Changelog

IP Lookup responses now include an abuse_score field (0–100) sourced from AbuseIPDB, refreshed every 24 hours. Available on all plans.

Subdomain endpoints now support cursor-based pagination for domains with 10,000+ subdomains, replacing the previous offset-based approach which was unreliable at scale.

Fixed expires_at and created_at returning incorrect timezone offsets for ccTLD domains (.de, .uk, .fr, .nl). All dates now consistently returned as UTC.

Rate-limited bulk requests now correctly include the Retry-After header with the number of seconds until the rate limit resets.

Blacklist aggregation pipeline optimisation reduced median scam detection response time from 340ms to 210ms. 99th percentile improved from 1.2s to 780ms.

Two new endpoints for company domain portfolio mapping. Look up any company by name and retrieve all associated domains, IP ranges, and SSL certificates. Available on Pro and Enterprise plans.

Subscribe to real-time HTTP callbacks for domain events: status_change, expiry_alert, blacklist_added, blacklist_removed, and registrant_change.

New endpoint returns all domains hosted on a given Autonomous System Number. Useful for mapping cloud provider footprints and threat actor infrastructure.

API keys can now be scoped to specific endpoint groups (domain, whois, ip, bulk). Requests to endpoints outside a key's scope now return 403 instead of 200. Update your key scopes in the dashboard.

Date fields renamed for consistency: created → created_at, expires → expires_at, updated → updated_at. Old field names removed. Update your field references before upgrading.

New endpoint returns individual score components: SSL validity, blacklist status, domain age, SEO health, content quality, and risk score — each as a separate 0–10 value.

Real-time feed of newly registered domains, updated every 15 minutes. Filter by TLD, country, registrar, or keyword. Available on Enterprise plans.

Returns the complete SSL certificate chain including leaf certificate, intermediates, issuer, SANs, validity period, and cipher suite. Supports historical certificate lookup.

Added URLhaus, Phishing Army, and OpenPhish Premium to the blacklist aggregation pipeline. Total blacklist sources now: 13. Scam detection coverage improved by ~18%.

Fixed a deduplication bug causing MX record responses to include the same mail server multiple times when a domain used both IPv4 and IPv6 MX records.

New typosquat object in domain responses identifies whether a domain is a lookalike of a known brand, including the target brand, similarity score, and attack type (homoglyph, transposition, addition, omission).

Free plan daily request limit increased 5× to 500 requests per day. Rate limit per minute unchanged at 10 req/min. No action needed — applies automatically to all free accounts.

All endpoints now use the /v2 prefix. The /v1 API will continue to receive security fixes only until December 31, 2025, after which it will be retired. Migrate to v2 at your earliest convenience.

API key authentication now uses the X-API-Key header instead of Authorization: Bearer. Both are accepted during the migration window until v1 retirement.

The v2 domain endpoint returns WHOIS, DNS, SSL, score, IP, and subdomains in a single response using the include parameter. Eliminates the need for multiple API calls per domain.

The v1 API has been retired. All requests to /v1/ endpoints now return 410 Gone. Please migrate to the v2 API. See our migration guide for full details.