OrionCMD Checks: Prepaid domain threat watch: up to 25 domains for 30 days, webhook alerts. Pay once; each domain is re-checked about once a day for 30 days. You get an HMAC-signed JSON POST at your https webhook_url (event watch.changed) when a domain or its IPv4 appears in (or leaves) ThreatCluster's high-confidence IOC feed, when a new ransomware leak-site claim names it, when its A/NS/MX records change, or when registration expiry changes or falls within 30 days. A watch.created POST is sent

Payment Options