WHOIS, RDAP, DNS, SSL, GeoIP, ASN, certificate transparency, subdomain enumeration, passive DNS, typosquat detection. One API. Built on public data sources, not paid feeds. Self-hostable when you can't send IPs offsite.
You got a suspicious URL. Pull WHOIS/RDAP, DNS records, certificate history from crt.sh, ASN, GeoIP, and IP reputation in one workflow. Output is structured JSON, drop into your SOAR.
Enumerate every subdomain from crt.sh, DNS brute, Common Crawl, and Wayback. Wildcard DNS detection. Then audit each subdomain's security headers and TLS config.
Generate every typosquat of your domain, resolve them, score which ones are real risks. Monitor certificate transparency for new certs issued for your brand. Phishing-domain detection without a vendor feed.
Validate SPF, DKIM, DMARC records. Check MX deliverability. Parse uploaded DMARC RUA reports. Verify single emails or batch up to 1,000 at a time.
Trace HTTP redirects across hostile redirect chains. Inspect TLS handshakes and cipher selection. Map ASN and BGP history of an IP. CDN detection from headers and CNAME analysis.
HSTS preload list checks. DNSSEC validation. Cookie audits for Secure, HttpOnly, SameSite. Subresource Integrity checks. Mixed-content detection. Reports ready for compliance review.
Security teams investigating internal IPs, customer domains, or pre-disclosure vulnerabilities often can't send queries to a third party. Run Ollagraph in your VPC. Same API, same MCP server, same 148 endpoints — all the data stays in your perimeter.
1,000 credits on signup. Domain & network intel catalog from day one.