Domain Risk API & Scraper
The Domain Risk API returns fraud and brand-protection intelligence as clean JSON.
🤖 Using an AI assistant? Copy this link into ChatGPT / Claude / Cursor — it reads every endpoint and parameter instantly and tells you if this API fits your use case.
The primary assess endpoint returns a domain's registration status, a 0-100 risk score, a risk level (low, medium, elevated or high) and plain-English reasons for the score, and you can check domain age, whether it is parked, typosquatting variants, reputation and batch many domains. It is built for fraud, trust-and-safety and brand-protection teams that need a fast domain-risk signal without stitching together WHOIS, blocklists and heuristics. One ReefAPI key, one shared credit pool, the standard { ok, data, meta, error } envelope.
The verdict fields, their allowed values, and a measured example of each
domain-risk reads RDAP, DNS over HTTPS, certificate transparency and the domain's own root page. It consults no abuse block-list at all, which is why it can flag a domain that nobody has reported yet. Every scored field has a small closed vocabulary, and the reasons array explains each point in plain English, so you can show a customer why a domain was held.
| Field | Values | Measured example |
|---|---|---|
| risk_level | low, medium, elevated, high, or n/a | google.com low, g00gle.com medium, and an unregistered domain returns n/a |
| risk_score | 0 to 100, or null | google.com 0 with reasons ["No notable risk signals - established/clean profile."], g00gle.com 35 |
| lifecycle.age_band | very_new, new, young, established, mature | github.com at 6,896 days is mature, while an 81-day-old domain is flagged recently_registered |
| lifecycle.expiry_risk | expired, imminent, soon, ok | github.com read soon at 43 days to expiry, google.com read ok at 749 |
| renewal_status | active, renewed/maintained | derived from the RDAP created, updated and expires triple, not from a separate lookup |
| signals.impersonation | null, or brand plus kind plus lookalike | g00gle.com returned brand google, kind homoglyph, lookalike g00gle |
| signals.mail | mx, spf and dmarc booleans | g00gle.com has spf and dmarc true but mx false, a common park-and-protect pattern |
| parked.parked | true, false, or null when the page could not be read | example-login.com returned parked false, for_sale false, confidence medium, http_status 200 |
| reputation_score | 0 to 100 with trust_level high, medium or low | reefapi.com scored 50 and medium at 0.22 years old, with signals written as "- only 81d old" and "+ DMARC policy" |
assess and batch do not produce the same number for the same domain. g00gle.com measured risk_score 35 through assess and 23 through batch, because batch skips the certificate-transparency lookup, which is why has_certificate comes back null there, and skips the parked-page probe entirely. Compare scores only within a single action.
Real request and response JSON
Captured from the indexed primary action, assess, on .
{
"method": "POST",
"url": "https://api.reefapi.com/domain-risk/v1/assess",
"headers": {
"x-api-key": "$REEF_KEY",
"content-type": "application/json"
},
"body": {
"domain": "google.com",
"check_parked": false
}
}{
"ok": true,
"meta": {
"api": "domain-risk",
"endpoint": "assess",
"mode": "live",
"latency_ms": 1221.9,
"record_count": 1,
"bytes": 457660,
"cache_hit": false,
"source": "rdap.org + doh:cloudflare + certspotter",
"risk_score": 0,
"risk_level": "low"
},
"data": {
"domain": "google.com",
"registered": true,
"available": false,
"risk_score": 0,
"risk_level": "low",
"reasons": [
"No notable risk signals — established/clean profile."
