Domain Search

curl --request POST \
  --url https://encrata.com/api/agent/domain \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "query": "<string>"
}
'

{
  "domain": "tesla.com",
  "whois": {
    "registrar": "MarkMonitor Inc.",
    "created": "2003-07-15",
    "expires": "2027-07-15",
    "name_servers": ["a1-12.akam.net", "a10-67.akam.net"]
  },
  "dns": {
    "a": ["184.50.204.169"],
    "mx": ["tesla-com.mail.protection.outlook.com"],
    "txt": ["v=spf1 ..."]
  },
  "ssl": {
    "issuer": "DigiCert Inc",
    "valid_from": "2025-01-15",
    "valid_to": "2026-01-15",
    "subject_alt_names": ["tesla.com", "www.tesla.com"]
  },
  "threat_intel": {
    "malicious": false,
    "categories": []
  },
  "intel": {
    "domain": "tesla.com",
    "subdomains": ["www.tesla.com", "shop.tesla.com", "api.tesla.com"],
    "subdomain_count": 3,
    "hosts": [
      {
        "host": "www.tesla.com",
        "ips": ["184.50.204.169"],
        "ports": [80, 443],
        "url": "https://www.tesla.com",
        "status_code": 200,
        "title": "Tesla",
        "web_server": "nginx",
        "tech": ["Nginx", "React", "Cloudflare"],
        "cdn": "cloudflare",
        "tls": {
          "issuer": "DigiCert Inc",
          "subject": "tesla.com",
          "expires": "2026-01-15"
        }
      }
    ],
    "live_host_count": 1,
    "dns": {
      "a": ["184.50.204.169"],
      "ns": ["a1-12.akam.net"],
      "mx": ["tesla-com.mail.protection.outlook.com"]
    },
    "exposures": [],
    "active_scan": false,
    "deep_scan": false,
    "tools_run": ["subfinder", "dnsx", "httpx"]
  },
  "company": {
    "name": "Tesla, Inc.",
    "industry": "Automotive",
    "headquarters": "Austin, Texas, USA",
    "socials": {
      "linkedin": "https://www.linkedin.com/company/tesla-motors",
      "twitter": "https://twitter.com/tesla"
    },
    "registry": {
      "jurisdiction": "us_tx",
      "status": "active"
    },
    "confidence": 0.92
  },
  "credits": 1
}

POST

api

agent

domain

Domain Search

curl --request POST \
  --url https://encrata.com/api/agent/domain \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "query": "<string>"
}
'

{
  "domain": "tesla.com",
  "whois": {
    "registrar": "MarkMonitor Inc.",
    "created": "2003-07-15",
    "expires": "2027-07-15",
    "name_servers": ["a1-12.akam.net", "a10-67.akam.net"]
  },
  "dns": {
    "a": ["184.50.204.169"],
    "mx": ["tesla-com.mail.protection.outlook.com"],
    "txt": ["v=spf1 ..."]
  },
  "ssl": {
    "issuer": "DigiCert Inc",
    "valid_from": "2025-01-15",
    "valid_to": "2026-01-15",
    "subject_alt_names": ["tesla.com", "www.tesla.com"]
  },
  "threat_intel": {
    "malicious": false,
    "categories": []
  },
  "intel": {
    "domain": "tesla.com",
    "subdomains": ["www.tesla.com", "shop.tesla.com", "api.tesla.com"],
    "subdomain_count": 3,
    "hosts": [
      {
        "host": "www.tesla.com",
        "ips": ["184.50.204.169"],
        "ports": [80, 443],
        "url": "https://www.tesla.com",
        "status_code": 200,
        "title": "Tesla",
        "web_server": "nginx",
        "tech": ["Nginx", "React", "Cloudflare"],
        "cdn": "cloudflare",
        "tls": {
          "issuer": "DigiCert Inc",
          "subject": "tesla.com",
          "expires": "2026-01-15"
        }
      }
    ],
    "live_host_count": 1,
    "dns": {
      "a": ["184.50.204.169"],
      "ns": ["a1-12.akam.net"],
      "mx": ["tesla-com.mail.protection.outlook.com"]
    },
    "exposures": [],
    "active_scan": false,
    "deep_scan": false,
    "tools_run": ["subfinder", "dnsx", "httpx"]
  },
  "company": {
    "name": "Tesla, Inc.",
    "industry": "Automotive",
    "headquarters": "Austin, Texas, USA",
    "socials": {
      "linkedin": "https://www.linkedin.com/company/tesla-motors",
      "twitter": "https://twitter.com/tesla"
    },
    "registry": {
      "jurisdiction": "us_tx",
      "status": "active"
    },
    "confidence": 0.92
  },
  "credits": 1
}

Authentication

Requires an API key in the Authorization header.

