{"name":"phishing-domain-triage","description":"Phishing domain triage API / suspicious domain age and registrar risk check. Same RDAP backend as whois-lookup, surfaced for security agents screening newly registered lookalike domains, DNSSEC status, expiration, registrar, and EPP lock flags.","price":"$0.02","method":"POST","input_schema":{"properties":{"domain":{"type":"string","description":"Apex domain to look up (e.g. 'example.com'). Subdomains are stripped to the registrable domain before query."},"include_certificates":{"type":"boolean","description":"If true, fetch a crt.sh certificate-transparency summary (issuer counts, first/last seen, total certs). Default false."}},"required":["domain"]},"input_example":{"domain":"paypal.com","include_certificates":true},"output_example":{"domain":"paypal.com","age_days":9490,"flags":[],"cert_summary":null},"x402_payment_required":true,"x402_facilitator":"https://api.cdp.coinbase.com/platform/v2/x402"}