Internet Infrastructure Data, API First

Raw Internet Data.
Ready to Plug Into
Your Stack.

Domain registrations, DNS records, and SSL/TLS certificate streams delivered as structured JSON via REST API. Whether you are building a security product, running an enterprise SOC, or developing in-house threat intelligence tooling, CodePunch gives you the raw data layer to power it.

No contracts  ·  Cancel anytime  ·  Active since 2017

240M+

gTLD domains monitored

12M+

Domain changes per day

10M+

SSL certs tracked / day

8yr

In production

Who Uses CodePunch

Built for teams that build.

CodePunch is a data provider, not an end product. Our customers use the feeds as a raw ingredient inside their own systems.

Security Product Vendors

Enrich your platform with internet-wide domain and certificate data

Threat intelligence platforms, brand monitoring SaaS, and OSINT tools ingest CodePunch feeds directly into their own data pipelines. gTLD coverage comes from zone file processing with over 240 million domains monitored and 10 to 12 million changes surfaced daily. ccTLD activity, where zone files are not publicly available, is tracked through SSL certificate generation data. No collection infrastructure to build or maintain on your end.

Enterprise Security Teams

Feed your SOC and threat intelligence workflows directly

Large organisations running in-house security operations use the API to monitor for lookalike domains, track certificate issuance for their assets, and query DNS infrastructure as part of incident investigation workflows. Integrates directly into SIEM platforms, internal dashboards, and automated alerting pipelines.

Corporate Software Divisions

Build internal security tooling without collecting the data yourself

Companies with an internal software or engineering team use CodePunch to power proprietary security tools including domain watchlists, certificate expiry monitors, and DNS change detection systems, without the overhead of running their own zone file processing or certificate transparency log ingestion. The data is ready. You just build on top.

Integration First

Designed to plug into your existing pipeline.

A straightforward REST API returning consistent JSON. No proprietary SDKs, no vendor lock-in. Fits naturally into any data ingestion pipeline, SIEM integration, or internal tooling stack.

Key-based auth, one header, any HTTP client

Consistent, predictable JSON response schema

Paginated results for bulk data ingestion

Daily feed updates from zone file processing

Read the API docs

api.codepunch.com: Domain Feed v2

# Step 1: Authenticate with your key and secret
GET https://api.codepunch.com/dnfeed/v2
    /auth/{YOUR_API_KEY}/{YOUR_API_SECRET}

# Response
{ "status": true, "token": "a1b2c3d4e5f6..." }

─────────────────────────────────────────────

# Step 2: Query today's added .com domains
# containing the keyword "bank"
GET https://api.codepunch.com/dnfeed/v2
    /a1b2c3d4e5f6/added
    ?kw=bank&tlds=com&limit=500

# Response
{
  "status":  true,
  "records": 4821,
  "data": [
    {
      "domain": "secure-yourbank-login.com",
      "tld":    "com",
      "date":   "2026-04-24",
      "idn":    0
    }
  ]
}
Pricing

Simple, transparent pricing

Single-user licenses. No setup fees. Cancel any time.

Domain Activity

$25 / mo
  • Daily added gTLD domains
  • Daily deleted gTLD domains
  • Keyword monitoring
Get started

DNS & Subdomains

$30 / mo
  • Everything in Domain Activity
  • DNS record lookups
  • Subdomain enumeration
Get started

Network Bundle

$80 / mo
  • All data feeds included
  • Domain + DNS + SSL/TLS
  • Best value for teams
Get started

SSL/TLS Certs

$50 / mo
  • Real-time cert stream
  • 90-day search history
  • Subject & SAN filtering
Get started
See full pricing & feature comparison

Annual billing saves 20%  ·  Contact us for multi-user and enterprise licences