],
"lifecycle": {
"age_days": 10533,
"age_years": 28.84,
"age_band": "mature",
"days_to_expiry": 788,
"expiry_risk": "ok",
"recently_registered": false,
"renewal_status": "active"
},
"signals": {
"registrar": "MarkMonitor Inc.",
"nameserver_provider": "google",
"dnssec": false,
"has_certificate": true,
"mail": {
"mx": true,
"spf": true,
"dmarc": true
},
"structural_flags": [],
"impersonation": null
},
"parked": null
}
}What the Domain Risk API does
| Action | Description | Concrete use case | Key params |
|---|---|---|---|
| assess | Comprehensive fraud and security risk report for one domain: a 0-100 risk score, human-readable reasons, and a risk level (low / medium / elevated / high). Combines domain age, expiry status, parked/for-sale detection, TLS certificate presence, hostname structure, brand impersonation signals, and email/DNSSEC legitimacy into a single verdict. The primary action for phishing detection and brand protection. | Platform and DevOps teams call assess to get comprehensive fraud and security risk report for one domain. | domain, check_parked, include_pii |
| age | Domain age + expiry-risk band + renewal status (lifecycle synthesis from RDAP dates — NOT a raw whois dump; use domain-intel.whois for that). | Security and supply-chain teams call age to get domain age + expiry-risk band + renewal status (lifecycle synthesis from RDAP dates. | domain |
| parked | Detect whether a domain is parked or listed for sale. Checks parking nameserver signals and the domain's root page for for-sale phrases and marketplace redirect hosts (Sedo, Afternic, GoDaddy, etc.). Returns a confidence-scored verdict: parked, for_sale, or actively in use. Returns 'unknown' when the page cannot be read. | Developer-tool builders call parked to detect whether a domain is parked or listed for sale. | domain |
| typosquat | Generate a brand's lookalike domains across 16 permutation families (meets/exceeds dnstwist; incl IDN homoglyph/homograph) then report which are ACTUALLY REGISTERED + their risk — the brand-protection product. | AI-agent developers call typosquat to generate a brand's lookalike domains across 16 permutation families (meets/exceeds dnstwist;…. | domain, families, keywords, check_registered |
| reputation | Registrar / nameserver / age / mail-hygiene (SPF·DMARC·DNSSEC) trust signals → a 0-100 reputation_score + trust_level. Reputation is a positive-trust lens (vs assess's risk lens). | Platform and DevOps teams call reputation to get registrar / nameserver / age / mail-hygiene (SPF·DMARC·DNSSEC) trust signals → a 0-100 reputa…. | domain |
| batch | Risk-assess up to 50 domains in one call (RDAP + DNS + email hygiene scoring, no per-domain parked-page probe). Returns a risk verdict per domain plus a combined high-risk list — ideal for bulk fraud screening. | Security and supply-chain teams call batch to get risk-assess up to 50 domains in one call (RDAP + DNS + email hygiene scoring, no per-domain p…. | domains |
Call assess from your stack
curl -X POST https://api.reefapi.com/domain-risk/v1/assess \
-H "x-api-key: $REEF_KEY" \
-H "content-type: application/json" \
-d '{"domain":"google.com","check_parked":false}'import requests
r = requests.post(
"https://api.reefapi.com/domain-risk/v1/assess",
headers={"x-api-key": REEF_KEY},
json={
"domain": "google.com",
"check_parked": false
},
)
print(r.json()["data"])const res = await fetch("https://api.reefapi.com/domain-risk/v1/assess", {
method: "POST",
headers: {
"x-api-key": process.env.REEF_KEY,
"content-type": "application/json",
},
body: JSON.stringify({
"domain": "google.com",
"check_parked": false
}),
});
const { ok, data, meta, error } = await res.json();Ask your MCP-connected assistant: call reefapi.domain-risk.assess with {"domain":"google.com","check_parked":false}.Who uses this API and why
- Trust-and-safety teams call assess to score domains in signups and transactions before they cause fraud.
- Brand-protection tools use typosquat to find lookalike domains impersonating a brand.
- Onboarding flows use age and parked to flag freshly-registered or dormant domains in real time.
Questions developers ask before integrating
Does a high risk score mean the domain is malicious?
No, it means the signals look wrong. g00gle.com is registered through MarkMonitor on Google's own nameservers, which is about as legitimate as ownership gets, and it still scores 35 at medium because no TLS certificate has ever been issued for it in CT logs and its name is a homoglyph of google. The reasons array carried exactly those two sentences. Treat the score as a triage ranking and read reasons before you act on it.
