All projects matching “domains”

Lookalike / homograph domain check (punycode, mixed scripts, brand typos): Instant offline check of a host name for phishing patterns: Unicode / punycode form, scripts per label and mixed-alphabet homographs, typo or confusable lookalikes of commonly phished brands, brand outside its official domain

Use it before you send to an address, or to screen sign-ups and leads for typos, disposable domains and role addresses. Checks syntax, MX records (with the A-record fallback), null MX, a list of about 120,000 disposable domains, role addresses (info@, support@…) and free providers, without sending anything. No SMTP probing, so it can't confirm the mailbox exists. Never charged for errors: we settl

Domain intelligence in one call: RDAP registration (registrar, age, expiry, status), live DNS (A/AAAA/MX/NS/TXT), the mail and DNS providers behind them, the SaaS vendors the domain's TXT verification tokens reveal, SPF/DMARC posture, and risk signals like newly-registered or no-registrar-lock.

Returns the stored company record by domain, LinkedIn URL or Pubrio id: firmographics, locations, industry, technologies, social profiles and identifiers, including the domain_search_id other endpoints take. Each call is 1 credit.

Unfold a domain's SPF policy (RFC 7208) into merged IPv4 and IPv6 blocks: include and redirect followed as a receiver counts them (10 lookups, 2 void lookups, PermError stops), a and mx resolved with /cidr, sources per block, exists, ptr and macros listed apart, and very broad blocks flagged. Use when an agent must know which servers may send. Input: ?domain=example.com.

Use when an agent is about to pay an x402 endpoint, seller domain or wallet it has not used before. Returns ok_to_pay, caution, dont_pay or no_payment_needed with reasons: live payment terms, its Coinbase Bazaar listing and paying wallets in 30 days, whether the live pay-to address matches the listing, real-USDC check, price vs. similar tools, and seller domain age. Read-only: never pays or signs.

Score a URL for phishing risk before an agent opens or trusts it. Keyless, deterministic heuristics - typosquat / homoglyph of a known brand, punycode / mixed-script hosts, credentials-in-URL, raw-IP hosts, suspicious TLDs, over-deep subdomains - plus a best-effort domain-age check (young domains are a top phishing signal). Returns a 0-100 risk score, a SAFE / SUSPICIOUS / DANGEROUS verdict, and l

Company due diligence in one call (KYB, vendor and supplier checks). Give a company name and country, a registry number, an EU VAT number, an LEI or a website domain. Returns the legal entity from the official register, LEI and parents, VAT validity, a sanctions screen (OFAC, EU, UK) of the company and officers, and the domain's age, mail and TLS, as signed pass/warn/fail checks with sources. Use

BitBooth Whois: pay 0.01 USDC, get the parsed whois record for any domain — registrar, creation/updated/expiry dates, name servers, status flags, plus the raw whois text. Two-hop resolution via whois.iana.org then the authoritative registry over TCP port 43. 5s per-connection timeout cap. Rejects IPv4/IPv6 inputs and blocks SSRF at the DNS layer. Built for agents auditing domain ownership, monitor

AgentCheck: independent report on an x402 seller before you pay it. Are its buyers real (repeat wallets on their own money) or funded by the seller itself, measured from 30 days of on-chain payments, plus results of our own paid test purchases where we have them. Query: ?domain=<seller-domain>. GET /sellers (free) lists covered domains.

Validate email syntax, domain, and MX records for basic automated checks without SMTP mailbox verification; cannot prove a mailbox exists or can receive mail. USE WHEN: agent needs inexpensive structural and mail-domain validation before using an email address. DO NOT USE WHEN: agent requires proof that a mailbox exists or can receive mail.

Mail Security Tools API: Prepaid email setup watch: up to 25 domains for 30 days, webhook on change. Pay once, then each domain's SPF, DMARC, DKIM (common selectors), MX and score are re-checked about once a day for 30 days. When something changes or breaks you get an HMAC-signed JSON POST at your https webhook_url (event watch.changed, kind changed|broke, before/after). A watch.created POST is se

Domain Drop Radar full dataset: every expiring, pending-delete and just-dropped domain matching your filters (up to 1000 per call) with quality score, archive history, backlink and parking/spam signals. Registrable with USDC/USDT at stabledomains.net.

