Security x402 offerings

Change watch for does site use plausible: runs the check, compares it with the result from your previous call for the same domain (kept 90 days) and returns the current answer, changed true/false, the fields that changed with before/after values, and when it was last seen. Schedule it to be alerted when this changes. $0.02 per check.

Does a website use reCAPTCHA? Fetches the page (homepage for a bare domain) and matches reCAPTCHA's fingerprints in the HTML and response headers, returning yes/no with the evidence snippet and the category (security). Technographics for sales, competitor research and migration planning, one technology per call. $0.01 per check.

Bulk does site use recaptcha: up to 20 domains in one call, processed concurrently, results in input order with a per-item error field and a failure count. Same answer per item as the single endpoint. Batch enrichment for agents that hold a list. $0.10 per batch.

Change watch for does site use recaptcha: runs the check, compares it with the result from your previous call for the same domain (kept 90 days) and returns the current answer, changed true/false, the fields that changed with before/after values, and when it was last seen. Schedule it to be alerted when this changes. $0.02 per check.

Change watch for does site use remix: runs the check, compares it with the result from your previous call for the same domain (kept 90 days) and returns the current answer, changed true/false, the fields that changed with before/after values, and when it was last seen. Schedule it to be alerted when this changes. $0.02 per check.

Bulk does site use sanity: up to 20 domains in one call, processed concurrently, results in input order with a per-item error field and a failure count. Same answer per item as the single endpoint. Batch enrichment for agents that hold a list. $0.10 per batch.

Does a website use F5 Shape? Fetches the page (homepage for a bare domain) and matches F5 Shape's fingerprints in the HTML and response headers, returning yes/no with the evidence snippet and the category (security). Technographics for sales, competitor research and migration planning, one technology per call. $0.01 per check.

Change watch for does site use shape security: runs the check, compares it with the result from your previous call for the same domain (kept 90 days) and returns the current answer, changed true/false, the fields that changed with before/after values, and when it was last seen. Schedule it to be alerted when this changes. $0.02 per check.

Does a website use Sucuri? Fetches the page (homepage for a bare domain) and matches Sucuri's fingerprints in the HTML and response headers, returning yes/no with the evidence snippet and the category (security). Technographics for sales, competitor research and migration planning, one technology per call. $0.01 per check.

Change watch for does site use sucuri: runs the check, compares it with the result from your previous call for the same domain (kept 90 days) and returns the current answer, changed true/false, the fields that changed with before/after values, and when it was last seen. Schedule it to be alerted when this changes. $0.02 per check.

Does a website use Sumo? Fetches the page (homepage for a bare domain) and matches Sumo's fingerprints in the HTML and response headers, returning yes/no with the evidence snippet and the category (popups). Technographics for sales, competitor research and migration planning, one technology per call. $0.01 per check.

Bulk does site use tiktok pixel: up to 20 domains in one call, processed concurrently, results in input order with a per-item error field and a failure count. Same answer per item as the single endpoint. Batch enrichment for agents that hold a list. $0.10 per batch.

Change watch for does site use trustarc: runs the check, compares it with the result from your previous call for the same domain (kept 90 days) and returns the current answer, changed true/false, the fields that changed with before/after values, and when it was last seen. Schedule it to be alerted when this changes. $0.02 per check.

Does a website use Wordfence? Fetches the page (homepage for a bare domain) and matches Wordfence's fingerprints in the HTML and response headers, returning yes/no with the evidence snippet and the category (security). Technographics for sales, competitor research and migration planning, one technology per call. $0.01 per check.

Dokimo Verify API (GET) - scheme demo: recomputes a sample dokimo-merkle-v1 proof to its root and verifies nothing of yours. For real caller verification, POST /paid/verify with {leaf, proof_path, root, rule_version_commitment} plus summary and binding for a dokimo-anchor-v2 close (recompute + on-chain anchor check). Scheme: /merkle-spec.html.

Security enrichment: tech-stack fingerprint + CVE mapping + EPSS + CISA KEV + verdict for a domain

Determine a domain's age from registration data and archival history — tries RDAP, then port-43 WHOIS, then a Wayback-based estimate (age_source: rdap | whois | wayback_estimate | null), returning creation date, age in years, first Wayback capture, archived snapshot count, and a maturity signal so agents can assess trustworthiness and detect freshly registered domains used for fraud or phishing — including .io and TLDs without public RDAP.

Resolves A, AAAA, MX, NS, TXT, CAA and SOA, reads the WHOIS record of the responsible registry, checks SPF, DMARC and known DKIM selectors, opens a TLS handshake for issuer, validity, chain and SAN list, and collects subdomains from Certificate Transparency. Fields that a registry refuses to answer are reported as unknown, never guessed.

One call returns a complete intelligence profile for a domain — WHOIS registration, DNS records, SSL certificate, detected tech stack, and blacklist status — aggregated into a single risk-scored report so agents can fully vet a domain without orchestrating five separate lookups.

domain risk report from DNS signals: address records, nameservers, MX records and high-abuse TLD heuristics.

composed domain threat report from DNS infrastructure signals and high-abuse TLD heuristics for agent browsing decisions.

Scores a domain’s trustworthiness using paid API access.

Phishing/trust verdict for a website domain before an agent transacts with an unfamiliar merchant. Fuses registration age (RDAP), DNS/mail posture (SPF, DMARC, DNSSEC), TLS validity, Certificate Transparency history and a typosquat/homoglyph analysis into a composite trust score 0-100, a category (trusted / caution / untrusted / unknown), per-dimension flags and reasons. Trust indicators, not a guarantee.

Pure-compute typosquat and homoglyph check on a hostname: edit-distance to a curated brand list, look-alike character normalization, brand-in-subdomain lures, punycode/IDN, abused free-hosting suffixes and throwaway TLDs. Returns is_typosquat plus the nearest brand, edit distance and reasons. No network — instant, cheap.