Domain Intelligence APIs: What You Can Learn About a Domain Before You Trust It

Domain Intelligence APIs: What You Can Learn About a Domain Before You Trust It

01Introduction

A domain intelligence API returns structured facts about a website that its owner did not choose to tell you: when the domain was registered, who registered it, what it runs on, whether it resolves, and what is actually on the page. You call it with a hostname and get back evidence.

The reason to care is that domain age alone is one of the strongest fraud signals available, and it costs one API call to check.

Research published in the Journal of Cybersecurity in 2026 analysed 15,126 newly registered phishing domains over eleven months and found they had an average lifetime of 8.6 days. A separate longitudinal study of roughly 1.52 million malicious domains flagged on VirusTotal between January and May 2026 found that close to nine in ten were registered by attackers rather than being legitimate sites that got compromised, and that a third were detected within a week of registration.

A domain registered nine days ago is not automatically fraudulent. But if you are onboarding merchants, accepting vendor applications, or letting users submit links, the registration date is the cheapest risk signal you will ever add.

This post covers what you can find out about a domain programmatically, grouped by question, with the ApyHub catalog endpoints that answer each one.

Throughout, one example runs alongside: Vellum Pay, a payments company reviewing merchant applications, where every applicant submits a website and someone has to decide whether it is real.

021. Registration and Ownership

The first question: how long has this existed, and who owns it?

WHOIS is the protocol that answers this. A WHOIS lookup returns the registrar, registration date, expiry date, nameservers, and, depending on the registry and privacy settings, the registrant contact.

A WHOIS API turns that into a JSON response you can act on, rather than a text blob you have to parse. That matters more than it sounds: raw WHOIS output format varies by registry, so parsing it yourself means writing a parser per TLD.

The derived value most teams actually want is domain age. A bulk domain age checker is usually the first thing anyone builds on top of WHOIS. The Calculate Domain Age API returns it directly, which saves you doing date arithmetic against a registration timestamp and handling the registries that report it inconsistently. If you are running a bulk domain age check across a list of applicants or suppliers, this is the endpoint to loop over.

Worth knowing what WHOIS will not tell you. GDPR redaction means registrant details are hidden for most European registrations, and privacy services hide them elsewhere. Registration date, registrar, and nameservers remain visible almost everywhere, and those are the fields that carry the signal anyway.

Use case: Vellum Pay added a domain age check to merchant onboarding and set a review threshold at 30 days. In the first month it flagged 41 applications, of which 9 turned out to be fake storefronts recycling product images from a real retailer. None of them would have been caught by document checks, because the documents were fine.

032. Health and Reachability

Second question: does this site actually work?

To check domain health you run a set of related checks: does the domain resolve, does the site respond, is TLS configured correctly, are there dead links, do the security headers exist.

Several endpoints cover different parts:

• Domain Availability tells you whether a domain is registered at all. Useful in the other direction too, when you are checking name options.
• Broken Link Checker crawls a page and returns links that no longer resolve.
• Audit Website Security reports on security posture including headers.
• Evaluate SEO Health returns a score, a grade, and a structured-data breakdown with prioritised fixes.
• Validate Schema checks structured data markup, which matters for rich results and for anything machine-readable on the page.

Health checks read differently depending on why you are asking. For SEO, a low score is a to-do list. For vetting, a site with no TLS, no security headers, and forty broken links is a site that was assembled quickly and is not maintained, which is exactly the profile of a storefront that will disappear in a fortnight.

Use case: Vellum Pay found that combining domain age with a health check reduced false positives sharply. A three-week-old domain with clean TLS, valid schema markup, and no broken links is usually a real business that just launched. A three-week-old domain failing all three is not.

043. Technology and Infrastructure

Third question: what is this site built on?

Tech stack detection tells you the CMS, the ecommerce platform, the analytics, the CDN, the payment processors, and the JavaScript frameworks a site uses. It works by fingerprinting the HTML, headers, scripts, and cookies a page serves.

Three different audiences want this:

• Sales teams filter prospects by platform. A vendor selling a Shopify app only wants Shopify stores.
• Security teams identify outdated software before a vulnerability report arrives.
• Anyone vetting a site learns a lot from the stack. A "custom-built enterprise platform" running on a default WordPress theme with a free plugin checkout is telling you something.

The same fingerprinting answers two questions developers search for constantly: how to check what technology a website is built in, and how to find the API of a website. Detecting the platform usually tells you the API, since a Shopify store has the Shopify API and a WordPress site has the REST API at a predictable path. Tech detection gets you there faster than reading minified JavaScript.

