Domain intelligence bundle: WHOIS + DNS + SSL + Certificate Transparency. One call, one JSON response, one x402 payment. Everything your agent needs to recon a domain.
Agents doing infrastructure recon need 3–4 separate lookups to understand a domain. RECON bundles them all into one call — WHOIS, DNS, SSL, and Certificate Transparency — and returns structured JSON. No scraping. No parsing. No wasted tokens.
Registrant info, registrar, creation/expiry dates, name servers, domain status. Uses RDAP first (modern, structured JSON), falls back to WHOIS CLI for edge-case TLDs.
A, AAAA, MX, NS, TXT, CNAME, SOA records via Cloudflare DNS-over-HTTPS. No local dig required. Consistent results from a trusted resolver.
Full certificate chain, issuer, expiry, SANs, protocol version. Direct TLS handshake — no third-party API. Paid tier adds extended chain verification.
Query crt.sh for all certificates ever issued for a domain. Discovers subdomains, tracks cert history, identifies infrastructure changes. Paid tier only.
All data comes from public sources. We aggregate, normalize, and cache it — so your agent gets consistent JSON instead of scraping registrar websites and parsing certificate logs.
Registration Data Access Protocol. The modern replacement for legacy WHOIS. Structured JSON from IANA-registered RDAP servers. Covers 90%+ of TLDs. Falls back to WHOIS CLI for edge cases.
DNS-over-HTTPS via 1.1.1.1. Encrypted, fast, reliable. Resolves all record types without requiring local dig. Consistent results from Cloudflare's global anycast network.
Python ssl module connects directly to the domain on port 443 and retrieves the full certificate chain. No third-party API. No rate limits. Always accurate.
Certificate Transparency log aggregator. PostgreSQL query interface. Discovers all subdomains that have ever had certificates issued. The gold standard for passive recon.
Get full domain intelligence: WHOIS + DNS + SSL + Certificate Transparency (paid).
curl "https://recon.4bots.ai/v1/free/recon?domain=example.com"
Example response:
{
"domain": "example.com",
"whois": {
"registrar": "RESERVED-Internet Assigned Numbers Authority",
"created": "1995-08-14",
"expires": null,
"status": ["clientTransferProhibited"],
"nameservers": ["a.iana-servers.net", "b.iana-servers.net"]
},
"dns": {
"A": ["93.184.216.34"],
"AAAA": ["2606:2800:220:1:248:1893:25c8:1946"],
"MX": [],
"TXT": [],
"NS": ["a.iana-servers.net", "b.iana-servers.net"]
},
"ssl": {
"issuer": "DigiCert Inc",
"expires": "2026-09-15",
"san": ["example.com", "www.example.com"],
"protocol": "TLS 1.3"
},
"cached": false,
"free_remaining": 9
}
Include a valid payment header for paid tier — adds Certificate Transparency logs and bulk lookup.
curl -H "PAYMENT-SIGNATURE: <base64-payload>" \ "https://recon.4bots.ai/v1/free/recon?domain=example.com"
Health check. Always free, always returns 200.
curl "https://recon.4bots.ai/health"
10 free lookups per day covers development and light agent workloads. Paid tier unlocks Certificate Transparency, subdomain enumeration, and bulk lookups.
No signup. No API key. Just send a request.
How x402 works