HUhudsonrock
Domain Intelligence

Domains Overview

Changed on

Get overview about domain-wide compromises and intelligence

post/search-by-domain/overview

Request

Request body

domainsstring[] required

List of domains to retrieve compromise overview statistics for. Accepts root domains (example.com) and will aggregate data across all subdomains. Between 1-500 domains can be specified per request.

min_employees_compromisednumber

Minimum threshold for employee compromises. Returns only domains with at least this many compromised employee accounts. Useful for filtering out domains with negligible compromise counts.

max_employees_compromisednumber

Maximum threshold for employee compromises. Returns only domains with no more than this many compromised employee accounts. Useful for focusing on organizations within specific size ranges.

min_users_compromisednumber

Minimum threshold for user compromises. Returns only domains with at least this many compromised user accounts. Helps identify domains with significant consumer impact.

max_users_compromisednumber

Maximum threshold for user compromises. Returns only domains with no more than this many compromised user accounts. Helps focus on domains with specific consumer impact ranges.

last_employee_compromisedstring date-time

ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter for domains with employee compromises after this date. Identifies domains with recent corporate breaches.

last_user_compromisedstring date-time

ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter for domains with user compromises after this date. Identifies domains with recent consumer-facing breaches.

last_employee_uploadedstring date-time

ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter for domains with employee data uploaded after this date. Reflects when the data became available in our system.

last_user_uploadedstring date-time

ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter for domains with user data uploaded after this date. Reflects when the data became available in our system.

sort_by'last_employee_compromised' | 'last_user_compromised' | 'last_employee_uploaded' | 'last_user_uploaded' | 'compromised_employees' | 'compromised_users'

Field to sort overview results by. Time-based sorting helps identify recent breaches, while count-based sorting identifies the most severely affected domains.

sort_direction'asc' | 'desc'

Direction to sort overview results. 'desc' prioritizes recent breaches or highest compromise counts (recommended for threat monitoring), while 'asc' shows oldest breaches or lowest counts first.

cursorstring

Base64 encoded pagination cursor for retrieving the next set of overview results. Obtained from the 'nextCursor' field in the previous response. Essential for processing large domain lists.

Example request

{
  "domains": [
    "hpe.com"
  ],
  "min_employees_compromised": 10,
  "max_employees_compromised": 100,
  "min_users_compromised": 5,
  "max_users_compromised": 50
}

Response

Successful operation

nextCursorstring

Base64 encoded cursor for the next page

Example response

{
  "data": [
    {
      "compromised_employees": 25,
      "compromised_users": 120,
      "fortinet": {
        "domain": "example.com",
        "industry": "Financial Services",
        "size": "1001-5000 Employees",
        "revenue": "$500 Million",
        "batches": [
          2
        ],
        "v2_added_at": "2026-10-01T00:00:00.000Z",
        "credentials": [
          {
            "batch": 2,
            "url": "https://vpn.example.com:443/login",
            "login": "admin",
            "password": "P@ssw0rd!",
            "FortiGuardID": "FGT60F-XXXXXXXX",
            "country": "US",
            "user_email": "jdoe@example.com",
            "ldap_dn": "CN=jdoe,OU=IT,DC=example,DC=com",
            "trusthosts": "10.0.0.0 255.0.0.0 192.168.1.10 255.255.255.255",
            "hostname": "FW-HQ-01",
            "serial_or_alias": "FGT60FTK21000000",
            "report_date": "2026-02-14 09:31:07",
            "device_ip": "203.0.113.10",
            "admin_port": "443",
            "vpn_port": "10443",
            "target_port": "443",
            "attribution_source": "LDAP_DN_Public",
            "credential_category": "FortiGate_System_Admin_Config",
            "secret_type": "cleartext",
            "account_status": "Enabled",
            "accprofile": "super_admin",
            "vdom": "root",
            "two_fa": "fortitoken",
            "ldap_server": "AD-Ldap (10.0.0.5)",
            "all_public_domains": "example.com,example.net",
            "all_internal_domains": "corp.example.local",
            "config_file": "203.0.113.10_443_FW-HQ-01.txt"
          }
        ]
      }
    }
  ]
}

Changes

  • a7ebb4dfd47fRevision changes
    • info

      added to the // response property allOf list for the response status

    • info

      removed from the // response property allOf list for the response status