Domain and email security check: SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT, DNSSEC (validated by Cloudflare and Google), CAA, BIMI with its mark certificate, mail IPs on the UCEPROTECT Level 1 blocklist, TLS certificate, registrar and domain age, and Microsoft 365 tenant, each graded with the exact record to fix it, plus a 0-100 score

Pay Guard: pre-payment allow/warn/block check for x402. Send your planned purchase (domain, max_price_usd, asset/network) plus the 402 challenge (payTo, amount, asset, network, resource). Returns verdict with wallet↔domain verification, price/asset/network checks, lookalike/URL safety, wash flags from Agentropolis, and a free OFAC SDN sanctions screen of payTo (a screen, not a certificate). Determ

Look up passive DNS resolution history and reputation for a domain or IP address. For a domain: which IPs it has resolved to over time. For an IP: which hostnames have resolved to it, plus malicious/suspicious vendor detection counts. Call to pivot from an indicator to its infrastructure history during an investigation.

Checks whether a URL/domain is safe to fetch, cite, or follow: flags phantom-squatted or typosquatted brand domains, unregistered or brand-new domains, and known malicious infrastructure (URLhaus). Returns an ALLOW/WARN/BLOCK verdict before your agent trusts the link.

Know Your Merchant (KYM) trust score: pass a merchant domain and get a deterministic 0-100 trust score with a band (high/medium/low/very_low/avoid) and human-readable reasons. Live signals: domain age from the RDAP registry of record, malware/phishing blocklist verdict via Cloudflare Security DNS, TLS certificate health, mail capability, and refund/privacy/contact page presence. The merchant-side

Resolve ONE DNS record type for a domain -- the cheapest, narrowest domain-check endpoint. For all record types at once, use /domain/intelligence. For a bundled DNS+TLS+headers audit, use /web/audit (raw) or /security/posture (scored). For mail-security plus a scored verdict, use /domain/due-diligence.

Dragons Eye Lookup: Ransomware leak-site claim lookup by company name or domain. Returns ransomware-group claims (group, dates, country, sector, sources) matching the company or domain. Unverified claims from criminal leak sites; commercially reusable sources only.

Return the full detected technology stack for a domain. Every technology is mapped to a category with a confidence score. Includes stack_sophistication, stack_gaps, and competing_vendors derived intelligence. Billed per domain profiled.

Assess how trustworthy a domain is using authoritative live signals, not just its spelling. Fuses RDAP registration data (domain age — the single strongest phishing signal — plus registrar, expiry and registry status flags), DNS resolvability (A/AAAA), MX presence and DNSSEC into a 0-100 risk score with a verdict (low/medium/high) and the exact reasons. Pairs with `urltrust` (lexical) for a comple

Domain intelligence in one call: RDAP registration (registrar, created, expires, age, status, nameservers), DNS records (A, AAAA, MX, NS, TXT, CNAME, SPF, DMARC), a live HTTPS probe (reachable, status, server, redirect target, HSTS), plus risk flags and a 0-100 risk score for new, parked, unreachable or badly configured domains.

XR-Trust XRPL Permissioned Domain (XLS-80) directory: active domains, accepted credentials, credential issuers

Pre-payment counterparty risk check for AI agents: OFAC sanctions (names, aliases, wallets), domain age and email authentication, vendor and executive impersonation domains, routing/IBAN/SWIFT/wallet validation, and invoice-fraud signals. Returns proceed/review/block, explained findings and a signed receipt.

RDAP domain registration/nameserver/status lookup (keyless). POST {domain} required. Empty -> 400 not charged. New RDAP/DNS vertical (low adjacency vs DoH trivia).

Crawl pre-flight for a domain: will you be blocked, is content behind a paywall, and how much is actually there. Returns per-bot robots.txt verdicts for 16 AI crawlers, crawlable page count from sitemaps, detected CDN and paid-access signals (x402, TollBit), plus a fetch/skip recommendation. Call before spending requests on an unknown domain.

Watch up to 25 domains for 30 days for new ransomware leak-site claims. $2.00 USDC on Base, paid once. Checked every 15 minutes; on a domain or exact-name match you get a signed webhook. Validate entries free first at POST /v1/watchlists/validate. Alerts are unverified claims from criminal leak sites, commercially reusable sources only.

Domain trust report for AI agents: is this domain real, how old is it, who registered it, and is its email locked down? DNS (A/AAAA/NS/MX/CAA), DNSSEC, SPF, DMARC, DKIM (common selectors), MTA-STS, TLS-RPT, BIMI, RDAP registration date + registrar + status, parking and disposable detection, risk flags, 0-100 score and verdict. Public DNS + RDAP, no data stored.

Use before an AI agent pays a vendor or counterparty. Returns an action-oriented allow/review/block evidence preflight: legal-entity resolution, potential sanctions signals, RDAP domain evidence and company-domain consistency. x402 payment safety decision support only; not legal or transaction approval.