WHOIS / RDAP / DNS / network / Web3 lookup
lookup_targetLook up one domain, IP address, CIDR block, ASN (AS15169) or Web3 name (ENS .eth, Unstoppable, SPACE ID .bnb, Handshake hns:) and get a compact fact sheet. Domains: registrar, dates, status, nameservers, DNS records, overall mail-security grade, third-party services seen in DNS, possibly dangling records. IPs, CIDRs and ASNs: network owner, origin AS, RIR, cloud / CDN provider, Tor or iCloud Private Relay tag, geolocation, abuse contact, local reputation. Web3 names: registration status, addresses, records. A look-alike warning is added when the name uses deceptive letters.
Use it first for any question about who owns, runs, hosts or registered something. Prefer check_mail_security when you need each email check rather than the grade, and check_lookalike to screen many names without network calls.
Behavior: queries registries, DNS and (for Web3) blockchain RPC live, usually in 1-5 s, at most about 12 s. If one source fails, the rest is still returned and the failure is listed under errors. Reputation covers local blocklists only: no match is not a clean bill of health. Queries are not logged or stored. The result ends with details_url, the full page with every record and its provenance.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | what to look up: a domain (example.com, münchen.de), IPv4 / IPv6 address, CIDR (8.8.8.0/24), ASN written as AS15169 (a bare number is not an ASN), or a Web3 name (vitalik.eth, brad.crypto, spaceid.bnb, hns:name) | |
| namespace | No | optional; force a Web3 namespace (ens, unstoppable, spaceid or hns) when a name could belong to several, e.g. a TLD that is both an ICANN TLD and a Web3 namespace. Leave empty and the namespace is detected from the name |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| type | Yes | target type: domain, ipv4, ipv6, cidr, asn or web3_name | |
| cloud | No | cloud / CDN provider | |
| query | Yes | normalized query | |
| errors | No | provider failures; the rest of the result is still valid | |
| country | No | ||
| network | No | covering CIDR or network range | |
| warnings | No | look-alike, special-purpose and namespace-collision warnings | |
| addresses | No | Web3 addresses as network:address | |
| origin_as | No | origin AS number for an IP | |
| registrar | No | ||
| anonymizer | No | tor_exit or private_relay | |
| created_at | No | ||
| expires_at | No | ||
| reputation | No | verdict from local lists; absent when no list is loaded | |
| details_url | No | full result page | |
| nameservers | No | ||
| web3_status | No | ||
| availability | No | registered, available or unknown (domains and Web3 names) | |
| organization | No | ||
| mail_security | No | strong, fair, weak or no_mail |