Authorization: Bearer YOUR_API_KEY

Request

query

string

required

The domain name to search (e.g. tesla.com)

Response

Returns domain intelligence including WHOIS registration, DNS records, SSL certificate details, hosting/IP info, threat indicators, and a deep Domain Intelligence recon report (intel) plus company enrichment (company).

domain

string

The resolved domain name.

whois

object

WHOIS registration data — registrar, creation/expiry dates, and name servers.

dns

object

Apex DNS records (a, aaaa, cname, mx, ns, txt).

ssl

object

SSL/TLS certificate details — issuer, validity window, and subject alternative names.

threat_intel

object

Reputation / threat indicators for the domain.

intel

object

Domain Intelligence — a passive reconnaissance report built from subdomain enumeration, DNS resolution, and live HTTP probing. Safe to run against any domain (no intrusive scanning). May be null if recon returns no data.

Show Intel fields

subdomains

array

Discovered subdomains (passive sources: certificate transparency + public DNS aggregators).

subdomain_count

integer

Total number of subdomains discovered.

hosts

array

Live, probed hosts. Each host includes resolved ips, cname, open ports, url, status_code, page title, web_server, detected tech stack, cdn, and tls certificate details.

live_host_count

integer

Number of hosts that responded to HTTP probing.

dns

object

Aggregate apex DNS records (a, aaaa, cname, mx, ns, txt).

exposures

array

Potential exposures / CVE findings. Each entry has name, severity, host, and matched. Only populated for authorised active deep scans.

active_scan

boolean

Whether active port scanning was performed. Always false for API requests (passive-only mode).

deep_scan

boolean

Whether deep exposure scanning was performed. Always false for API requests.

tools_run

array

The recon tools that produced data for this report.

company

object

Company enrichment for the organisation behind the domain — name, industry, headquarters, social profiles, and registry data. May be null if no enrichment data is available.

Show Company fields

name

string

Company name.

legal_name

string

Registered legal name.

description

string

Short company description.

industry

string

Industry / sector.

founded

string

Founding or incorporation date.

headquarters

string

Primary headquarters location.

emails

array

Public contact email addresses.

phones

array

Public contact phone numbers.

socials

object

Social profile links (LinkedIn, Twitter/X, Crunchbase, GitHub, Facebook, Instagram, YouTube).

registry

object

Registry data — LEI, company number, jurisdiction, status, registered address, name servers, abuse contact, and officers.

confidence

number

Confidence score (0–1) for the merged enrichment.

report

object

OSINT Report — a structured, 16-section intelligence report synthesized from every data source above plus keyless passive enrichment (HTTP security headers, .well-known files, Certificate Transparency logs, the Internet Archive / Wayback Machine, ASN / hosting attribution, and email-authentication posture). Designed for a single-domain “everything we know” view. May be null if no data is available.

Show Report fields

domain

string

The domain the report was built for.

generated_at

string

ISO-8601 timestamp of when the report was generated.

screenshot

string

URL of the most recent urlscan.io live screenshot of the apex site, when available.

popularity_rank

integer

Tranco global popularity rank (lower is more popular), when the domain is ranked.

summary

object

Executive summary — company_name, description, category, key_findings[], major_risks[], confidence, security_grade (A–F), and a stats object (subdomains, live_hosts, open_ports, dns_records, technologies, exposures, emails, ct_names).

dns_intel

array

Sheet 2 — DNS & domain intelligence rows (record_type, value, provider, notes).

infra

array

Sheet 3 — infrastructure & hosting (asset, ip, asn, hosting, cdn, country).

subdomains

array

Sheet 4 — discovered subdomains (subdomain, ip, status, purpose, source, first_seen, owner_era). owner_era is previous when a Certificate Transparency entry predates the current registration (likely a prior owner), otherwise current.

website

array

Sheet 5 — website & product pages (page, url, page_type, status, title).

tech_stack

array

Sheet 6 — technology stack (category, technology, evidence, confidence).

security

array

Sheet 7 — passive security posture (area, finding, severity, recommendation).

company

array

Sheet 8 — company & business intelligence (category, entity, role, detail).

marketing

array

Sheet 9 — marketing, SEO & brand (category, finding, url, detail).

documents

array

Sheet 10 — public documents & files (type, url, sensitive, notes).

array

Sheet 11 — email infrastructure & authentication posture: SPF, DKIM, DMARC, MTA-STS, CAA, BIMI, and TLS-RPT (type, value, purpose, notes).

risk

array

Sheet 12 — risk, reputation & trust (signal, category, severity, recommendation).

historical

array

Sheet 13 — historical intelligence from Wayback & CT (period, source, finding, url).

gaps

array

Sheet 14 — gaps & unknowns (missing, why_matters, next_step, priority).

next_steps

array

Sheet 15 — recommended next steps (priority, task, purpose, method).

sources

array

Sheet 16 — source list (name, type, used_for, reliability).

extras

object

Extended domain intelligence — additional best-effort OSINT sources. Each sub-field is null when the source returns nothing. These signals are also folded into the report (risk, infrastructure, historical, and website sections).

