bots.st/how-is-domain-ip-intelligence
how.is domain & IP intelligence
DNS and IP intelligence with risk checks
4914 ms
answered our call
- State
- Answered
- Protocol
- MCP 2025-06-18
- Tools listed
- 24
- Answered
- 3 of the last 3 calls
How to reach it
- MCP, HTTP
https://how.is/mcp
What it can do
| Tool | What it says it does |
|---|---|
add_credit | Free. Returns a link your user opens to add card credit (from $5) to the key on this connection. If the connection has no key, it creates one: tell your user to add it to this server's settings as the header 'Authorization: Bearer <key>'. The link only adds credit; it never reveals the key. |
bot_observatory | Partner tier of the dns.pizza bot observatory: every network (ASN), named crawler, TLS (JA4) fingerprint and firewall rule seen in the last 7 days, refreshed hourly. The public tier is free at https://dns.pizza/bots; unlimited pulls come with a monthly plan at https://how.is/bots. Price $0.050 per… |
bot_verify | Verify a crawler's identity: is this visitor (IP + user-agent) really Googlebot, Bingbot, GPTBot, ClaudeBot, Applebot, PerplexityBot..., an impostor using the name, another bot, or likely a person? Checked against each operator's published IP lists and forward-confirmed reverse DNS, plus 7 days of… |
bot_verify_batch | Verify up to 100 visitors (IP + user-agent, optional JA4) in one call and one payment, billed per item: the same verdicts as bot_verify, for a log excerpt or a firewall review. Price $0.005 per call. Free sample: {"items": [{"ip": "66.249.66.1", "ua": "Mozilla/5.0 (compatible; Googlebot/2.1… |
brand_lookalikes | Newly registered look-alikes of a brand: names that entered the gTLD and .com/.net zones in the last 14 days and are a typo, a look-alike-character spelling (paypa1), the same name on another TLD, or the brand beside a lure word (paypal-login). Each with a risk tier and the reasons. Derived… |
company_lookup | Who runs this site? Company name and legal name, what they do, category, location and social links when known, mail/DNS/hosting providers, registration facts, and whether it is the same outfit as before, with a source and a confidence for every field. Unknown domains answer 404 and are not… |
domain_age | How old a domain is: registration date, age in days and years, and whether it was registered in the last 30 days (a common phishing signal). Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data: created, age_days, age_years, newly_registered, expires, registrar, source. |
domain_available | Is this domain name registered? Asked of the registry over RDAP, with the standard first-year and renewal price when it is free to register. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data: available (true/false; null when only DNS could be checked, then… |
domain_blacklist | Whether the addresses behind a domain appear on spam and abuse blocklists. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data.ipResults[]: target, isListed, listingCount, totalChecked. |
domain_changes | When did this domain appear in the registry zone file, leave it, come back, or change nameservers? From the daily gTLD + .com/.net zone files we capture (daily since 2026-08-05; monthly 2013-2018). A sudden nameserver move is a hijack or sale signal; a brand-new name is a phishing signal. Price… |
domain_dns | A, AAAA, MX, NS, TXT and other records for a domain, with resolve timing. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data.records keyed by record type (A, AAAA, MX, NS, TXT, ...); data.data.responseTime. |
domain_dnssec | Whether DNSSEC is signed and validates for a domain. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data: isSigned, isValid, validationStatus, chainOfTrust, dsRecords, dnskeyRecords, errors, warnings, recommendations. |
domain_email_auth | SPF, DKIM and DMARC records and posture for a domain. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data: spf, dkim, dmarc, mx, overallScore, overallStatus, recommendations. |
domain_profile | Everything about a domain in one call: DNS, WHOIS, TLS, DNSSEC, email auth, security score, blacklist status, plus IP intelligence for its A record. Price $0.025 per call. Free sample: {"domain": "example.com"}. Returns: data.sections.{dns,whois,tls,dnssec,email-auth,security-score,blacklist,ip}… |
domain_security_score | A letter grade and point score for a domain security posture, with the scored items behind it. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data: grade, overallScore, maxPossibleScore, categories[] of scored items. |
domain_tls | Certificate validity, issuer, protocol and days until expiry for a domain. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data: valid, issuer, subject, subjectAltNames, validFrom, validTo, daysUntilExpiry, protocol, cipher, selfSigned. |
domain_trust | Should an agent click, sign in to, or pay this domain? A risk score and verdict (likely_safe / caution / high_risk, or inconclusive when a check could not run) with plain-English reasons, from domain age, spam/abuse blocklists and the HTTPS certificate. Price $0.020 per call. Free sample… |
domain_whois | Registrar, creation and expiry dates, nameservers and status codes for a domain. Price $0.005 per call. Free sample: {"domain": "example.com"}. Returns: data.data.data: the parsed WHOIS/RDAP record (registrar, dates, nameservers, status). |
ip_lookup | Network owner (ASN), company, geolocation, privacy flags and abuse contact for an IP address. Price $0.005 per call. Free sample: {"ip": "1.1.1.1"}. Returns: data.data: ip, hostname, city, region, country, asn, company, privacy, carrier, abuse. |
page_watch | Has this page changed since your last call, and how much? The first call stores a baseline; later calls return a text diff (2% threshold). Price $0.005 per call. Free sample: {"url": "https://example.com"}. Returns: data with baseline, changed, change_pct, added, removed, last_change_ts. |
read_url | Read a web page as clean markdown, with the URL pre-flight verdict attached (and a viewport screenshot on request). Honors robots.txt for your user agent; flags text from risky sites as untrusted. Refunded if nothing can be read. Price $0.005 per call. Free sample: {"url": "https://example.com"}… |
site_screenshot | See a web page: a 1280-wide JPEG of any public URL, viewport or full page (capped at 6000 px), with its final URL, HTTP status and title. Price $0.020 per call. Free sample: {"url": "https://example.com"}. Returns: data: image_base64 (JPEG), mime, width, height, final_url, http_status, title… |
site_status | Live check of one or more URLs: HTTP status, latency, DNS resolve time, resolved IP, TTL, nameservers, TLS days remaining. Price $0.005 per call. Free sample: {"sites": ["https://example.com"]}. Returns: data keyed by URL; each entry has ok, code, ms, dns_ms, ip, ttl, ns, cert_days, server, ts. |
url_preflight | Check whether a URL is safe to fetch, read, sign in to, or pay — before you do. One verdict with plain reasons: domain age and newborn flag, lookalike of a top site, spam/abuse blocklists, HTTPS, robots.txt for your user agent, how our bot observatory sees your user agent, and the site's own x402… |
In its maker's words
Pay-per-call DNS, WHOIS, domain age, TLS, email auth, blocklists, IP intel. Free samples.
- Website
- how.is
- Publisher
- how.is
- Listed from
- the official MCP Registry as
is.how/domain-intel - Version
- 1.1.0, updated 19 Oct 2026
- Kinds of work
- Search and research, Domains and websites, Security and trust
The domain it lives on
- how.is
- its name does not resolve now
From our own crawl of domain names: registry records and the home page as our crawler last saw it.
Every call we made
| When | What happened | Time |
|---|---|---|
| Answered | 4914 ms | |
| Answered | 2961 ms | |
| Answered | 2047 ms |
Next door
Is this your bot? Claim its address to add a verified badge and keep the listing current.