Developer Tools

Domain Risk API API

The Domain Risk API returns fraud and brand-protection intelligence as clean JSON.

6 actionsLive JSON1,000 free creditsMCP-ready
Get a free keyOpen in playground

🤖 Using an AI assistant? Copy this link into ChatGPT / Claude / Cursor — it reads every endpoint and parameter instantly and tells you if this API fits your use case.

The primary assess endpoint returns a domain's registration status, a 0-100 risk score, a risk level (low, medium, elevated or high) and plain-English reasons for the score, and you can check domain age, whether it is parked, typosquatting variants, reputation and batch many domains. It is built for fraud, trust-and-safety and brand-protection teams that need a fast domain-risk signal without stitching together WHOIS, blocklists and heuristics. One ReefAPI key, one shared credit pool, the standard { ok, data, meta, error } envelope.

Live example

Real request and response JSON

Captured from the indexed primary action, assess, on .

Captured request
{
  "method": "POST",
  "url": "https://api.reefapi.com/domain-risk/v1/assess",
  "headers": {
    "x-api-key": "$REEF_KEY",
    "content-type": "application/json"
  },
  "body": {
    "domain": "google.com",
    "check_parked": false
  }
}
Captured response
{
  "ok": true,
  "meta": {
    "api": "domain-risk",
    "endpoint": "assess",
    "mode": "live",
    "latency_ms": 1221.9,
    "record_count": 1,
    "bytes": 457660,
    "cache_hit": false,
    "source": "rdap.org + doh:cloudflare + certspotter",
    "risk_score": 0,
    "risk_level": "low"
  },
  "data": {
    "domain": "google.com",
    "registered": true,
    "available": false,
    "risk_score": 0,
    "risk_level": "low",
    "reasons": [
      "No notable risk signals — established/clean profile."
    ],
    "lifecycle": {
      "age_days": 10533,
      "age_years": 28.84,
      "age_band": "mature",
      "days_to_expiry": 788,
      "expiry_risk": "ok",
      "recently_registered": false,
      "renewal_status": "active"
    },
    "signals": {
      "registrar": "MarkMonitor Inc.",
      "nameserver_provider": "google",
      "dnssec": false,
      "has_certificate": true,
      "mail": {
        "mx": true,
        "spf": true,
        "dmarc": true
      },
      "structural_flags": [],
      "impersonation": null
    },
    "parked": null
  }
}
Actions

What the Domain Risk API API does

ActionDescriptionConcrete use caseKey params
assessComprehensive fraud and security risk report for one domain: a 0-100 risk score, human-readable reasons, and a risk level (low / medium / elevated / high). Combines domain age, expiry status, parked/for-sale detection, TLS certificate presence, hostname structure, brand impersonation signals, and email/DNSSEC legitimacy into a single verdict. The primary action for phishing detection and brand protection.Ops teams call assess to get comprehensive fraud and security risk report for one domain.domain, check_parked, include_pii
ageDomain age + expiry-risk band + renewal status (lifecycle synthesis from RDAP dates — NOT a raw whois dump; use domain-intel.whois for that).Developer tools call age to get domain age + expiry-risk band + renewal status (lifecycle synthesis from RDAP dates.domain
parkedDetect whether a domain is parked or listed for sale. Checks parking nameserver signals and the domain's root page for for-sale phrases and marketplace redirect hosts (Sedo, Afternic, GoDaddy, etc.). Returns a confidence-scored verdict: parked, for_sale, or actively in use. Returns 'unknown' when the page cannot be read.Validation workflows call parked to detect whether a domain is parked or listed for sale.domain
typosquatGenerate a brand's lookalike domains across 16 permutation families (meets/exceeds dnstwist; incl IDN homoglyph/homograph) then report which are ACTUALLY REGISTERED + their risk — the brand-protection product.Data-quality teams call typosquat to generate a brand's lookalike domains across 16 permutation families (meets/exceeds dnstwist;….domain, families, keywords, check_registered
reputationRegistrar / nameserver / age / mail-hygiene (SPF·DMARC·DNSSEC) trust signals → a 0-100 reputation_score + trust_level. Reputation is a positive-trust lens (vs assess's risk lens).Ops teams call reputation to get registrar / nameserver / age / mail-hygiene (SPF·DMARC·DNSSEC) trust signals → a 0-100 reputa….domain
batchRisk-assess up to 50 domains in one call (RDAP + DNS + email hygiene scoring, no per-domain parked-page probe). Returns a risk verdict per domain plus a combined high-risk list — ideal for bulk fraud screening.Developer tools call batch to get risk-assess up to 50 domains in one call (RDAP + DNS + email hygiene scoring, no per-domain p….domains
Code samples

Call assess from your stack

curl -X POST https://api.reefapi.com/domain-risk/v1/assess \
  -H "x-api-key: $REEF_KEY" \
  -H "content-type: application/json" \
  -d '{"domain":"google.com","check_parked":false}'
MCP one-liner
Ask your MCP-connected assistant: call reefapi.domain-risk.assess with {"domain":"google.com","check_parked":false}.
Use cases

Who uses this API and why

  • Trust-and-safety teams call assess to score domains in signups and transactions before they cause fraud.
  • Brand-protection tools use typosquat to find lookalike domains impersonating a brand.
  • Onboarding flows use age and parked to flag freshly-registered or dormant domains in real time.
FAQ

Questions developers ask before integrating

What is the Domain Risk API API?

Domain Risk API API is a ReefAPI endpoint group for domain risk api It returns live JSON through POST requests under /domain-risk/v1.

Is the Domain Risk API API free to try?

Yes. ReefAPI starts with 1,000 free credits, no card required. Domain Risk API calls use the same shared credit balance as every other ReefAPI engine.

