FEATURE STORE / ANNOTATIONS

One API.
Every feature
your model needs.

Extract WHOIS, passive DNS, certificate, content, and brand intelligence features from a single endpoint. The same feature schema at training time and inference time — so your model never sees a distribution shift between environments.

Get API key See all features
Python · Feature extraction
import httpx

client = httpx.Client(
    base_url="https://api.preintel.ai",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
)

# Pull features for training
resp = client.get("/v1/features/domain/paypal-secure-login.xyz")
features = resp.json()
# {
#   "domain": "paypal-secure-login.xyz",
#   "brand_similarity": 0.94,
#   "squatting_type": "combo",
#   "domain_age_days": 3,
#   "pdns_ip_count": 1,
#   "cert_issuer": "Let's Encrypt",
#   "whois_registrar": "NameCheap",
#   "whois_privacy": true,
#   ...
# }

# Same API at inference time — no feature drift
label = my_model.predict([features])
Train and infer on the same schema
Call the same API at model training time and production inference time. Eliminates the feature drift that causes accuracy drops between offline and online environments.
P50 latency under 80ms
Features are pre-computed and cached with write-through updates on new DNS/WHOIS/cert events. Real-time lookups fall back to live resolution with a cache-miss SLA of 500ms.
Domain intelligence included
Our original domain monitoring capability — brand squatting, WHOIS, passive DNS, cert history — is available as one of the annotation types in the Feature Store.
AVAILABLE FEATURES

Five feature categories.
One coherent schema.

Domain Intelligence

Squatting variants, brand similarity scores, registration patterns, and passive DNS history.

GET /v1/features/domain/{domain}
  • Brand squatting variants (typo, homograph, combo)
  • Similarity score vs registered trademark
  • Passive DNS resolution history
  • Domain age and registration trajectory
WHOIS

Registration metadata, registrar reputation, privacy shield usage, and historical WHOIS diff.

GET /v1/features/whois/{domain}
  • Registrar name and reputation score
  • Registration age, expiry countdown
  • Privacy shield / WHOIS redaction flag
  • Historical registrant changes
Passive DNS

IP resolution history, geolocation spread, ASN diversity, and co-hosted domain clusters.

GET /v1/features/pdns/{domain}
  • IP resolution history (first/last seen)
  • Country and ASN diversity across resolutions
  • Hosting provider fingerprint
  • Co-hosted domain cluster size
Certificates

Certificate transparency log data: issuer reputation, SAN count, validity window, and DV vs OV/EV.

GET /v1/features/cert/{domain}
  • Certificate issuer and CA reputation
  • SAN domain count and wildcard usage
  • Validity duration and days-until-expiry
  • DV / OV / EV classification
Page Content

URL lexical features, page structure hash, redirect chain depth, and brand impersonation signals.

GET /v1/features/content/{url}
  • URL lexical features (length, entropy, keyword count)
  • Redirect chain depth and final destination
  • Page structure and logo similarity hash
  • Form presence and input field patterns
Batch Extraction

Submit up to 10,000 domains in a single request. Returns a Parquet or JSON Lines file for your training pipeline.

POST /v1/features/batch
  • Up to 10K domains per batch
  • All feature types in a single payload
  • Async job with webhook or polling
  • Output: Parquet, JSON Lines, or CSV
TRY IT NOW

Scan a domain and see
the raw features.

Our domain scanner calls the Feature Store API under the hood. Scan any domain and see the JSON feature payload you'd get from the API — DNS, WHOIS, cert, brand squatting scores included.

Open Scanner Get API key