how.is domain & IP intelligence MCP Server

How old a domain is: registration date, age in days and years, and whether it was registered in the last 30 days (a common phishing signal). Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data: created, age_days, age_years, newly_registered, expires, registrar, source.

Is this domain name registered? Asked of the registry over RDAP, with the standard first-year and renewal price when it is free to register. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data: available (true/false; null when only DNS could be checked, then likely_available), registered_on, suffix, source (rdap/dns), confidence, price{registration_usd, renewal_usd, registrar, note}, caveat.

Whether the addresses behind a domain appear on spam and abuse blocklists. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data.ipResults[]: target, isListed, listingCount, totalChecked.

When did this domain appear in the registry zone file, leave it, come back, or change nameservers? From the daily gTLD + .com/.net zone files we capture (daily since 2026-08-05; monthly 2013-2018). A sudden nameserver move is a hijack or sale signal; a brand-new name is a phishing signal. Price $0.010 per call. Free sample: {"domain": "example.com"}. Returns: data: in_zone_now, first_seen, first_seen_is_coverage_start, last_seen, current_ns, events[{type: appeared|disappeared|reappeared|ns_changed, dates, from, to, message}], changed_last_30_days, coverage{daily_since, first_zone_file, runs}, ns_runs, note.

A, AAAA, MX, NS, TXT and other records for a domain, with resolve timing. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data.records keyed by record type (A, AAAA, MX, NS, TXT, ...); data.data.responseTime.

Whether DNSSEC is signed and validates for a domain. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data: isSigned, isValid, validationStatus, chainOfTrust, dsRecords, dnskeyRecords, errors, warnings, recommendations.

SPF, DKIM and DMARC records and posture for a domain. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data: spf, dkim, dmarc, mx, overallScore, overallStatus, recommendations.

Everything about a domain in one call: DNS, WHOIS, TLS, DNSSEC, email auth, security score, blacklist status, plus IP intelligence for its A record. Price $0.025 per call. Free sample: {"domain": "example.com"}. Returns: data.sections.{dns,whois,tls,dnssec,email-auth,security-score,blacklist,ip}; data.errors names any section that failed; data.billing says what was delivered.

A letter grade and point score for a domain security posture, with the scored items behind it. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data: grade, overallScore, maxPossibleScore, categories[] of scored items.

Certificate validity, issuer, protocol and days until expiry for a domain. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data: valid, issuer, subject, subjectAltNames, validFrom, validTo, daysUntilExpiry, protocol, cipher, selfSigned.

Should an agent click, sign in to, or pay this domain? A risk score and verdict (likely_safe / caution / high_risk, or inconclusive when a check could not run) with plain-English reasons, from domain age, spam/abuse blocklists and the HTTPS certificate. Price $0.020 per call. Free sample: {"domain": "example.com"}. Returns: data: verdict, risk_score (0-100), reasons[{risk, why}], age_days, blocklist_listings, blocklists_unanswered[], https_valid, not_checked[].

Registrar, creation and expiry dates, nameservers and status codes for a domain. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data.data: the parsed WHOIS/RDAP record (registrar, dates, nameservers, status).

Partner tier of the dns.pizza bot observatory: every network (ASN), named crawler, TLS (JA4) fingerprint and firewall rule seen in the last 7 days, refreshed hourly. The public tier is free at https://dns.pizza/bots; unlimited pulls come with a monthly plan at https://how.is/bots. Price $0.050 per call. Returns: data.data: generated_at, networks, bots, fingerprints (the free tier at dns.pizza/bots shows the same shape without fingerprints).

Verify a crawler's identity: is this visitor (IP + user-agent) really Googlebot, Bingbot, GPTBot, ClaudeBot, Applebot, PerplexityBot..., an impostor using the name, another bot, or likely a person? Checked against each operator's published IP lists and forward-confirmed reverse DNS, plus 7 days of bot-observatory firewall data on the network and TLS (JA4) fingerprint. Price $0.005 per call. Free sample: {"ip": "66.249.66.1", "ua": "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"}. Returns: data: verdict (verified / impostor / unknown_bot / likely_human_or_unclassified), confidence, automation_likely, claimed, identified_as{operator, method, evidence}, reasons[], how_to_act, checks{published_ranges, reverse_dns, asn}, observatory{network, fingerprint, claimed_family, impostors_seen}.

