Every alert, proxy log line and email link resolves to a domain — and the first question is always: what is this domain? We answer it three ways at once: content category, domain age, and technology stack. Served from a 102M-domain offline database inside your perimeter, with a real-time API for anything the attacker registered last night.
Phishing kits, C2 staging and credential-harvesting pages overwhelmingly live on domains that are brand new or too obscure for reputation feeds. Attackers select for the gap — and the analyst triaging the alert gets a bare hostname with no context.
Phishing campaigns burn domains within days of registration — live before any blocklist update ships. Registration age is one of the strongest cheap predictors, but only if queryable at triage time.
A fake bank login reads like banking; a fake parcel notice reads like logistics. When a two-week-old domain classifies as Finance or Shipping, that mismatch is itself the detection.
A SIEM rule fires on an outbound connection and the analyst gets a hostname. Category, age, infrastructure — every answer is a manual pivot across WHOIS, crawlers and search.
Sending every visited domain to a third-party cloud API is a data-egress problem. Browsing telemetry is sensitive, and regulated environments often cannot ship it out at all.
Category answers what the site claims to be, domain age answers how long it has existed, and the technology stack answers what it is built on. Joined on one domain key, they triage most alerts automatically.
Write allow/block policy in categories, not hostname lists.
Flag newly registered and recently reactivated domains in bulk.
Reveal what a site runs — CMS, frameworks, CDNs, analytics.
Load the 102M-domain database into your SIEM or data lake.
A proxy alert fires on an outbound request. The enrichment job checks the local database first, calls the API for unknowns, and attaches category, age and tech stack before an analyst opens the ticket.
import requests
BASE = "https://www.websitecategorizationapi.com"
def enrich(alert):
domain = alert["dest_domain"]
# Local first: 102M-domain offline DB inside the perimeter
intel = local_db.get(domain)
if intel is None: # unknown tail -> real-time API
cat = requests.post(
f"{BASE}/api/iab/iab_web_content_filtering.php",
data={"query": f"https://{domain}",
"api_key": API_KEY, "data_type": "url"},
timeout=30,
).json()
intel = {"category": cat["classification"][0]}
alert["enrichment"] = {
"category": intel["category"],
"age_days": domain_age(domain), # domain-age DB
"tech": tech_stack(domain), # technology DB
}
if (alert["enrichment"]["age_days"] < 30
and intel["category"]["category"] in
{"Finance", "Shipping & Logistics"}):
alert["verdict"] = "ESCALATE: young lookalike domain"
return alert
{
"alert_id": "SIEM-2026-071233",
"dest_domain": "secure-payportal-verify.example",
"enrichment": {
"category": {"category": "Finance", "confidence": 0.91},
"age_days": 11,
"tech": ["nginx", "Cloudflare", "jQuery"]
},
"verdict": "ESCALATE: young lookalike domain"
}
An eleven-day-old "Finance" site on throwaway infrastructure is a phishing profile — the rule that catches it is two lines of code.
The same fingerprint (nginx + Cloudflare + jQuery, no CMS) can be hunted across the technology database to surface sibling domains from the same kit.
Category from the database or API, age from the domain-age dataset, action from policy. Most SOCs converge on a matrix like this:
| Category signal | Domain age | Reading | Action |
|---|---|---|---|
| Malware / phishing-adjacent | Any | Known-bad content class | BLOCK |
| Finance, logistics, webmail lookalike | < 30 days | Classic phishing profile | ESCALATE |
| Uncategorized / unreachable | < 30 days | No history, no content record | ESCALATE |
| Uncategorized | > 1 year | Obscure but established | REVIEW |
| Business, education, news | > 2 years | Established, consistent identity | ALLOW |
Run the same matrix on URLs extracted from inbound mail before delivery.
Apply it across candidate IOC lists during campaign analysis.
All three datasets share the domain key, so the joins are identical at every insertion point.
No — it is the context layer feeds don't provide. Reputation feeds tell you a domain is already known-bad; we tell you what any domain is: its content category, age and technology stack. That context turns an unknown into a decision, and it composes with whatever TI feeds you already run.
Yes. The 102M-domain database, domain-age data and technology data all deploy locally, so air-gapped and regulated environments never send a hostname outside. The real-time API is an optional overlay for the newest domains.
That is what the real-time path is for: the API fetches and classifies the live page on demand, and the domain age checker confirms registration recency. New-domain plus lookalike-category is precisely the combination the offline snapshot alone would miss.
Send us a de-identified list of alerted domains and get back category, age and technology enrichment for each — the same joins your SIEM would run against the offline datasets.
Try the Live Demo Request a Sample Read the API Docs