Website Safety & Domain Age Checker API

Use when…

• You need quick scam/risk signals: domain age, DNS/MX/SPF/DMARC, SSL, HTTPS, lookalike hints.
• An onboarding or anti-phishing agent must score a URL before a user clicks or pays.
• You want a structured risk summary from public protocols (not a full malware sandbox).

Try this input

Copy-paste this JSON as the Actor input (it matches a successful run / the default schema):

{
  "urls": [
    "google.com",
    "paypa1-secure-login.com"
  ]
}

Sample output (real run 2026-10-26)

One dataset item, shortened:

{
  "input": "paypa1-secure-login.com",
  "host": "paypa1-secure-login.com",
  "registered_domain": "paypa1-secure-login.com",
  "tld": "com",
  "is_ip": false,
  "punycode": false,
  "dns": {
    "resolves": false,
    "a": [],
    "aaaa": [],
    "mx": [],
    "ns": [],
    "spf": null,
    "dmarc": null
  },
  "ssl": {
    "valid": false,
    "error": "no HTTPS on port 443 (gaierror)"
  },
  "http": {
    "error": "ConnectError"
  },
  "registration": {
    "registered": false,
    "source": "RDAP"
  },
  "domain_created": null,
  "domain_age_days": null,
  "…": "+6 more keys"
}

"Is this website legit?" in one call. For each domain or URL you get:

• Domain age & registration: created / expires dates, registrar, status, name servers (RDAP, WHOIS fallback for ccTLDs)
• DNS: resolves?, A/AAAA, MX, NS, SPF, DMARC
• SSL/TLS certificate: valid?, issuer, valid from/to, days left, certificate age
• HTTPS: status code, redirects, final URL, HSTS
• Lookalike detection: typo-squats and brand-in-domain tricks (paypa1-secure.com, amaz0n-login.net...) for 60+ banks, shops, couriers and tech brands
• Risk score 0–100 (low / medium / high) with plain-English reasons, e.g. "domain registered 4 days ago", "looks like paypal"

Quick start

Leave the default input (it is prefilled) and click Start:

{"urls": ["google.com", "paypa1-secure-login.com"]}

Sample output (real run, 26 Oct 2026, default input)

input	domain_age_days	registrar	ssl valid	DMARC	risk_score	risk_level	top reasons
google.com	10633	MarkMonitor Inc.	true	yes	0	low	none
paypa1-secure-login.com	(not registered)	none	false	no	90	high	domain is not registered; looks like paypal (brand name inside a different domain); domain does not resolve

Each row also has full dns, ssl, http and registration objects, lookalike and a note.

Use cases

• Check a link from an email or text before an AI agent or a person clicks it.
• Vet a new supplier's or shop's website before paying.
• Flag brand lookalike or typo-squat domains in support tickets or marketplace listings.
• Bulk-screen sign-up or referral domains for very new registrations.

Pricing

Pay per event: $0.005 per website checked. Invalid input is not charged.

FAQ

Is this a phishing blocklist? No. It scores public registration, DNS and certificate signals. It does not use Google Safe Browsing.

Do I need an API key? No.

Can I check many sites? Yes, put them all in urls in one run.

Limits & failure modes

• A low score does not prove a site is safe, and a high score means "verify", not "proven scam".
• Some country-code domains do not publish registration dates, so domain age can be empty.
• Lookalike detection covers about 60 well-known brands, not every brand.
• Sites that block cloud servers may show HTTP errors even when they work in a browser.
• Heuristic risk only — not a malware sandbox, Safe Browsing replacement, or guarantee.
• New domains look riskier by age alone; combine signals before blocking.

Notes

The score is built from public registration, DNS and certificate signals. It is not a malware or phishing blocklist (Google Safe Browsing is not used because its terms forbid commercial use). A low score does not guarantee a site is safe; a high score means "be careful and verify". Sources: IANA RDAP bootstrap and registry RDAP/WHOIS servers, public DNS, the site's own TLS certificate.