with location data, perform fraud detection, or geo-target users. See the documentation

Check the reputation and security status of a domain — including whether it is associated with malware, phishing campaigns, or other malicious activity. Use this action for threat intelligence workflows, email security checks, or domain risk scoring. Returns JSON output. See the documentation

Retrieve details about a domain name. See the documentation

Check if a domain name is available for registration. For example you can check whoisfreaks.com. This action supports responses in both JSON and XML format. Always use sug=false to get the response. See the documentation

Retrieve WHOIS registration data (registrant, registrar, name servers, email, phone, address, ASN, history) for up to 100 domains in a single request. Accepts comma-separated domain names across 1000+ TLDs; returns JSON or XML output. Use this action for bulk domain research, lead enrichment, or portfolio audits. See the documentation

Score up to 100 IPv4 or IPv6 addresses against real-time threat data in a single request. Returns composite threat score, VPN/proxy/Tor/bot classification, blacklist status, and ASN/ISP details for each IP. Accepts comma-separated IP addresses; returns JSON or XML output. See the documentation

Retrieve geolocation details (country, city, ASN, ISP, coordinates) for up to 100 IP addresses in a single request. Accepts comma-separated IPv4 or IPv6 addresses and returns JSON or XML output. Use this action for bulk network analysis, fraud detection, or audience geo-enrichment. See the documentation

Retrieve DNS records (A, AAAA, MX, NS, CNAME, TXT, PTR, SPF, DKIM, DMARC, SRV, SOA) for up to 100 domains or IP addresses in a single request. Use this action for bulk DNS auditing, infrastructure mapping, or automated monitoring. Accepts domain names and/or IP addresses; returns JSON or XML output. See the documentation