Tech stack detection sits in the SEO catalog alongside the audit endpoints.

Use case: Vellum Pay used stack detection to catch a pattern their reviewers had missed. Fourteen separate merchant applications, all with different company names and different domains, were running an identical theme, an identical plugin set, and the same analytics ID. Same operator, fourteen shells.

054. Content and Structure

Fourth question: what is actually on this site?

Fetching a page is easy. Getting usable data out of it is the work. Four endpoints handle different shapes of that problem:

• Extract Sitemap from URL lets you extract every URL from a sitemap in one call, returning the site's full structure. This is the fastest way to understand scale: a "national retailer" with nine pages in its sitemap is not a national retailer.
• Extract Text from Webpage pulls the visible text, stripping navigation, scripts, and markup. If you need a website text extractor for content analysis or classification, this is the shape you want.
• Extract Links from Webpage returns outbound and internal links. If you need to extract links from a website to map its relationships or see where it sends visitors, this is the endpoint.
• AI-ready Clean Data Extractor returns page content structured for downstream model consumption, which saves the cleanup step when you are feeding pages into classification or summarisation.

Combine text extraction with keyword analysis and you have a website keyword extractor: pull the visible copy, run it through keyword analysis, and you know what a site is actually about rather than what its meta description claims.

Use case: Vellum Pay ran sitemap extraction across pending applications and set a floor. Any merchant claiming an established catalogue with fewer than fifteen indexed pages went to manual review. It caught template storefronts that looked complete on the homepage and had nothing behind it.

065. Visual Verification

Fifth question: what does this look like to a real visitor?

A screenshot endpoint renders a page and returns an image. It sounds trivial and it answers questions nothing else can.

Text extraction tells you what the HTML says. A website screenshot generator tells you what a person sees, which is not always the same thing. Sites hide content behind JavaScript, overlays, geolocation checks, and user-agent sniffing.

That last one has a name. Cloaking is serving different content to crawlers than to human visitors, and it is used both for search manipulation and for fraud, where a payment processor's automated check sees a legitimate storefront and actual customers see something else.

You can detect it without a dedicated cloaking checker. Render the same URL twice with different user agents and compare the results. If the crawler view and the browser view diverge materially, that is your answer. Screenshot generation and text extraction together give you both sides of the comparison.

Screenshots also give reviewers something to look at. A human glancing at an image decides in two seconds what a JSON response takes a minute to convey.

A website screenshot generator endpoint sits in the SEO catalog alongside the audit tools.

Use case: Vellum Pay attaches a screenshot to every application in the review queue. It turned merchant review from reading a form into looking at a storefront, and reviewers started catching things the automated checks had no rule for.

076. Authority and Competitive Context

Sixth question: does anyone else take this domain seriously?

Given only a company URL, authority metrics estimate that domain's standing based on its backlink profile and reach. They were built for SEO, and they double as a legitimacy proxy, because accumulating genuine inbound links takes time that a fraudulent operation does not have.

• Domain Authority Checker returns authority scores along with the underlying source data rather than a bare number.
• Advanced Domain Analysis provides deeper metrics on a domain's search presence.
• Find Similar Sites by Domains returns domains resembling a given one, which maps a competitive set or surfaces near-identical sites.
• Get Top Domains by Country and Search Domains by Keyword work in the other direction, finding domains that match a description.

The similarity endpoint is quietly the most interesting one for vetting. If a submitted domain is nearly identical to a well-known brand's site, you have found either a reseller or an impersonator, and both are worth knowing about before you approve a payment account.

Use case: Vellum Pay runs similarity checks on every applicant against a list of brands their fraud team tracks. Two applications in six weeks came back as near-clones of established retailers, down to the layout.

08Building the Pipeline

The endpoints above are more useful in sequence than individually. Vellum Pay's onboarding check runs in three stages:

Stage one, cheap and immediate. Domain age and availability. These are fast, and a domain registered last week ends the review before anything else runs. Most rejections happen here.

Stage two, structural. Sitemap extraction, tech stack detection, health check. Answers whether the site has substance behind the homepage.

Stage three, evidence. Screenshot, text extraction, similarity check. Produces the artefacts a human reviewer looks at, attached to the application.

Two practical notes. Check whether each endpoint is sync or job before you write the integration, since ApyHub labels them on the listing and the two need different code. Full crawls and audits are jobs; lookups are synchronous. And cache aggressively. A domain's registration date will not change, so there is no reason to look it up twice.

