Domain Intelligence

Authentication

All requests require an API key passed via the X-API-Key header:

X-API-Key: your-api-key-here

Plans

Feature access and limits are determined by your API key's plan.

Pricing

Get started with a free plan or upgrade for higher limits and premium features.

Already a subscriber? Manage your subscription

Rate Limiting

Requests are rate-limited per API key using a sliding window. Every response includes rate limit headers:

When the limit is exceeded, the API returns 429 Too Many Requests. Wait until the Retry-After period expires before retrying.

Domain Intelligence

Look up one or more domains concurrently. Returns WHOIS, DNS, SSL, and HTTP header data by default for each domain. Optional flags enable additional lookups. All lookups run concurrently with a 30-second timeout.

Request Body

Domain Normalization

Domain names are normalized automatically. You can pass bare domains or full URLs with any scheme — the API extracts the hostname by stripping scheme prefixes, userinfo, ports, paths, query strings, and fragments. The result is lowercased. The domain field in the response shows exactly what was looked up. Raw IP addresses are rejected — use the IP Intelligence endpoint instead.

Example

curl -X POST https://api.securityaccelerated.com/v1/domain/lookup \
  -H 'Content-Type: application/json' \
  -H 'X-API-Key: your-api-key' \
  -H 'X-Client-Request-ID: req-001' \
  -d '{
    "domains": ["example.com"],
    "email_security": true,
    "subdomains": true
  }'

import requests

resp = requests.post(
    "https://api.securityaccelerated.com/v1/domain/lookup",
    headers={
        "X-API-Key": "your-api-key",
        "X-Client-Request-ID": "req-001",
    },
    json={
        "domains": ["example.com"],
        "email_security": True,
        "subdomains": True,
    },
)

if resp.status_code != 200:
    print("Error:", resp.json()["error"])
else:
    results = resp.json()
    for result in results:
        print(result["domain"], result["dns"]["a"])

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "net/http"
)

func main() {
    body, _ := json.Marshal(map[string]any{
        "domains":        []string{"example.com"},
        "email_security": true,
        "subdomains":     true,
    })

    req, _ := http.NewRequest("POST",
        "https://api.securityaccelerated.com/v1/domain/lookup",
        bytes.NewReader(body))
    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("X-API-Key", "your-api-key")
    req.Header.Set("X-Client-Request-ID", "req-001")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    if resp.StatusCode != http.StatusOK {
        var apiErr map[string]string
        json.NewDecoder(resp.Body).Decode(&apiErr)
        fmt.Println("Error:", apiErr["error"])
        return
    }

    var results []map[string]any
    json.NewDecoder(resp.Body).Decode(&results)
    fmt.Println(results[0]["domain"])
}

Response Structure

The response is always a JSON array, even for single-domain requests. Each element contains the core lookup results plus any optional fields that were requested.

[
  {
    "domain": "example.com",
    "cache_hit": false,
    "whois": { ... },
    "dns": { ... },
    "ssl": { ... },
    "headers": { ... },
    "email_security": { ... },
    "subdomains": { ... },
    "threat_intel": { ... },
    "errors": []
  }
]

Optional fields (screenshot, reputation, email_security, subdomains, ct_logs, bgp, fingerprint, threat_intel) are only present in the response when requested.

Invalid Domains

Invalid domains in a multi-domain request do not fail the entire request. They are included in the response with a validation error while valid domains return normally:

[
  {
    "domain": "example.com",
    "cache_hit": false,
    "whois": { "domain_name": "example.com", ... },
    "dns": { ... },
    "ssl": { ... },
    "headers": { ... }
  },
  {
    "domain": "notadomain",
    "errors": [{ "lookup": "validation", "message": "invalid domain name" }]
  }
]

Response Fields

whois -- Domain Registration

{
  "domain_name": "example.com",
  "registrar": "RESERVED-Internet Assigned Numbers Authority",
  "created_date": "1995-08-14T04:00:00Z",
  "updated_date": "2024-08-14T07:01:38Z",
  "expiry_date": "2025-08-13T04:00:00Z",
  "status": ["clientDeleteProhibited", "clientTransferProhibited"],
  "name_servers": ["a.iana-servers.net", "b.iana-servers.net"],
  "registrant": { "organization": "REDACTED FOR PRIVACY", "country": "US" }
}

dns -- DNS Records

{
  "a": ["93.184.216.34"],
  "aaaa": ["2606:2800:220:1:248:1893:25c8:1946"],
  "mx": [{ "host": "mail.example.com", "priority": 10 }],
  "ns": ["a.iana-servers.net", "b.iana-servers.net"],
  "txt": ["v=spf1 -all"]
}

