Robby Frank: How Robby Frank Built 1Lookup to $272,000/mo
How Robby Frank built 1Lookup into a $3.2M ARR data verification and domain intelligence engine for cybersecurity teams.
0-to-1 Playbook Blueprint
- Cybersecurity researcher and DNS telemetry crawler scripts
- Infrastructure engineering at network security firms
Robby Frank is the solo engineering genius behind 1Lookup, the threat intelligence, domain verification, and network telemetry API used by cybersecurity analysts and security operations center (SOC) teams worldwide. Operating completely alone from San Francisco, Robby built 1Lookup into an infrastructure titan generating over $272,000 per month ($3.2M ARR) with zero venture backing and zero full-time staff.
For decades, the threat intelligence and network data market was dominated by legacy enterprise monopolists who locked basic domain records, historical WHOIS data, and IP reputation scores behind predatory $30,000 annual contracts and mandatory phone calls with enterprise sales reps.
Robby had a revolutionary engineering thesis: βWhat if security researchers and developers could query billions of historical network records via a modern, lightning-fast self-serve API with sub-35ms response times?β
By replacing sluggish relational databases with a custom ClickHouse columnar engine paired with high-performance Rust network crawlers, Robby built a solo data utility that outperforms enterprise competitors at one-tenth the cost.
Here is the deep architectural breakdown of how Robby Frank scaled 1Lookup to $3.2M ARR.
The Venture Scorecard: Robby Frankβs Trajectory
| Phase | Milestone | Period | Scale / Outcome | Core Growth Driver |
|---|---|---|---|---|
| Security Research | Network Crawler Scripts | 2018 to 2019 | Mapped billions of global DNS records | Deep protocol engineering |
| 1Lookup MVP | Self-Serve API Launch | 2020 | Reached $10K MRR in 7 months | Free web lookup tools for developers |
| The ClickHouse Migration | Database Architectural Leap | 2021 to 2022 | Query speeds improved by 10x | Columnar storage migration |
| Enterprise Fleet Adoption | Security Operations Center (SOC) Deals | 2023 to 2024 | Crossed $1.5M ARR milestone | Transparent credit pools & high SLA |
| Solo Seven-Figure Titan | Global Threat Intelligence Standard | 2025 to 2026 | $3,200,000 ARR ($272K/mo MRR) | High net retention across 800+ tech firms |
1. Unbundling the Enterprise Data Cartels (2018-2020)
Before 1Lookup, if a cybersecurity analyst investigating a phishing attack wanted to see which domains shared an IP address or look up who owned a domain three years ago, they had to deal with legacy data cartels:
- Sales reps demanded 45-minute discovery calls before revealing pricing.
- Contracts required upfront annual commitments starting at $25,000.
- Legacy APIs had terrible latency, taking 1 to 2 seconds per query.
Robby spent 18 months writing high-concurrency Rust daemons that continuously indexed global DNS zones, SSL certificate transparency logs, WHOIS databases, and routing tables. He built an API where any developer could sign up with a credit card, get an API key in 10 seconds, and run 10,000 queries for $99/month.
2. The Architectural Breakthrough: Migrating to ClickHouse
In 1Lookupβs early days, Robby stored his data in standard MySQL and PostgreSQL databases. But as the dataset expanded beyond 5 billion historical records, query times began to degrade from 50ms to over 800ms.
Robby executed a daring architectural migration to ClickHouse, an open-source columnar database management system:
- Massive Data Compression: ClickHouse compressed his raw network telemetry by over 85%, cutting his storage hardware costs by four-fifths.
- Blazing Query Performance: Queries that previously took 800ms in PostgreSQL executed in under 18 milliseconds in ClickHouse!
By combining ClickHouse with Cloudflare Workers at the edge, 1Lookup became known as the fastest network verification API on the market, achieving a 99.99% retention rate among SOC analysts.
3. The Growth Engine: Free Developer Lookup Tools
1Lookupβs primary acquisition channel is a suite of free, lightning-fast web lookup utilities:
- Free Reverse IP Lookup
- Historical WHOIS Checker
- SSL Certificate History Inspector
- DNS Propagation Checker
These free tools require no account or credit card. They rank at the top of Google search results for technical queries, attracting over 500,000 monthly visits from security engineers and system administrators, a fraction of whom upgrade to the commercial API to automate lookups inside their security pipelines.
4. 1Lookup Pricing & Revenue Architecture
1Lookup utilizes a transparent credit-based API subscription model:
| Plan | Monthly Price | Monthly Lookups Included | Query Latency | Ideal Customer |
|---|---|---|---|---|
| Developer | $99/mo | 50,000 lookups | < 50ms | Independent security researchers |
| Pro | $249/mo | 200,000 lookups | < 35ms | Growth-stage tech startups & MSPs |
| Business | $499/mo | 1,000,000 lookups | < 25ms | SOC teams & automated threat pipelines |
| Dedicated Cluster | $2,500/mo | Unlimited / High Concurrency | Dedicated VPC | Fortune 500 cybersecurity operations |
5. Exact Technical Architecture & Infrastructure
Robby operates a global data infrastructure that processes hundreds of millions of monthly queries as a solo founder:
| Component | Technology | Purpose | Why Robby Selected It |
|---|---|---|---|
| Network Crawlers | Rust & Tokio | Asynchronous high-throughput DNS and SSL harvesting | Bare-metal performance, memory safety, and zero garbage collection pauses |
| Core Database | ClickHouse Clusters | Distributed columnar data storage | Sub-20ms aggregate analytical queries across 5B+ records |
| API Gateway | Python & FastAPI | Exposing REST endpoints and documentation | Fast async request routing and automatic OpenAPI spec generation |
| Edge Network | Cloudflare Workers & KV | Edge rate-limiting and global response caching | Prevents malicious API abuse and terminates SSL at edge |
| Billing Engine | Stripe Billing | Metered credit tracking and automated renewals | Reliable handling of enterprise corporate credit cards |
6. The 3 Tactical Rules for Bootstrapped Developers
Rule 1: Sub-50ms API Latency Is an Undefeatable Competitive Advantage
In API businesses, developers judge your quality by two metrics: uptime and response speed. If your API responds in 25ms while competitors take 500ms, developers will advocate passionately for your tool inside their organizations.
Rule 2: Unbundle Enterprise Cartels into Self-Serve APIs
Look for industries where enterprise salespeople gatekeep simple data behind 5-figure contracts. Build a self-serve API that provides 90% of the same utility with instant credit card checkout, and you will win thousands of underserved customers.
Rule 3: Leverage Modern Columnar Engines for Data Scale
Solo developers can manage multi-terabyte datasets without large infrastructure teams by using modern columnar systems like ClickHouse. Choose tools that handle compression and indexing natively to keep your operational burden minimal.
Startupbricks Growth Takeaway
Action Step for Founders: If you are architecting a developer or data API:
- Provide free standalone web utilities to capture high-intent developer search traffic.
- Maximize your cloud runway by claiming up to $100,000 in AWS & Google Cloud credits via the Startupbricks Founder Perks Catalog.
- Need senior backend and infrastructure engineers to build high-performance distributed systems? Discover our 30-Day MVP Engineering & Fractional CTO Services.
Building an early-stage startup? Boost your runway.
Unlock over $12.1M in founder perks from AWS, Stripe & 340+ SaaS tools, or explore 900+ indie hackers in our global directory.
Calculate your exact project timeline & budget
Configure your MVP tech stack, team scope, and marketing channels for an instant 2026 cost breakdown in 30 seconds.