# Related domains API

Bewary's related domains API, `GET /v1/domain/{host}/related`, returns domains sharing an IP address, a /24 or an ASN, name servers from hourly DNS history, a certificate, a registrar and a registration time, a page template or a tracking id in Bewary's data. Each related domain comes with all its relations, each relation's strength (`strong`, `medium` or `weak`) and the related domain's own `verdict`. CDNs, big hosting, parking and DNS providers appear in `pivots` with the reason and are not followed. A call costs 5 credits, a free key gets 1,000 credits a month, no card.

Updated 2026-10-30.

## At a glance

- Endpoint: GET https://api.bewary.app/v1/domain/{host}/related
- Price: 5 credits
- Free key: 1,000 credits a month, no card
- Returns: verdict, p_scam, entities with typed facts, reason codes
- MCP tool: related_domains

## Used for

- Analysts query a reported phishing domain for domains sharing its IP address or name servers in Bewary's data.
- Analysts find related domains sharing an impersonation domain's page template and check each `verdict` before acting.
- Analysts weigh certificate matches, relation strengths and each `verdict` before blocking a domain.

## Call it

curl:

```bash
curl "https://api.bewary.app/v1/domain/paypal-login-secure.top/related" \
  -H "Authorization: Bearer $BEWARY_API_KEY"
```

Python:

```python
import os
import requests

r = requests.get("https://api.bewary.app/v1/domain/paypal-login-secure.top/related", headers={"Authorization": f"Bearer {os.environ['BEWARY_API_KEY']}"}, timeout=10)
result = r.json()
print(result["verdict"], result["p_scam"], result["reason_codes"])
```

JavaScript:

```javascript
const res = await fetch("https://api.bewary.app/v1/domain/paypal-login-secure.top/related", {
  headers: { Authorization: `Bearer ${process.env.BEWARY_API_KEY}` },
})
const result = await res.json()
console.log(result.verdict, result.p_scam, result.reason_codes)
```

## Act on the result

Python:

```python
import os, requests

def campaign_neighbours(domain):
    r = requests.get(f"https://api.bewary.app/v1/domain/{domain}/related",
                     params={"per_page": 50},
                     headers={"Authorization": f"Bearer {os.environ['BEWARY_API_KEY']}"}, timeout=20)
    r.raise_for_status()
    return [d["domain"] for d in r.json()["related"]
            if d["strength"] == "strong" and d["verdict"] in ("scam", "suspicious")]

print(campaign_neighbours("paypal-login-secure.top"))
```

TypeScript, with the types from https://bewary.app/types/bewary.d.ts:

```typescript
import type { RelatedResponse } from "./bewary"

export async function campaignNeighbours(domain: string): Promise<string[]> {
  const res = await fetch(`https://api.bewary.app/v1/domain/${encodeURIComponent(domain)}/related?per_page=50`,
    { headers: { Authorization: `Bearer ${process.env.BEWARY_API_KEY}` }, signal: AbortSignal.timeout(20_000) })
  if (!res.ok) throw new Error(`Bewary ${res.status}`)
  const r: RelatedResponse = await res.json()
  return r.related.filter((d) => d.strength === "strong" && (d.verdict === "scam" || d.verdict === "suspicious")).map((d) => d.domain)
}
```

## The fields you will use

- `related[]`: This page of related domains, strongest first, each with its verdict and relations.
- `related[].strength`: strong: few domains share it and both held it at the same time. weak: a /24, an ASN or a value many share.
- `pivots[]`: Every value considered, with used, and why one was excluded (cdn, shared, parking and more).
- `campaigns[]`: Kits this domain is part of: one page template or tracking id shown by two or more listed domains.

## Response type

From https://bewary.app/types/bewary.d.ts:

```typescript





```

## Parameters

| Name | In | Type | Required | Description |
|---|---|---|---|---|
| `host` | path | string | yes | The domain or hostname, e.g. paypal-login-secure.top. |
| `page` | query | integer | no | 1 and up. Default `1`. |
| `per_page` | query | integer | no | Related domains a page, at most 50. Default `25`. |

## Questions

### How do I find domains on the same IP or name servers?

`GET /v1/domain/{host}/related` returns domains sharing an IP address or name servers in Bewary's data. Each related domain includes its relations, their strengths and its own `verdict`.

### Does a shared CDN address link every domain on it?

No. Bewary lists shared CDN, big hosting, parking and DNS provider infrastructure in `pivots[]` with the reason and does not follow those pivots.

### How much does the related domains API cost?

Each page costs 5 credits and returns up to 50 related domains. An API key is required.