ssl -- TLS Certificate

{
  "subject": "www.example.org",
  "issuer": "DigiCert Global G2 TLS RSA SHA256 2020 CA1",
  "not_before": "2024-01-30T00:00:00Z",
  "not_after": "2025-03-01T23:59:59Z",
  "expired": false,
  "days_until_expiry": 142,
  "sans": ["www.example.org", "example.net", "example.org"],
  "serial_number": "0F:BE:08:B0:85:4D:05:73:8A:B0...",
  "signature_algorithm": "SHA256-RSA"
}

headers -- HTTP Response

Security Headers Checked

{
  "status_code": 200,
  "headers": {
    "Server": "ECAcc (dcd/7D5A)",
    "Content-Type": "text/html; charset=UTF-8",
    "Cache-Control": "max-age=604800"
  },
  "security_headers": {
    "strict_transport_security": "max-age=31536000",
    "x_content_type_options": "nosniff",
    "x_frame_options": "DENY"
  }
}

screenshot -- Page Screenshot Pro

{
  "status_code": 200,
  "png": "iVBORw0KGgoAAAANSUhEUgAA..."
}

reputation -- Domain Reputation Pro

Provider Result

{
  "score": 35,
  "risk": "medium",
  "providers": [
    { "listed": true, "category": "phishing", "provider": "spamhaus_dbl", "return_code": "127.0.1.4" },
    { "listed": false, "provider": "surbl" },
    { "listed": false, "provider": "uribl" },
    { "listed": false, "provider": "spamhaus_zen" }
  ]
}

Providers

The following blocklists are checked: Spamhaus DBL, SURBL, URIBL, and Spamhaus ZEN.

Risk Levels

email_security -- Email Authentication

spf -- Sender Policy Framework

dmarc -- DMARC Policy

dkim -- DKIM Records

{
  "spf": {
    "raw": "v=spf1 include:_spf.google.com -all",
    "version": "spf1",
    "mechanisms": ["include:_spf.google.com"],
    "all": "-all"
  },
  "dmarc": {
    "raw": "v=DMARC1; p=reject; rua=mailto:dmarc@example.com",
    "version": "DMARC1",
    "policy": "reject",
    "rua": "mailto:dmarc@example.com"
  },
  "dkim": [
    { "selector": "google", "found": true, "raw": "v=DKIM1; k=rsa; p=MIGf..." },
    { "selector": "default", "found": false }
  ]
}

subdomains -- Subdomain Enumeration

Subdomain Entry

{
  "count": 3,
  "capped": false,
  "subdomains": [
    { "domain": "www.example.com", "source": "crt.sh" },
    { "domain": "mail.example.com", "source": "crt.sh" },
    { "domain": "api.example.com", "source": "crt.sh" }
  ]
}

ct_logs -- Certificate Transparency Logs

CT Log Entry

{
  "count": 2,
  "capped": false,
  "entries": [
    {
      "logged_at": "2024-01-15T00:00:00",
      "not_before": "2024-01-15T00:00:00",
      "not_after": "2025-04-15T23:59:59",
      "issuer": "Let's Encrypt",
      "common_name": "example.com",
      "serial": "abc123def456"
    }
  ]
}

bgp -- BGP / ASN Enrichment

ASN Record

{
  "records": [
    {
      "ip": "93.184.216.34",
      "asn": 15133,
      "prefix": "93.184.216.0/24",
      "country": "US",
      "registry": "arin",
      "description": "EDGECAST, US"
    }
  ]
}

fingerprint -- Technology Fingerprinting

Detects web servers, frameworks, CDNs, CMS platforms, and programming languages from HTTP response headers. No extra HTTP requests are made -- detection uses the headers already fetched. Approximately 90 technologies are covered.

Technology Entry

{
  "count": 2,
  "technologies": [
    { "name": "Nginx", "category": "web-server", "version": "1.25.3", "confidence": "header" },
    { "name": "Cloudflare", "category": "cdn", "version": "", "confidence": "header" }
  ]
}

Categories

web-server, language, framework, cdn, cms, analytics, security, hosting, cache, javascript, other

threat_intel -- Threat Intelligence Pro

Queries external threat intelligence feeds concurrently and returns an aggregated risk assessment. Three providers are queried: VirusTotal (70+ antivirus engines), URLhaus (Abuse.ch malware URL database), and AlienVault OTX (community threat pulses).

