Question 1

What is SpiralBig and what core products does it provide?

Accepted Answer

SpiralBig is a premier domain intelligence and cyber threat data platform. We provide comprehensive daily Newly Registered Domains (NRDs), over a decade of Historical WHOIS records, Expired and Dropped domain datasets, and high-performance REST APIs tailored for cybersecurity teams, brand protection firms, and domain investors.

Question 2

Who typically benefits from using SpiralBig datasets?

Accepted Answer

Our datasets empower cybersecurity researchers, Threat Intelligence / SOC teams, anti-phishing vendors, IP attorneys, trademark protection agencies, competitive intelligence analysts, and domain portfolio investors who require accurate, automated domain registration feeds.

Question 3

How does SpiralBig collect and verify its domain data?

Accepted Answer

We maintain high-throughput registrar zone file monitors, authoritative DNS scanners across root servers, RDAP endpoints, and global WHOIS port 43 servers. Our distributed ingestion pipelines validate DNS resolution, name server delegation, and record integrity in real time before releasing data drops.

Question 4

How do I access my domain data files after subscribing?

Accepted Answer

Once subscribed, you can instantly download your datasets from the user dashboard under "Downloads". You also gain access to our secure SFTP server and high-speed HTTPS direct download links with pre-signed tokens for automated workflow ingestion.

Question 5

Are historical and archive records accessible on the platform?

Accepted Answer

Yes. Depending on your subscription plan, SpiralBig grants access to comprehensive Historical WHOIS archives dating back over 10 years, allowing you to trace complete ownership genealogies and past infrastructure modifications.

Question 6

Can SpiralBig domain feeds be integrated into automated pipelines?

Accepted Answer

Absolutely. Every daily drop is available via REST API, automated SFTP drops, and direct HTTPS endpoints. You can ingest CSV or JSON feeds directly into data lakes, Elasticsearch, Splunk, Snowflake, or custom SIEM pipelines.

Question 7

What is the Newly Registered Domains (NRD) database?

Accepted Answer

The NRD database is a curated daily feed containing all newly discovered domain registrations worldwide across generic TLDs (gTLDs) and country-code TLDs (ccTLDs), complete with registration timestamps, registrar metadata, and DNS name servers.

Question 8

How many newly registered domains does SpiralBig process each day?

Accepted Answer

SpiralBig tracks and processes between 180,000 and 280,000+ newly registered domains every single day, varying according to global weekday registration surges and batch registrar creations.

Question 9

What time are daily Newly Registered Domain drops released?

Accepted Answer

Daily domain drops are compiled, validated, and published every day at 00:00 UTC. Subscribers can retrieve the latest drop within minutes via the dashboard or automated cron scripts.

Question 10

What fields are included in the Newly Registered Domains dataset?

Accepted Answer

Each record includes: Domain Name, TLD, Registrar Name, IANA ID, Creation Date, Expiration Date, Name Servers, MX Records, Domain Status Codes, Registrant Country/State, and WHOIS privacy flags.

Question 11

Do you provide country-code Top-Level Domains (ccTLDs) in NRD feeds?

Accepted Answer

Yes! We monitor over 1,500+ generic TLDs (like .com, .net, .org, .xyz, .online, .io) and hundreds of active ccTLDs (including .us, .uk, .de, .in, .ca, .eu, .fr, .co, .me) where authoritative zone data is accessible.

Question 12

Why are newly registered domains critical for cybersecurity?

Accepted Answer

Over 70% of newly registered domains involved in malicious activity (phishing campaigns, credential theft, ransomware C2 servers) are weaponized within the first 24 to 48 hours of creation. Ingesting daily NRD feeds allows SOC teams to enforce zero-day defensive blocking.

Question 13

Can I download historical NRD daily archives for previous months or years?

Accepted Answer

Yes, Pro and Enterprise subscribers have on-demand access to our comprehensive archive library of historical daily NRD drops, enabling retrospective forensic audits and trend modeling.

Question 14

What is the SpiralBig Historical WHOIS Database?

Accepted Answer

Our Historical WHOIS Database contains hundreds of millions of point-in-time domain ownership records spanning over a decade. It documents past registrants, historical contact emails, street addresses, phone records, and DNS configuration transitions.

