Related domains API

Bewary's related domains API, `GET /v1/domain/{host}/related`, returns domains sharing an IP address, a /24 or an ASN, name servers from hourly DNS history, a certificate, a registrar and a registration time, a page template or a tracking id in Bewary's data. Each related domain comes with all its relations, each relation's strength (`strong`, `medium` or `weak`) and the related domain's own `verdict`. CDNs, big hosting, parking and DNS providers appear in `pivots` with the reason and are not followed. A call costs 5 credits, a free key gets 1,000 credits a month, no card.

Endpoint

GEThttps://api.bewary.app/v1/domain/{host}/related

Price

5 credits

Free key

1,000 credits a month, no card

Returns

verdict, p_scam, entities with typed facts, reason codes

MCP tool

related_domains

Call it

curl "https://api.bewary.app/v1/domain/paypal-login-secure.top/related" \
  -H "Authorization: Bearer $BEWARY_API_KEY"

import os
import requests

r = requests.get("https://api.bewary.app/v1/domain/paypal-login-secure.top/related", headers={"Authorization": f"Bearer {os.environ['BEWARY_API_KEY']}"}, timeout=10)
result = r.json()
print(result["verdict"], result["p_scam"], result["reason_codes"])

const res = await fetch("https://api.bewary.app/v1/domain/paypal-login-secure.top/related", {
  headers: { Authorization: `Bearer ${process.env.BEWARY_API_KEY}` },
})
const result = await res.json()
console.log(result.verdict, result.p_scam, result.reason_codes)

Act on the result

Copy-paste code that turns the answer into a decision. It runs with or without BEWARY_API_KEY. TypeScript uses bewary.d.ts.

import os, requests

def campaign_neighbours(domain):
    r = requests.get(f"https://api.bewary.app/v1/domain/{domain}/related",
                     params={"per_page": 50},
                     headers={"Authorization": f"Bearer {os.environ['BEWARY_API_KEY']}"}, timeout=20)
    r.raise_for_status()
    return [d["domain"] for d in r.json()["related"]
            if d["strength"] == "strong" and d["verdict"] in ("scam", "suspicious")]

print(campaign_neighbours("paypal-login-secure.top"))

import type { RelatedResponse } from "./bewary"

export async function campaignNeighbours(domain: string): Promise<string[]> {
  const res = await fetch(`https://api.bewary.app/v1/domain/${encodeURIComponent(domain)}/related?per_page=50`,
    { headers: { Authorization: `Bearer ${process.env.BEWARY_API_KEY}` }, signal: AbortSignal.timeout(20_000) })
  if (!res.ok) throw new Error(`Bewary ${res.status}`)
  const r: RelatedResponse = await res.json()
  return r.related.filter((d) => d.strength === "strong" && (d.verdict === "scam" || d.verdict === "suspicious")).map((d) => d.domain)
}

Response

The fields you will use

related[]

This page of related domains, strongest first, each with its verdict and relations.

related[].strength

strong: few domains share it and both held it at the same time. weak: a /24, an ASN or a value many share.

pivots[]

Every value considered, with used, and why one was excluded (cdn, shared, parking and more).

campaigns[]

Kits this domain is part of: one page template or tracking id shown by two or more listed domains.

The same typed answer as a message check, with input.kind set to screenshot: see Response format.

Parameters

Questions

Used for

• Analysts query a reported phishing domain for domains sharing its IP address or name servers in Bewary's data.
• Analysts find related domains sharing an impersonation domain's page template and check each `verdict` before acting.
• Analysts weigh certificate matches, relation strengths and each `verdict` before blocking a domain.

Updated October 30, 2026 · This page as Markdown · Changelog