NetAPI Domain Intelligence

NetAPI Domain Intelligence answers domain and IP questions using NetAPI's JSON API. NetAPI tracks registered domains across more than 1,500 zones and publishes data from public threat feeds, daily newly registered domain lists, zone statistics, and its Top 1M popularity ranking. Free methods work without an account or API key. Calls are read-only HTTPS GET requests; the indicator or search text is sent to NetAPI.

The compromised-check method accepts a domain, hostname, URL, or IP address. It returns current and historical listing flags, first and last observation dates, a source tag, the matched value, and registrar information. Hostname checks also examine parent domains. A URL is checked through its hostname and parent domain.

For registration monitoring, search-new finds domains containing or starting with a keyword. Searches require at least four characters and cover one to seven days, with optional TLD, match, and result-limit filters. Coverage includes more than 1,100 TLDs that publish daily lists; zones refreshed through crawling have no new-domain lists.

Other methods retrieve a domain's Top 1M and TLD rank, TLD domain counts, registry, and abuse share, registrar size and abuse rate, DNS-provider size and market share, slices of the Top 1M, popular websites by country, and tracked zones with their figures. Daily new and deleted TLD counts are available where the registry publishes them.

Use it to enrich indicators from logs, alerts, emails, or threat hunts; investigate reported compromise; monitor brand lookalike registrations; or answer domain-popularity and infrastructure questions. Treat a feed listing as an investigative lead and check its date. A popular domain may be listed because one page was compromised.

Do not submit private or internal indicators, including RFC 1918 addresses, loopback addresses, and internal hostnames. Confirm permission before sending indicators from confidential investigations to this third-party service. A missing feed entry is not proof that an indicator is safe: the feed contains what public threat feeds have reported and consists mostly of domains and IPv4 addresses.

Each request selects a method and its parameters and returns JSON. For compromised-check, submit one indicator without spaces or lists. The listed_now flag means a report within the last 24 hours. If listed_ever is true but listed_now is false, report the older listing with last_seen. Name NetAPI and the date of the data in the answer.

curl -s "https://netapi.com/api-json/?method=compromised-check&value=example.com"

New-domain results contain domain, tld, and added_on. Domain ranking applies to registrable domains, removes a leading www., and does not rank other subdomains. Errors contain a code and message: HTTP 400 covers invalid input or short queries, 404 an unknown zone or name, and 429 an exhausted limit. Report the returned message instead of guessing; honor Retry-After for rate limits.

Without a key, single lookups allow 30 requests per minute and 1,000 per day per IP; search-new allows six per minute and 100 per day. A free account raises those respective limits to 60/5,000 and 30/500. Deduplicate batch indicators and pace requests. Full domain lists and datasets through lookup-domain, lookup-ip, and download-url require a paid plan.

The same data is available through MCP tools. The public MCP endpoint offers free tools without an account, while the account endpoint uses OAuth and adds account tools. An included Python example uses only the standard library for indicator enrichment. Free-account API tokens are sent in an authorization header from an environment variable; keep them out of command lines and files.