Bewary is a WhoisXML API alternative for scam checks

At a glance

WhoisXML API provides registration and domain intelligence APIs

WhoisXML API's WHOIS API page describes a registration-record lookup for a domain name, IP address or email address. The response is the registration (WHOIS) record for that input.

Its documented products separate registration lookup, ownership research, domain availability, reputation and threat intelligence into different APIs. Its official MCP server also exposes WHOIS, DNS, IP, threat intelligence and email tools.

Bewary returns scam verdicts and typed evidence

Bewary is a scam detection API and MCP server for apps and AI agents. It looks up links, domains, IP addresses, phone numbers, SMS short codes, email addresses, crypto wallets, IBANs, mobile apps and payment handles.

Each check returns a typed JSON envelope containing verdict, p_scam, reason_codes and classification. Its entities contain typed facts and the datasets checked. Its signals identify the source class, weight, dataset and coverage.

POST /v1/batch accepts up to 1,000 values in a request and costs 1 credit per item. Each result uses the same envelope as a single lookup.

The verdict is scam, suspicious, safe or unknown. An unknown answer means the evidence was insufficient or a source failed. Your app should never treat it as safe.

p_scam is a probability from 0 to 1 that is not yet calibrated against labelled data. The domain field site.p_scam_site has a separate calibration based on labelled hosts.

Bewary's responses follow contract version 1.16.0. Within /v1, changes only add fields, enum values and reason codes. Existing fields are never renamed or removed.

The remote MCP server at https://api.bewary.app/mcp runs the same code as REST. Its tools return structured answers with outputSchema and structuredContent for Claude, ChatGPT, Cursor, VS Code and other MCP clients.

WhoisXML API offers registration lookup, reverse WHOIS, domain availability and threat intelligence

WhoisXML API's WHOIS API page, as read on November 12, 2026, claims 374 million+ active domains tracked and 28.7 billion+ WHOIS records.

Its Reverse WHOIS API accepts an owner's name, email, phone or postal address and returns linked domains. Its Domain Availability API answers whether a domain can be registered.

Its Threat Intelligence API accepts domains, URLs, IP addresses, CIDR ranges and file hashes. The documented response includes threat type and first- and last-seen dates. Its pages name server logs, honeypots, OSINT and ISP abuse reports as sources.

Its Domain Reputation API evaluates hundreds of parameters for a domain or IP and returns a reputation score. Its Newly Registered Domains page describes about 450,000 newly registered or newly discovered domains a day from 2.5 million daily domain events, with WHOIS data.

WhoisXML API's official MCP page lists 35 tools. The WHOIS API accepts a personal API key or a server-to-server OAuth token. WhoisXML API's GitHub organization publishes official clients, including a Python WHOIS API client.

Bewary differs in identifier coverage and decision evidence

Bewary accepts phone numbers, SMS short codes, crypto wallets, IBANs, mobile apps and payment handles in addition to domain, IP and email lookups. WhoisXML API's documented WHOIS API inputs are domain names, IP addresses and email addresses.

Bewary's reason_codes identify the reasons that decided the verdict, strongest first. Codes are added and never renamed, so your app can store them and branch on them. Lookups use no language model, and the answer is always Bewary's own verdict.

The domain age API reads registration dates, expiry dates and registrars from RDAP. It also checks brand imitation, TLD scam use and scam list membership. A domain under 30 days old raises risk, but age alone never makes it suspicious.

A domain aged 30 to 90 days raises risk less than a domain under 30 days. From 90 days to a year, age counts a little in the domain's favor, and over a year it counts strongly in its favor. A domain on vercel.app, github.io or sites.google.com gets no credit for the shared platform's age.

Bewary reads newly published TLS certificates from certificate transparency logs and checks brand-lookalike candidates again over three days. On November 6, 2026, its scam list held 715,887 active domains. The dataset catalog at GET /v1/datasets exposes dataset geography, entity coverage and active entry counts.

A lookup keeps no record of who asked. Bewary can add the checked value to its datasets. A looked-up domain is queued for its web-archive history, and a looked-up app is recorded as seen on its store. Bewary stores API keys as SHA-256 hashes.

Free tier, rate limits and commercial use terms

The WhoisXML API WHOIS page, read November 12, 2026, offers 500 free requests on signup without a credit card. Bewary's free API key provides 1,000 credits a month without a card. A standard Bewary lookup costs 1 credit.

The WhoisXML API limits page permits up to 200 WHOIS API requests a second. Bewary permits 600 requests a minute with a key. Its browser checkers provide 10 checks a day per visitor without a key.

WhoisXML API's MCP page says the server itself is free and tool calls spend ordinary API credits. Each Bewary MCP tool call spends the same credits as its REST endpoint.

WhoisXML API's standard terms restrict data to internal use and prohibit passing it to third parties. A commercial product or service requires a separate Master Service Agreement. AI model training, testing or development requires written permission.