Verify up to 100 visitors (IP + user-agent, optional JA4) in one call and one payment, billed per item: the same verdicts as bot_verify, for a log excerpt or a firewall review. Price $0.005 per call. Free sample: {"items": [{"ip": "66.249.66.1", "ua": "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"}]}. Returns: data: results[] (one bot_verify verdict per item, or {ip, error}), counts by verdict, billing{items, unit_price_usd}.

See a web page: a 1280-wide JPEG of any public URL, viewport or full page (capped at 6000 px), with its final URL, HTTP status and title. Price $0.020 per call. Free sample: {"url": "https://example.com"}. Returns: data: image_base64 (JPEG), mime, width, height, final_url, http_status, title, note.

Live check of one or more URLs: HTTP status, latency, DNS resolve time, resolved IP, TTL, nameservers, TLS days remaining. Price $0.005 per call. Free sample: {"sites": ["https://example.com"]}. Returns: data keyed by URL; each entry has ok, code, ms, dns_ms, ip, ttl, ns, cert_days, server, ts.

Read a web page as clean markdown, with the URL pre-flight verdict attached (and a viewport screenshot on request). Honors robots.txt for your user agent; flags text from risky sites as untrusted. Refunded if nothing can be read. Price $0.005 per call. Free sample: {"url": "https://example.com"}. Returns: data: markdown, title, description, lang, canonical, final_url, http_status, content_type, words, truncated, untrusted_content, preflight{verdict, safe_to, reasons, ...}, screenshot{image_base64, ...} when asked.

Check whether a URL is safe to fetch, read, sign in to, or pay — before you do. One verdict with plain reasons: domain age and newborn flag, lookalike of a top site, spam/abuse blocklists, HTTPS, robots.txt for your user agent, how our bot observatory sees your user agent, and the site's own x402 price if it answers 402. Fails closed: 'unknown' means do not proceed. Price $0.005 per call. Free sample: {"url": "https://example.com"}. Returns: data: verdict (likely_safe/caution/high_risk/inconclusive), risk_score, safe_to{fetch,read,sign_in,pay} each yes/caution/no/unknown, actions{...: {answer, why}}, reasons[{risk, why}], domain_age_days, newborn, lookalike, https_valid, robots{allowed, token, status}, http{status, content_type, redirects}, x402{offers[{price_usd, network, pay_to}]}, bot_policy, not_checked[].

Newly registered look-alikes of a brand: names that entered the gTLD and .com/.net zones in the last 14 days and are a typo, a look-alike-character spelling (paypa1), the same name on another TLD, or the brand beside a lure word (paypal-login). Each with a risk tier and the reasons. Derived matches only, at most 50 — never a raw list of new domains. Price $0.020 per call. Free sample: {"brand": "example"}. Returns: data: brand, window{from,to,days}, matches[{domain, day, kind, matched, lures, tier, score, signals, ns{provider,hint}, census{state,registrar}, risk{tier,verdict,target}}], window_totals{total, by_tier, by_kind, listed_cap}, variants_searched, saturated, note.

Who runs this site? Company name and legal name, what they do, category, location and social links when known, mail/DNS/hosting providers, registration facts, and whether it is the same outfit as before, with a source and a confidence for every field. Unknown domains answer 404 and are not charged. Price $0.010 per call. Free sample: {"domain": "stripe.com"}. Returns: data: name, legal_name, description, categories, kind, audience, business_model, location{locality,region,country}, social{x,linkedin,...}, providers{dns,mail,hosting}, registration{registrar,created,expires,age_years,registrant_org}, ownership, confidence{overall,fields}, sources, not_checked[].

Free. Returns a link your user opens to add card credit (from $5) to the key on this connection. If the connection has no key, it creates one: tell your user to add it to this server's settings as the header 'Authorization: Bearer <key>'. The link only adds credit; it never reveals the key.

Network owner (ASN), company, geolocation, privacy flags and abuse contact for an IP address. Price $0.005 per call. Free sample: {"ip": "1.1.1.1"}. Returns: data.data: ip, hostname, city, region, country, asn, company, privacy, carrier, abuse.

Has this page changed since your last call, and how much? The first call stores a baseline; later calls return a text diff (2% threshold). Price $0.005 per call. Free sample: {"url": "https://example.com"}. Returns: data with baseline, changed, change_pct, added, removed, last_change_ts.