MonSPHERE

Monitoring

WHOIS Monitoring

Track a domain's own registration expiry and catch an unexpected ownership transfer — with a real WHOIS lookup, not a certificate check.

A WHOIS monitor watches two completely different things about a domain, both invisible to an SSL check: when its registration expires, and who actually owns it right now.

Availability

Available on every plan — a WHOIS lookup is a single cheap network call, nothing like Synthetic Monitoring's per-check browser cost.

How it works

curl -X POST https://api.monsphere.com/api/v1/organizations/{orgId}/monitors \
  -H "X-Api-Key: msk_live_..." -H "Content-Type: application/json" \
  -d '{
    "name": "Domain Registration",
    "type": "whois",
    "target": "example.com",
    "intervalSeconds": 21600,
    "timeoutSeconds": 30,
    "config": { "domainExpiryThresholdDays": 30 }
  }'

The check fails once the domain is within domainExpiryThresholdDays of its registration expiry (30 by default) — same "alert before it becomes an outage" shape as SSL expiry monitoring.

Registrant change detection

Every check also fingerprints the domain's registrant name, organization, and email from the WHOIS record, and compares it against what the last check saw. A domain can keep resolving and passing every other check while its registration has quietly been transferred to someone else — a classic hijack pattern that expiry checking alone never catches, and the exact reason this exists as its own signal rather than folding into the up/down result.

This ships with a zero-config default alert — "WHOIS Registrant Changed" — the moment a change is detected, no rule setup required, the same convention the built-in "Monitor Down" alert already uses. Because privacy-proxy registrars redact some or all of these fields anyway, a monitor's very first check only ever establishes its baseline; nothing is flagged as "changed" until there's a previous value to differ from.

Check frequency

WHOIS monitors run at most a few times a day (a 6-hour minimum interval is enforced) — many registrars rate-limit or temporarily block an IP that queries the same domain too often, and neither registration expiry nor ownership changes fast enough to need checking more frequently than that anyway.

How it runs

Like Synthetic Monitoring, a WHOIS monitor doesn't go through Blackbox Exporter or Prometheus — there's no WHOIS prober in that pipeline. It runs on MonSPHERE's own internal scheduler, the same one Heartbeat and Synthetic monitors use, so there's no region to pick.