Pricing

Free lookups with no account. Paid plans lift the daily cap, add the daily data files, and unlock the extended record on every domain page. Above that, what separates them is how much of the corpus you can sweep at once.

See the extended record Certificates with their keys and JA4X fingerprints, DNS per vantage point and the full address history -- what every plan unlocks, public on one domain. View the example →

Look things up, take the files

Read the public record, and download the daily domain and DNS files. No advanced queries on either of these.

Free

You look up domains one at a time, or from a script.

The public record for any domain: certificate, issuer, expiry, hosting address and current DNS
1,000 requests a day per address, no account and no key
JSON, Markdown or a web page from the same URL
No daily data files
No search, pivots or reverse IP
No extended record

Read the docs →

Basic

You need the domain and DNS corpus in bulk.

$39/month

No daily cap. 60 requests a minute
Daily data files for domains and DNS, csv.zst and json.zst
The extended record on the website for any domain you look up: certificate internals, DNS per vantage point, full address history
Registration and expiry dates, registrar
No reverse IP, pivots or search: those start at Plus
No Pro datasets as files

Subscribe — Basic

Hunter plans

Everything above, plus the advanced queries — reverse IP, pivots, pattern search, batch. Those are bounded by how many you may run at once on your key rather than by the per-minute cap, and that is what separates these two.

Plus

You work leads one at a time: an address, a certificate, a name.

$99/month

Everything in Basic, at 300 requests a minute
Reverse IP and CIDR: every domain on an address or a range
Pivots by certificate, SPKI or JA4X: the other names on a certificate, everything sharing a key
The extended record by API, not only on the website
Domain timeline by API: every dated event with the gap between them
1 advanced query in flight on your key
No pattern search or batch lookup
No Pro datasets as files

Subscribe — Plus

Pro

You run collection: sweep the corpus, take the feeds, hold the files.

$199/month

Everything in Plus, at 1,200 requests a minute
Pattern search across the corpus, and batch lookup of up to 500 domains in one call
The newly registered domains and provisioning feeds, cursor-paged
Daily files for DNS per vantage point, certificates and address history — the three datasets Basic and Plus do not get in bulk
2 advanced queries in flight on your key

Subscribe — Pro

Compare

Weighing us against another service? The comparison page covers AllZonefiles.io, Domains-Monitor, WhoisXML API and crt.sh, including where each of them is the better choice.

Features Basic API response Pro API response

	Free	Basic	Plus	Pro
Limits
Requests a day	1,000	no cap	no cap	no cap
Requests a minute	n/a	60	300	1,200
API keys on the account	No	1	1	1
Lookups and records — one domain at a time
Public record API	Yes	Yes	Yes	Yes
Registration and expiry, registrar	Yes	Yes	Yes	Yes
Current DNS records	Yes	Yes	Yes	Yes
Extended record on the website	No	Yes	Yes	Yes
Certificate internals, on a domain you look up	No	Yes	Yes	Yes
DNS per vantage point, on a domain you look up	No	Yes	Yes	Yes
Full address history, on a domain you look up	No	Yes	Yes	Yes
Domain timeline on the website	No	Yes	Yes	Yes
The extended record by API	No	No	Yes	Yes
Domain timeline by API, with `gap_seconds`	No	No	Yes	Yes
Pivot by certificate, SPKI or JA4X, by API	No	No	Yes	Yes
Advanced queries — bounded by concurrency, not by the per-minute cap
Reverse IP and CIDR: what resolves to an address	No	No	Yes	Yes
Pattern search across the corpus	No	No	No	Yes
Batch lookup, up to 500 domains in one call	No	No	No	Yes
Provisioning feed	No	No	No	Yes
Newly registered domains, cursor-paged	No	No	No	Yes
In flight at once, on your key	No	No	1	2
Downloads — the daily files, by dataset
Domains	No	Yes	Yes	Yes
DNS	No	Yes	Yes	Yes
DNS by vantage point	No	No	No	Yes
Certificates	No	No	No	Yes
Address history	No	No	No	Yes
Full weekly snapshot	No	the datasets on your plan	the datasets on your plan	all five
Formats	No	csv.zst and json.zst	csv.zst and json.zst	csv.zst and json.zst
Download allowance	No	1 per file per day	1 per file per day	1 per file per day
Published SHA-256 checksums	Yes	Yes	Yes	Yes
Account
Sign-in, billing page	No	Yes	Yes	Yes
Ad-free, every page	No	Yes	Yes	Yes

GET /github.com on the free or Basic plan.

