OrionCMD Checks

Check a domain's SSL/TLS certificate expiry and renewal from CT logs. $0.01 USDC on Base per call. Returns issuer, validity, days left, % of lifetime used, renewal cadence and a renewal-stall heuristic from Certificate Transparency logs, plus a live HTTPS pass/fail probe. Don't use this for inspecting the exact certificate served live; details come from CT logs.

Is this domain malicious or named by ransomware? Domain threat check. $0.02 USDC on Base per call. Matches the hostname, parent domains and resolved IPv4 against ThreatCluster's high-confidence 30-day IOC feed and looks up ransomware leak-site claims. Returns one verdict: listed, claimed, listed_and_claimed or no_known_threat. Don't use this for many domains; use /v1/bulk-threat-check.

OrionCMD Checks: Live DNS / email-auth / CAA / DNSSEC check. NS, A/AAAA/CNAME, MX, SPF, DMARC, CAA (tree-climbing) and DNSSEC via Cloudflare DoH, with plain-English findings and fixes[] (paste-ready SPF merge, DMARC and CAA records with dig verify commands).

Get a domain security grade A-F with a per-category breakdown. $0.03 USDC on Base per call. Returns one A-F grade, a 0-100 score, points per category (TLS 25, email auth 25, headers 20, DNS 15, expiry 15) and the top fixes. Don't use this for raw cert, DNS and expiry data without a grade; use /v1/site-health.

OrionCMD Checks: Email authentication posture: SPF, DMARC, DKIM, MTA-STS, TLS-RPT, BIMI. SPF validity and DNS-lookup count (limit 10), DMARC policy/pct/rua, DKIM on common selectors, MTA-STS mode, TLS-RPT and BIMI, with a rough 0-100 score and plain-English findings. Live DNS via Cloudflare DoH.

When does a domain expire? Registration expiry and registrar via RDAP. $0.01 USDC on Base per call. Returns registrar, registration and expiry dates, days left, EPP status and nameservers. Within 60 days of expiry, fixes[] gives auto-renew steps for the registrar. Don't use this for SSL certificate expiry; use /v1/cert.

OrionCMD Checks: HTTP security headers + redirect chain for a site. One HTTPS GET from Cloudflare's edge: redirect chain, final status, HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, a simple A-F grade and plain-English findings.

Check a domain's certificate, DNS and expiry together in one call. $0.03 USDC on Base per call. Returns a summary, the renewal-stall heuristic, the Let's Encrypt 64-day (2027-02-10) note and fixes[] with paste-ready DNS records and auto-renew steps, each with a verify command. Partial results if one source fails. Don't use this for an A-F grade; use /v1/domain-grade.

Run a full website security audit with a prioritized fix list for a client or vendor review. $2 USDC on Base per call. Runs every OrionCMD check plus HTTPS redirect, www/apex, security.txt, robots.txt and sitemap. Returns the A-F grade, score and an action plan sorted critical to low. Don't use this for one quick check; single checks start at $0.01.

OrionCMD Checks: Bulk IOC check: up to 100 domains or IPv4 (domains resolved, IPs matched too). Up to 100 comma- or newline-separated domains, URLs or IPv4 addresses in ?q=. Each domain is resolved (A) and the name, parent domains and resolved IPv4 are matched against ThreatCluster's high-confidence 30-day IOC feed (cached, refreshed hourly). No ransomware-claim lookups (use /v1/threat-check). Stale feed answers 503 before payment.

OrionCMD Checks: Prepaid domain threat watch: up to 25 domains for 30 days, webhook alerts. Pay once; each domain is re-checked about once a day for 30 days. You get an HMAC-signed JSON POST at your https webhook_url (event watch.changed) when a domain or its IPv4 appears in (or leaves) ThreatCluster's high-confidence IOC feed, when a new ransomware leak-site claim names it, when its A/NS/MX records change, or when registration expiry changes or falls within 30 days. A watch.created POST is sent