Show Extras fields

urlscan

object

urlscan.io scan of the apex site — scan_id, scanned_url, screenshot, report_url, malicious, score, verdict, tags, scanned_at.

blocklist

object

abuse.ch URLhaus blocklist status — listed, source, threat_types, url_count, blacklists, first_seen, reference.

reverse_ip

object

Reverse-IP lookup of the primary IP — ip, domains[], count, truncated.

popularity

object

Tranco popularity — rank, date, list.

typosquat

object

Registered look-alike domains — generated, count, and registered[] (domain, ip, type).

ip_reputation

array

GreyNoise + AbuseIPDB reputation per resolved IP — ip, abuse_score, total_reports, classification, is_tor, is_scanner, usage_type, country.

breaches

object

Have I Been Pwned breaches recorded at the domain — domain, count, total_pwned, and breaches[] (name, title, breach_date, pwn_count, data_classes).

credits

integer

Credits consumed by the request.

{
  "domain": "tesla.com",
  "whois": {
    "registrar": "MarkMonitor Inc.",
    "created": "2003-07-15",
    "expires": "2027-07-15",
    "name_servers": ["a1-12.akam.net", "a10-67.akam.net"]
  },
  "dns": {
    "a": ["184.50.204.169"],
    "mx": ["tesla-com.mail.protection.outlook.com"],
    "txt": ["v=spf1 ..."]
  },
  "ssl": {
    "issuer": "DigiCert Inc",
    "valid_from": "2025-01-15",
    "valid_to": "2026-01-15",
    "subject_alt_names": ["tesla.com", "www.tesla.com"]
  },
  "threat_intel": {
    "malicious": false,
    "categories": []
  },
  "intel": {
    "domain": "tesla.com",
    "subdomains": ["www.tesla.com", "shop.tesla.com", "api.tesla.com"],
    "subdomain_count": 3,
    "hosts": [
      {
        "host": "www.tesla.com",
        "ips": ["184.50.204.169"],
        "ports": [80, 443],
        "url": "https://www.tesla.com",
        "status_code": 200,
        "title": "Tesla",
        "web_server": "nginx",
        "tech": ["Nginx", "React", "Cloudflare"],
        "cdn": "cloudflare",
        "tls": {
          "issuer": "DigiCert Inc",
          "subject": "tesla.com",
          "expires": "2026-01-15"
        }
      }
    ],
    "live_host_count": 1,
    "dns": {
      "a": ["184.50.204.169"],
      "ns": ["a1-12.akam.net"],
      "mx": ["tesla-com.mail.protection.outlook.com"]
    },
    "exposures": [],
    "active_scan": false,
    "deep_scan": false,
    "tools_run": ["subfinder", "dnsx", "httpx"]
  },
  "company": {
    "name": "Tesla, Inc.",
    "industry": "Automotive",
    "headquarters": "Austin, Texas, USA",
    "socials": {
      "linkedin": "https://www.linkedin.com/company/tesla-motors",
      "twitter": "https://twitter.com/tesla"
    },
    "registry": {
      "jurisdiction": "us_tx",
      "status": "active"
    },
    "confidence": 0.92
  },
  "credits": 1
}

Domain Intelligence

The intel block is produced by Encrata’s self-hosted recon engine, which wraps the open-source ProjectDiscovery suite:

Tool	Purpose
`subfinder`	Passive subdomain enumeration (certificate transparency, public DNS aggregators)
`dnsx`	DNS resolution (A/AAAA/CNAME/MX/NS/TXT) for the apex + every subdomain
`httpx`	Live HTTP probing — status, title, server, tech stack, TLS, CDN/WAF detection

API requests run in passive mode only — no port scans or intrusive probes are sent to the target, so it is safe to query any domain. Active port scanning (naabu) and exposure/CVE scanning (nuclei) are reserved for authorised internal use and never run on user-supplied domains.

Credits

1 credit per request.

Phone Lookup Company Search

​Authentication

​Request

​Response

​Domain Intelligence

​Credits

Authentication

Request

Response

Domain Intelligence

Credits