Do I need a Domain Risk API login or account?

No login to Domain Risk API is needed for the API response. You call ReefAPI with your x-api-key header, and the playground can run live examples before you create a production key.

How fresh is the Domain Risk API data?

The page example is captured from a live assess call, and production requests fetch live data through ReefAPI rather than a static sample.

How many credits does the Domain Risk API API use?

Domain Risk API actions currently cost 1 credit per successful call. Failed or blocked calls are free, and all APIs draw from one credit pool.

Can I call Domain Risk API from an AI assistant or MCP client?

Yes. Connect ReefAPI once through MCP and your assistant can call domain-risk actions with the same key, credit pool and JSON envelope used by normal REST requests.

Is the Domain Risk API API a Domain Risk API scraper?

It is the managed alternative to a DIY Domain Risk API scraper. Instead of building and maintaining your own scraper — proxies, headless browsers, captcha and constant breakage — you call one ReefAPI endpoint and get the same domain risk api back as clean JSON.

Why does my Domain Risk API scraper keep getting blocked?

Most Domain Risk API scrapers break on anti-bot defenses, rate limits and IP bans that need rotating residential proxies and browser fingerprinting to clear. ReefAPI handles all of that for you — no proxies, no captchas, no maintenance — and returns live JSON. Blocked or failed calls are free.

docs / domain-risk

Domain Risk API

Domain Risk API

base /domain-risk/v16 endpoints
post/domain-risk/v1/assess1 credit

Comprehensive fraud and security risk report for one domain: a 0-100 risk score, human-readable reasons, and a risk level (low / medium / elevated / high). Combines domain age, expiry status, parked/for-sale detection, TLS certificate presence, hostname structure, brand impersonation signals, and email/DNSSEC legitimacy into a single verdict. The primary action for phishing detection and brand protection.

ParameterAllowed / rangeDescription
domainrequired—A full domain to evaluate (e.g. example.com, secure-login.io). A bare host, full URL, leading www., or an IDN (münchen.de) are accepted and normalized to its registrable form.
check_parked = trueoptional—If true (default), also fetch the domain's root page to detect a parked or for-sale landing page. A failed page probe never fails the overall risk assessment — only the parking signal is omitted.
include_pii = falseoptional—If true, return the full RDAP registrant contact. Default false → personal data dropped (GDPR), organization kept.
Try in playground →
post/domain-risk/v1/age1 credit

Domain age + expiry-risk band + renewal status (lifecycle synthesis from RDAP dates — NOT a raw whois dump; use domain-intel.whois for that).

ParameterAllowed / rangeDescription
domainrequired—A full domain to evaluate (e.g. example.com, secure-login.io). A bare host, full URL, leading www., or an IDN (münchen.de) are accepted and normalized to its registrable form.
Try in playground →
post/domain-risk/v1/parked1 credit

Detect whether a domain is parked or listed for sale. Checks parking nameserver signals and the domain's root page for for-sale phrases and marketplace redirect hosts (Sedo, Afternic, GoDaddy, etc.). Returns a confidence-scored verdict: parked, for_sale, or actively in use. Returns 'unknown' when the page cannot be read.

ParameterAllowed / rangeDescription
domainrequired—A full domain to evaluate (e.g. example.com, secure-login.io). A bare host, full URL, leading www., or an IDN (münchen.de) are accepted and normalized to its registrable form.
Try in playground →
post/domain-risk/v1/typosquat1 credit

Generate a brand's lookalike domains across 16 permutation families (meets/exceeds dnstwist; incl IDN homoglyph/homograph) then report which are ACTUALLY REGISTERED + their risk — the brand-protection product.

ParameterAllowed / rangeDescription
domainrequired—A full domain to evaluate (e.g. example.com, secure-login.io). A bare host, full URL, leading www., or an IDN (münchen.de) are accepted and normalized to its registrable form.
familiesoptionalomission · repetition · transposition · replacement · insertion · vowel_swap · homoglyph · bitsquatting · hyphenation · addition · subdomain · tld_swap · combosquat · plural · homophones · variousWhich typosquat permutation families to generate (comma-separated or array). Defaults to ALL 16 (meets/exceeds dnstwist): omission, repetition, transposition, replacement, insertion, vowel_swap, homoglyph, bitsquatting, hyphenation, addition, subdomain, tld_swap, combosquat, plural, homophones, various. Unknown names are ignored.
keywordsoptional—Additional keywords to include in the combosquat permutation family (e.g. your product name or campaign terms like 'checkout', 'wallet'). Combined with the built-in phishing keyword set (login, secure, verify…).
check_registered = trueoptional—If true (default), RDAP/DoH-check which generated lookalikes are actually registered (capped at 120 checks). False → return candidates only.
Try in playground →
post/domain-risk/v1/reputation1 credit

Registrar / nameserver / age / mail-hygiene (SPF·DMARC·DNSSEC) trust signals → a 0-100 reputation_score + trust_level. Reputation is a positive-trust lens (vs assess's risk lens).

ParameterAllowed / rangeDescription
domainrequired—A full domain to evaluate (e.g. example.com, secure-login.io). A bare host, full URL, leading www., or an IDN (münchen.de) are accepted and normalized to its registrable form.
Try in playground →
post/domain-risk/v1/batch1 credit

Risk-assess up to 50 domains in one call (RDAP + DNS + email hygiene scoring, no per-domain parked-page probe). Returns a risk verdict per domain plus a combined high-risk list — ideal for bulk fraud screening.

ParameterAllowed / rangeDescription
domainsrequired—A list of full domains to risk-assess at once (comma-separated string or array). Capped at 50; invalid entries reported under 'invalid'.
Try in playground →