What you can do
Favicon-hash pivot
Give a domain → get its favicon SHA-256 and every other domain serving the same icon — the classic favicon-hash pivot for mapping shared infrastructure across the open web.
Domain enrichment
Resolve a domain to its hosting org/ASN, region, IPs, MX and CNAME — with an ASN-popularity score so you can tell WordPress.com from a one-off box.
Subdomain enumeration
Give an apex → get every host we've seen under it (including DNS-discovered names never crawled as pages), each with its primary IP. A free crt.sh-style map of the attack surface.
curl -H "X-API-Key: YOUR_KEY" \
"https://cl0q.com/api/favicon?domain=github.com"
{ "domain":"github.com", "sha256":"2ee43237…",
"also_used_by_total": 26,
"also_used_by": ["gist.github.com","cli.github.com", …] }
Pricing
Billing isn't live yet — during beta every tier is free. Grab a key now; paid plans (and higher limits) plug into the same key when they launch.
Get notified when Pro launches
Billing isn’t live yet. Leave your email and we’ll tell you the day it is — and telling us what you’d build genuinely shapes what ships first. Nothing else; no drip campaign.
Prefer email? cl0qsearch@gmail.com. We store just your address and note — see the privacy policy.
Get your free key
API keys are tied to your free cl0q account — passkey sign-in, no password, no email. Create an account (or sign in) and mint a key in seconds.
Already searching fast? Search keeps working without a key — this is for the programmatic API and full-dataset exports.
Your new API key (free tier · 30/min · 1,000/day):
Save this now — it won't be shown again.
Docs
Authentication
Send your key as the X-API-Key header (or ?key= query param) on every request.
Endpoints — key required
GET /api/favicon?domain=<domain> → that domain's favicon hash + who else uses it GET /api/favicon?hash=<hex sha256> → every domain serving that icon (?limit=, max 1000) GET /api/subdomains?domain=<apex> → every host seen under that apex + its IP (?limit=, max 1000) GET /api/domain/<host> → full crawl profile: title, DNS, ASN, latency, favicon hash
Data API — free, no key
Aggregate and facet data behind explore. Served from precomputed snapshots, so it costs no query budget — free, IP rate-limited only.
GET /api/stats → index totals, crawl velocity, top distributions GET /api/facets → every drill-down key you can query (start here) GET /api/tld/<tld> → per-TLD profile e.g. /api/tld/io GET /api/country/<cc> → per-country profile e.g. /api/country/de GET /api/tech/<server> → per-server profile e.g. /api/tech/nginx GET /api/lang/<code> → per-language profile e.g. /api/lang/de GET /api/cross/<kind>/<key> → a drill-down's TLDs / countries / languages / servers / networks
Browse API — every domain behind a drill-down
Filterable, paginated lists of the live sites on a network, TLD, country, language, server family or shared favicon — the lists on the explore pages. The first 150 rows of each list are free without a key; an API key pages through all of them.
GET /api/browse/asn/13335?country=de&lang=de → Cloudflare-hosted, German-language sites
GET /api/browse/tld/io?tech=vercel&apex=1 → .io apex domains served by Vercel
GET /api/browse/favicon/<sha256> → every site sharing one favicon (A→Z)
follow "next" until it is null
Limits
Free tier: 30 requests/minute, 1,000/day on keyed endpoints. Responses include X-RateLimit-Limit / X-RateLimit-Remaining; 429 with Retry-After when exceeded. The Data API needs no key.
Full reference with response shapes: Data API · Browse API.