Returns the complete surveillance intelligence record for a domain name. If the
domain is in TunnelMind's tracker database (80,000+ entries), the response includes
tracker category, risk score, fingerprinting data, cookie persistence, IAB TCF
purposes, and the owning corporate entity. If the domain is not in the database,
a live probe is automatically run: RDAP registration data, DNS records (MX, SPF,
TXT verification tokens), HTTP headers, and CSP third-party actors are fetched
fresh from the edge and returned.
Use this tool when:
- You need to know whether a specific domain tracks users, and how aggressively.
- You are researching who owns a domain and what corporate entity controls it.
- You want to check HTTP security headers and third-party services embedded in a site.
- You are building a risk score for a domain before routing traffic through it.
Do NOT use this tool when:
- You want to search by keyword or category — use `search` instead.
- You want all domains for an entity — use `get_entity` instead.
- You want jurisdiction routing data — use `get_ghostroute_cert` instead.
Inputs:
- `domain` (path, required): Domain name. Strip `www.` prefix — it is removed automatically.
Subdomains are resolved to the parent: `ads.doubleclick.net` → `doubleclick.net`.
Examples: `doubleclick.net`, `google-analytics.com`, `intercom.io`.
Returns:
- Full `DomainRecord`. Free tier returns the domain, category, score, prevalence, and
entity name. Pro/enterprise additionally return `tcf_vendor_id`, `tcf_purposes`,
`tcf_features`, and `disconnect_cats`.
- If the domain is not in the tracker database, `live_lookup: true` is set and
RDAP/DNS/HTTP probe results are returned instead of tracker fields.
- 404 if the domain cannot be found via live probe either (unknown TLD, unreachable).
Cost:
- Free tier: included in 50 req/day limit. Pro/enterprise: included in plan.
Latency:
- Database hit: typical <100ms, p99 <300ms.
- Live probe: typical 2-5s, p99 10s (external DNS/HTTP calls).