What actually makes a domain risky here?
Seven structural inputs: RDAP age, expiry and renewal history; the registrar and nameserver provider; DNSSEC; mail hygiene as MX, SPF and DMARC booleans; whether any certificate for the name appears in CT logs; hostname structure, surfaced as structural_flags such as digit_letter_mix; and similarity to a known brand. No reputation feed or abuse block-list is involved, which is the point: a domain registered an hour ago for a phishing run has no reports yet but scores badly on age and certificates.
How does this differ from threat-intel and domain-intel?
domain-risk is predictive and structural, threat-intel is reported abuse, and domain-intel is raw records. domain-intel gives you whois, dns, ssl_certs, hosting, subdomains and tech_detect with no verdict attached, threat-intel tells you whether URLHaus, OpenPhish, ThreatFox or Spamhaus have listed the host, and domain-risk is the only one of the three that produces a judgment about a domain nobody has reported. Run domain-risk first on unknown domains, then threat-intel to confirm.
What does typosquat generate, and how long does it take?
It builds lookalikes across 16 permutation families and then checks which are actually registered. A measured paypal.com run limited to homoglyph, replacement and omission generated 44 candidates, checked all 44, and found 31 registered and high risk with 1 indeterminate, broken down as replacement 22, omission 5 and homoglyph 4, with rows such as 0aypal.com and aypal.com carrying method dns-fallback. That three-family call took about 43 seconds, and the default all-16 run is considerably heavier. Registration checks are capped at 120, and check_registered false returns candidates only.
How do I check a domain that might not be registered?
Use assess or batch, not age. A measured assess on an unregistered .com returned ok true with registered false, available true, risk_level n/a, lifecycle null and a reasons entry saying there is nothing to assess. The same domain through the age action failed on three consecutive attempts across two different unregistered names, so age is only reliable once you already know the domain exists.
risk_score came back as a number but risk_level says n/a. Which one do I trust?
risk_level, together with registered. One unregistered domain returned risk_score null and another returned risk_score 8, because its name triggered the structural_flags entry digit_letter_mix even though there was nothing else to score. Both had risk_level n/a and registered false. Branch on registered and risk_level, because a score without a level is a fragment of an assessment rather than a verdict.
When should I call reputation instead of assess?
They read the same signals through opposite lenses. assess returns risk_score where high is bad and a reasons array listing only what is wrong. reputation returns reputation_score where high is good, a trust_level of high, medium or low, and a signals array where every entry is prefixed with a plus or a minus so you can render both sides. A measured reefapi.com reputation call returned 50 and medium, penalized for being 81 days old and credited for MX, SPF and DMARC.
What input formats does the domain parameter accept?
A bare host, a full URL, a leading www. and an IDN are all accepted and normalized down to the registrable domain before anything is looked up. Something that cannot be parsed as a domain is rejected with MISSING_PARAM and the message that assess requires a valid domain. include_pii defaults to false, which drops the RDAP registrant's personal contact details while keeping the organization, so set it true only if you have a lawful reason to hold that data.
What is the Domain Risk API?
Domain Risk API is a ReefAPI endpoint group for domain risk It returns live JSON through POST requests under /domain-risk/v1.
Is the Domain Risk API free to try?
Yes. ReefAPI starts with 1,000 free credits, no card required. Domain Risk calls use the same shared credit balance as every other ReefAPI engine.
Do I need a Domain Risk login or account?
No login to Domain Risk is needed for the API response. You call ReefAPI with your x-api-key header, and the playground can run live examples before you create a production key.
How fresh is the Domain Risk data?
The page example is captured from a live assess call, and production requests fetch live data through ReefAPI rather than a static sample.
How many credits does the Domain Risk API use?
Domain Risk actions currently cost 1 credit per successful call. Failed or blocked calls are free, and all APIs draw from one credit pool.
Can I call Domain Risk from an AI assistant or MCP client?
Yes. Connect ReefAPI once through MCP and your assistant can call domain-risk actions with the same key, credit pool and JSON envelope used by normal REST requests.