Question 15

Can Historical WHOIS reveal registrant details hidden by modern privacy services?

Accepted Answer

Yes. Often, a cyber actor or company registered a domain with real public details before enabling WHOIS privacy guard or before GDPR redaction took effect. Historical WHOIS snapshots capture those earlier unmasked registrations for forensic investigators.

Question 16

How is Historical WHOIS data structured and queried?

Accepted Answer

Each historical event is stored as an immutable versioned snapshot with an effective timestamp. You can query domain history via our REST API or request full enterprise batch SQL/Parquet dumps for bulk offline analytics.

Question 17

How far back does SpiralBig historical WHOIS coverage reach?

Accepted Answer

Our archives reach back to 2012 for legacy gTLDs (.com, .net, .org, .info, .biz) and continuously expand across hundreds of new gTLDs and major ccTLDs.

Question 18

Can I search Historical WHOIS by registrant email or phone number (Reverse WHOIS)?

Accepted Answer

Yes, our Reverse WHOIS lookup feature allows enterprise users to search all past and present domains affiliated with a specific registrant email, company name, address, or administrative handle.

Question 19

What are the main use cases for Historical WHOIS data?

Accepted Answer

Common applications include cyber threat hunting, attribution of threat actors, intellectual property litigation, trademark disputes (UDRP filings), merger & acquisition technical due diligence, and tax fraud investigations.

Question 20

What are Expired and Dropped Domains datasets?

Accepted Answer

Expired and dropped datasets record domains that have completed their redemption grace periods and have been released back into the public pool for re-registration or drop-catching.

Question 21

How often is the Expired Domains feed updated?

Accepted Answer

We update our dropped and expired domain feeds on a daily cycle corresponding to registry drop windows (such as the Verisign daily drop window for .com and .net).

Question 22

Does SpiralBig provide SEO and domain authority metrics for dropped domains?

Accepted Answer

Yes, our enriched expired domains datasets include backlink indicators, age metrics, archive.org presence flags, and domain authority indicators to assist domain investors and SEO professionals in finding valuable domains.

Question 23

Can Expired Domain monitoring prevent subdomain takeover vulnerabilities?

Accepted Answer

Yes. Organizations use our expired domain feeds to detect when decommissioned corporate domains or third-party SaaS CNAME aliases are abandoned, preventing malicious actors from hijacking orphaned assets.

Question 24

What file formats are provided for the Expired Domains feeds?

Accepted Answer

Expired feeds are delivered in standardized CSV and JSON formats, packaged inside gzip archives for rapid decompression and database ingestion.

Question 25

Can I filter dropped domains by keyword, TLD, or character length?

Accepted Answer

Yes, our dashboard tools and developer API allow you to filter drops by keyword patterns, character length, hyphen presence, numbers, and specific TLD lists.

Question 26

Does SpiralBig offer a real-time developer REST API?

Accepted Answer

Yes. SpiralBig provides high-speed RESTful JSON endpoints for Live WHOIS Lookups, Historical WHOIS, Reverse WHOIS, Newly Registered Domain stream queries, and Account Usage stats.

Question 27

How do I authenticate API requests to SpiralBig?

Accepted Answer

All API requests are authenticated via an API Key passed either in the HTTP header as `Authorization: Bearer YOUR_API_KEY` or as a query parameter `?api_key=YOUR_API_KEY`.

Question 28

What are the rate limits and SLA for the SpiralBig API?

Accepted Answer

Default plans include rate limits of 60 to 300 requests per minute depending on tier. Enterprise custom plans offer dedicated endpoints with throughput up to 2,000+ RPS and a 99.99% uptime SLA.

Question 29

Are official SDKs or code samples provided for the API?

Accepted Answer

Yes, we provide ready-to-use code samples and libraries for Python, Node.js / TypeScript, PHP, Go, and cURL in our Developer Documentation page.

Question 30

Does the API return standardized, normalized JSON data?

Accepted Answer

Yes. Unlike raw WHOIS port 43 text, our API parses and normalizes over 200 different registrar WHOIS schemas into a clean, consistent JSON schema with strict types.