API volume pricing

As of the November 12, 2026 reading, the WHOIS API pricing page lists one-time packs at $50 for 2,000 queries, $105 for 5,000 and $180 for 10,000. Monthly subscriptions cost $30 for 2,000 queries a month, $60 for 5,000 and $100 for 10,000.

Bewary sells prepaid packs without a subscription. The packs cost $20 for 10,000 credits, $100 for 60,000, $500 for 375,000 and $2,000 for 2,000,000. Prepaid credits never expire.

10,000 WHOIS queries cost $180 one-time or $100 a month, and 10,000 standard Bewary domain lookups cost $20 in prepaid credits at 1 credit each.

The WXA.ONE pricing page lists shared-pool tiers above its entry tier at $449, $999, $1,899 and $2,999 a month. Its Pro tier lists 87,250 credits a month and a WHOIS API credit cost of $0.005146.

Other WhoisXML API pricing pages list Reverse WHOIS from $19 a month for 1,000 calls, Domain Availability from $9 a month for 1,000 queries, and Threat Intelligence from $79 a month for 5,000 queries.

The Newly Registered Domains pricing page lists $499 and $999 a month for its first two plans. Its other three plans are custom-priced. Fixed prices for those plans are not published.

Moving a domain registration check to Bewary changes the response

WhoisXML API's WHOIS API takes a domain name and returns its registration (WHOIS) record.

The corresponding Bewary operation is GET https://api.bewary.app/v1/domain/{host} with an API key. It costs 1 credit and returns the registration date, expiry date, registrar and age in days alongside the scam verdict and evidence.

The registration date, expiry date and registrar sit in the domain entity's typed facts for display. Your code branches on verdict and reason_codes. The Bewary OpenAPI specification is at https://api.bewary.app/v1/openapi.json, and published TypeScript types and Python models are at bewary.app/types.

Some registries, including Germany's .de, publish no registration date through RDAP. Bewary then reports an unknown age, which counts neither for nor against the domain. A missing date must remain distinct from a newly registered domain.

Get an API key

Both APIs can serve different checks in one app

An app can use WhoisXML API's WHOIS API, Reverse WHOIS API or Domain Availability API alongside Bewary's scam checks.

For example, an app that checks a seller's contact points can use Bewary's assess operation. A separate ownership investigation can use WhoisXML API's documented Reverse WHOIS inputs. Review its commercial-use terms before incorporating the returned data into a customer-facing service.

Bewary's related-domains endpoint finds connections in its own domain records through shared infrastructure, certificates, registration details, page templates or tracking identifiers. Each returned domain includes its own verdict and every relation with a strong, medium or weak rating. CDNs, large hosting services, parking services and DNS providers appear in pivots with the reason they were excluded from further traversal.

Bewary and WhoisXML API both run official MCP servers. Bewary’s server has 15 tools, including lookup_domain, which returns the same typed JSON envelope as the REST API.

For continuing checks, Bewary watches domains, phone numbers, wallets and brands. Changes appear as events or signed webhooks. A watch costs 1 credit a day, with an additional 1 credit per brand-lookalike event.

Questions

Sources

1. whois.whoisxmlapi.comwhois.whoisxmlapi.com/
2. whois.whoisxmlapi.com: Pricingwhois.whoisxmlapi.com/pricing
3. reverse-whois.whoisxmlapi.com: Pricingreverse-whois.whoisxmlapi.com/api/pricing
4. domain-availability.whoisxmlapi.com: Pricingdomain-availability.whoisxmlapi.com/api/pricing
5. threat-intelligence.whoisxmlapi.com: Pricingthreat-intelligence.whoisxmlapi.com/api/pricing
6. main.whoisxmlapi.com: Pricingmain.whoisxmlapi.com/wxa-one/pricing
7. reverse-whois.whoisxmlapi.com: Apireverse-whois.whoisxmlapi.com/api
8. domain-availability.whoisxmlapi.com: Making requestsdomain-availability.whoisxmlapi.com/api/documentation/making-requests
9. threat-intelligence.whoisxmlapi.com: Apithreat-intelligence.whoisxmlapi.com/api
10. domain-reputation.whoisxmlapi.com: Making requestsdomain-reputation.whoisxmlapi.com/api/documentation/making-requests
11. newly-registered-domains.whoisxmlapi.comnewly-registered-domains.whoisxmlapi.com/
12. newly-registered-domains.whoisxmlapi.com: Pricingnewly-registered-domains.whoisxmlapi.com/pricing
13. main.whoisxmlapi.com: Terms of servicemain.whoisxmlapi.com/terms-of-service
14. whois.whoisxmlapi.com: Limitswhois.whoisxmlapi.com/documentation/limits
15. whois.whoisxmlapi.com: Making requestswhois.whoisxmlapi.com/documentation/making-requests
16. main.whoisxmlapi.com: Mcp servermain.whoisxmlapi.com/ai/mcp-server
17. github.com: Whois api pygithub.com/whois-api-llc/whois-api-py