{
  "domain": "github.com",
  "registered": "2007-10-09T18:20:50Z",
  "expires": "2026-10-09T18:20:50Z",
  "ssl_expires": "2026-12-26T23:59:59Z",
  "ssl_cert": "9F53ECDDF913AFBA5678C924A95149D2",
  "ssl_issuer": "Amazon",
  "ip": "140.82.113.4",
  "last_update": "2026-09-14T08:07:30Z",
  "first_cert_seen": null,
  "tracked": false,
  "first_zone_seen": null
}

GET /api/v1/domain/github.com on Pro. Abridged: the real response carries every certificate and address, not one of each.

{
  "domain": "github.com",
  "record": { ... every field from the Basic response ... },
  "addresses": [
    { "ip": "140.82.113.4",
      "first_seen": "2026-08-05T19:16:00Z",
      "last_seen":  "2026-09-12T04:26:55Z",
      "observed": 2, "current": true }
  ],
  "certificates": [
    { "serial": "0a1b2c...", "spki_sha256": "e3b0c442...",
      "ja4x": "2bab15409345_2bab15409345_a475d2a3f9e8",
      "issuer_org": "Amazon", "subject_cn": "github.com",
      "key_alg": "RSA", "key_bits": 2048,
      "signature_alg": "SHA256-RSA",
      "sans": ["github.com", "www.github.com"],
      "san_count": 2, "wildcard": false,
      "ct_logs_seen": 3,
      "valid_from": "2026-09-01T00:00:00Z",
      "valid_until": "2026-12-26T23:59:59Z" }
  ],
  "counts": { "addresses": 22, "certificates": 6 }
}

Limits, and why they are set where they are

The API and the files are metered differently because they cost us different things.

Limit	Value	Reason
Free daily cap	1,000 requests per address, resetting at 00:00 UTC	Enough for an interactive visitor or a small script. It stops one scraper monopolizing a shared backend.
Paid rate limit	60 a minute on Basic, 300 on Plus, 1,200 on Pro	Paid plans have no daily cap. The per-minute ceiling smooths bursts, and it is the nudge toward the files: paging an API for the whole corpus is slower for you and more expensive for us than one download.
Advanced API concurrency	1 request in flight on Plus, 2 on Pro	A cold reverse-IP range query can read hundreds of millions of rows and hold its database connection for the better part of 18 seconds. Ten of those at once would exhaust the connection pool and the memory behind it, and every other request on the site would stall. The cap keeps one account from doing that. Over the limit a request waits briefly, then returns a timeout rather than queueing.
File downloads	One download per file per day	Each file is generated once a day. Re-downloading is the main way bulk access gets expensive, and this keeps the price flat for everyone.

Every capped response carries its own state in the X-RateLimit-* headers, and a Retry-After when you are over. See the API documentation.

If a limit genuinely blocks legitimate work, tell us. These are sized to protect the service, and we would rather adjust one than lose the use case.

Daily files

Generated once every 24 hours as csv.zst and json.zst. Fetch them with your API key as a bearer token, so they drop straight into a cron job with no browser and no session.

Two kinds: a daily delta of what changed, and a full snapshot for seeding a new system. The delta is what most people run on. Files stay on the download page for 14 days; every file we publish is archived permanently, so the 14-day certificate window in the API is a working window rather than the life of the data. The daily file reference lists every column. The corpus currently holds 439,800,303 domains, so re-reading all of it to find the day's changes wastes time on both sides.

A sample row for every dataset, and what is published right now, are on Downloads.

Billing

Monthly through PayPal. There is no password: you sign in with a code sent to your email, and manage your key and billing from there. The files are listed publicly at Downloads. Cancel any time in PayPal; the billing page follows within minutes. Access runs to the end of the period you have paid for. See the terms.