Browse the SEO catalog → · Browse security and privacy APIs →

09Domain Intelligence for Agents

Every endpoint mentioned here is available over MCP, which changes what a vetting pipeline can be.

A fixed pipeline runs the same checks in the same order every time. An agent can branch on what it finds: the domain is nine days old, so check similarity against known brands; the stack matches three other pending applications, so flag the pattern; the screenshot and the extracted text disagree, so escalate.

That branching is exactly what a fraud reviewer does, and it is difficult to express as a static rule set. It is also why the agent needs to discover capabilities at runtime rather than being handed a fixed toolset up front.

10Conclusion

Most of what you need to know about a website is available without asking its owner. Registration date, infrastructure, structure, appearance, and standing are all observable, and each takes one call.

The registration date is where to start. It is the cheapest check available, it requires no context about your business, and the research is consistent that newly registered domains carry disproportionate risk. Everything else refines the picture.

Try ApyHub free →

11FAQ

What is a domain intelligence API? An API that returns structured facts about a domain and the website behind it: registration date, registrar, nameservers, technology stack, site structure, health, and authority metrics. You send a hostname and receive JSON rather than having to crawl and parse the site yourself.

What is a WHOIS API? A WHOIS API returns domain registration data as structured JSON: registrar, registration and expiry dates, nameservers, and registrant details where they are not redacted. It replaces parsing raw WHOIS text, whose format varies between registries.

How do I check domain age in bulk? Loop a domain age endpoint over your list. ApyHub's Calculate Domain Age API returns the age directly from registration data, which avoids handling inconsistent date formats across registries. Cache the results, since a registration date never changes.

Why does domain age matter for fraud detection? Newly registered domains are disproportionately malicious. Research published in the Journal of Cybersecurity in 2026 found newly registered phishing domains had an average lifetime of 8.6 days, and a study of 1.52 million malicious domains found close to nine in ten were registered by attackers rather than compromised legitimate sites.

How do I check domain health? Combine several checks: does it resolve, does TLS validate, are security headers present, are there broken links, is structured data valid. Individually each is weak evidence. Together they describe whether a site is maintained.

How do I check what technology a website is built in? Tech stack detection fingerprints the HTML, response headers, scripts, and cookies a site serves to identify its CMS, ecommerce platform, analytics, CDN, and frameworks. It is also the fastest way to find a site's API, since the platform usually determines it.

What is cloaking and how do I detect it? Cloaking is serving different content to crawlers than to human visitors, used for search manipulation and for fraud. Detect it by requesting the same URL with different user agents and comparing the results, using screenshot rendering and text extraction to capture both views.

How do I extract a URL list from a sitemap? Use a sitemap extraction endpoint, which fetches and parses sitemap.xml including nested sitemap index files. It is the quickest way to establish a site's real scale, since the sitemap reflects what the owner wants indexed.

How do I extract the text content from a website? A text extraction endpoint fetches a page and returns visible text with navigation, scripts, and markup removed. For pages destined for a model rather than a human, a clean extraction endpoint returns content already structured for that.

Does WHOIS still work after GDPR? Partly. Registrant contact details are redacted for most European registrations and hidden by privacy services elsewhere. Registration date, expiry date, registrar, and nameservers remain visible almost everywhere, and those carry most of the risk signal.

Can AI agents run domain checks? Yes. Every endpoint here is available over MCP, so an agent can discover and call them at runtime and branch on what it finds, rather than following a fixed sequence of checks.

12Sources

• Sharad Agarwal and Marie Vasek, Examining newly registered phishing domains at scale, Journal of Cybersecurity, Volume 12, Issue 1, 2026
• A Longitudinal Study of Recently Observed Malicious Domains, arXiv, June 2026
• Phishing Landscape 2026, Interisle Consulting Group, July 2026

13About ApyHub

ApyHub is a curated API catalog for developers, teams, and AI agents, covering domain intelligence, SEO, file conversion, validation, AI, extraction, and more. One subscription covers the whole catalog, billed in atoms, with headroom pooled across every API rather than locked to individual services.

Every service carries machine-readable certification covering data handling, retention, and standards alignment including GDPR, SOC 2, and ISO 27001. Every endpoint is MCP-ready by default.

ApyHub is headquartered in Amsterdam, with offices in the Netherlands, Greece, and India, and runs on EU infrastructure. The catalog holds 450+ services and 1,500+ endpoints, with new APIs and providers onboarded continuously. The free tier requires no credit card.