netapi

NetAPI Domain Intelligence

Overview

NetAPI (https://netapi.com/) tracks the registered domains of more than 1,500 zones and publishes free data built from them: a compromised feed of domains and IP addresses reported by public threat feeds, the daily lists of newly registered domains, zone statistics and the NetAPI Top 1M popularity ranking. This skill answers domain and IP questions with NetAPI's JSON API. The free methods need no account and no API key. Risk is safe: every call is a read-only HTTPS GET, and the only data sent is the indicator or search text itself.

When to Use This Skill

• Use when the user asks whether a domain, hostname, URL or IP address is known as compromised, or when enriching indicators from logs, alerts, emails or a hunt.
• Use when the user wants newly registered domains that contain a brand or keyword, for lookalike and phishing monitoring.
• Use when the user asks how popular a domain is, how big a TLD is, or how much abuse a TLD, registrar or DNS provider has.
• Do not use for private or internal indicators (RFC 1918 or loopback addresses, internal hostnames), or for indicators the user has not agreed to send to a third-party service.

How It Works

Step 1: Pick the method

Every call is GET https://netapi.com/api-json/?method=<method>&<parameters> and returns JSON.

Step 2: Call the API and handle errors

Errors come back as {"error": {"code": "...", "message": "..."}} with an HTTP status: 400 for invalid input (invalid_value, query_too_short), 404 for an unknown zone or name, 429 when a limit is reached (the response carries Retry-After). Report the message instead of guessing.

Step 3: Report the result

• listed_now: true means the indicator was reported within the last 24 hours; listed_ever: true with listed_now: false means an older listing, so give last_seen.
• listed_ever: false means the feed never held it. That is not a verdict that the indicator is clean.
• Name the source (NetAPI, https://netapi.com/) and the date of the data in the answer.

Examples

Example 1: Check an indicator

curl -s "https://netapi.com/api-json/?method=compromised-check&value=example.com"

{
  "value": "example.com",
  "type": "domain",
  "listed_now": false,
  "listed_ever": false,
  "matched_value": null,
  "first_seen": null,
  "last_seen": null,
  "block_reason": null,
  "note": "Not in the current or historical compromised feed."
}

A URL or a subdomain can be passed as it is: value=https://login.example.com/path is checked as login.example.com and then example.com.

Example 2: Watch for lookalike registrations

curl -s "https://netapi.com/api-json/?method=search-new&q=paypal&days=2&limit=50"

Each result has domain, tld and added_on. Use match=starts to keep only names that begin with the text, and tld=com to narrow it to one zone.

Example 3: Enrich a list of indicators (Python, standard library only)

import json
import time
import urllib.parse
import urllib.request

def netapi(method, **params):
    url = "https://netapi.com/api-json/?" + urllib.parse.urlencode({"method": method, **params})
    with urllib.request.urlopen(url, timeout=30) as response:
        return json.load(response)

for indicator in sorted(set(["example.com", "203.0.113.10"])):
    result = netapi("compromised-check", value=indicator)
    print(indicator, result["listed_now"], result["last_seen"])
    time.sleep(2)  # stays under the 30 requests a minute allowed without a key

A non-200 answer raises urllib.error.HTTPError; read its body for the JSON error message.

Example 4: Connect the MCP server instead

The same data is available as MCP tools. https://mcp.netapi.com/mcp/public offers the free tools without an account; https://mcp.netapi.com/mcp signs in with OAuth and adds the account tools. Setup per client: https://netapi.com/help/mcp/

Best Practices

• ✅ Deduplicate indicators before a batch and pace the calls; on a 429, wait for Retry-After.
• ✅ Ask before sending indicators from a confidential investigation to an external service.
• ✅ Treat a listing as a lead: check last_seen, and remember that a well-ranked domain can be listed because one of its pages was compromised.
• ❌ Don't send private, loopback or internal names and addresses; they cannot be listed and only leak internal data.
• ❌ Don't put an API token in a command line or a file; read it from an environment variable.

Limitations

• The feed holds what public threat feeds reported. An indicator that was never reported is not in it, so absence is not proof of safety.
• The feed holds mostly domains and IPv4 addresses.
• search-new covers the last 7 days of the zones that publish daily lists; zones refreshed by crawling (marked N/A on netapi.com) have no new-domain lists.
• domain-rank ranks registrable domains (a leading www. is dropped); other subdomains have no rank.
• Without a key: 30 requests a minute and 1,000 a day per IP for single lookups, 6 a minute and 100 a day for search-new. A free NetAPI account raises these to 60 / 5,000 and 30 / 500.
• lookup-domain, lookup-ip and download-url (full domain lists and datasets) need a paid plan.

Security & Safety Notes

• All calls are read-only GET requests to netapi.com; nothing is installed and no local file is changed.
• With a free account, send the token as a header from an environment variable, for example -H "Authorization: Bearer $NETAPI_TOKEN".
• The indicator or search text leaves the machine. Confirm with the user first when it comes from private data.

Common Pitfalls

• Problem: query_too_short from search-new. Solution: The search text must be at least 4 characters.
• Problem: invalid_value from compromised-check. Solution: Pass one domain, hostname, URL or IP per call, without spaces or lists.
• Problem: HTTP 429. Solution: The per-minute or daily limit is used up; wait for Retry-After, or use a free account token.

Related Skills

• @threat-intelligence - Broader IOC and campaign enrichment from public sources; use this skill as one of its lookups.
• @threat-hunting - Turn listed domains and IPs into detections.
• @osint-methodology - Authorized attack-surface work that needs newly registered lookalike domains.