Provider Result

{
  "risk_level": "medium",
  "score": 45,
  "categories": ["malware"],
  "providers": [
    {
      "provider": "virustotal",
      "detected": true,
      "score": 3,
      "categories": ["malware"],
      "details": "3/70 engines detected this domain"
    },
    {
      "provider": "urlhaus",
      "detected": false
    },
    {
      "provider": "alienvault_otx",
      "detected": true,
      "score": 20,
      "categories": ["malware"],
      "details": "5 threat pulses reference this domain"
    }
  ]
}

Scoring

The aggregate score is a weighted average across providers: VirusTotal (50%), URLhaus (30%), AlienVault OTX (20%). Risk levels map from the aggregate score: 0 = none, 1--20 = low, 21--50 = medium, 51--80 = high, 81--100 = critical.

errors -- Partial Failures

Individual lookups can fail without blocking the rest of the response. Each error contains:

Full Response Example

A complete response with all optional features enabled (screenshot, reputation, email_security, subdomains, ct_logs, bgp, fingerprint, threat_intel):

[
  {
    "domain": "example.com",
    "cache_hit": false,
    "whois": {
      "domain_name": "example.com",
      "registrar": "RESERVED-Internet Assigned Numbers Authority",
      "created_date": "1995-08-14T04:00:00Z",
      "expiry_date": "2025-08-13T04:00:00Z",
      "name_servers": ["a.iana-servers.net", "b.iana-servers.net"]
    },
    "dns": {
      "a": ["93.184.216.34"],
      "aaaa": ["2606:2800:220:1:248:1893:25c8:1946"],
      "ns": ["a.iana-servers.net", "b.iana-servers.net"],
      "txt": ["v=spf1 -all"]
    },
    "ssl": {
      "subject": "www.example.org",
      "issuer": "DigiCert Global G2 TLS RSA SHA256 2020 CA1",
      "not_after": "2025-03-01T23:59:59Z",
      "expired": false,
      "days_until_expiry": 142,
      "sans": ["www.example.org", "example.net", "example.org"]
    },
    "headers": {
      "status_code": 200,
      "headers": { "Server": "ECAcc (dcd/7D5A)" },
      "security_headers": {
        "strict_transport_security": "max-age=31536000",
        "x_content_type_options": "nosniff"
      }
    },
    "screenshot": {
      "status_code": 200,
      "png": "iVBORw0KGgoAAAANSUhEUgAA..."
    },
    "reputation": {
      "score": 0,
      "risk": "clean",
      "providers": [
        { "listed": false, "provider": "spamhaus_dbl" },
        { "listed": false, "provider": "surbl" },
        { "listed": false, "provider": "uribl" },
        { "listed": false, "provider": "spamhaus_zen" }
      ]
    },
    "email_security": {
      "spf": { "raw": "v=spf1 -all", "version": "spf1", "all": "-all" },
      "dmarc": { "raw": "v=DMARC1; p=reject", "version": "DMARC1", "policy": "reject" },
      "dkim": [{ "selector": "default", "found": false }]
    },
    "subdomains": {
      "count": 2,
      "capped": false,
      "subdomains": [
        { "domain": "www.example.com", "source": "crt.sh" },
        { "domain": "mail.example.com", "source": "crt.sh" }
      ]
    },
    "ct_logs": {
      "count": 1,
      "capped": false,
      "entries": [
        { "logged_at": "2024-01-15T00:00:00", "issuer": "Let's Encrypt", "common_name": "example.com", "serial": "abc123" }
      ]
    },
    "bgp": {
      "records": [
        { "ip": "93.184.216.34", "asn": 15133, "prefix": "93.184.216.0/24", "country": "US", "description": "EDGECAST, US" }
      ]
    },
    "fingerprint": {
      "count": 1,
      "technologies": [
        { "name": "ECAcc", "category": "cdn", "version": "", "confidence": "header" }
      ]
    },
    "threat_intel": {
      "risk_level": "none",
      "score": 0,
      "providers": [
        { "provider": "virustotal", "detected": false },
        { "provider": "urlhaus", "detected": false },
        { "provider": "alienvault_otx", "detected": false }
      ]
    },
    "errors": []
  }
]

Caching

Results are cached for 60 minutes. The cache_hit field on each response indicates whether data was served from cache or fetched live.

Error Handling

Error Response Format

All error responses use this format:

{
  "error": "description of the problem"
}

Request Correlation

You can pass an optional X-Client-Request-ID header with your own correlation ID for end-to-end tracing. The API echoes it back in the response headers and includes it in server-side logs.

What's New