RErecordedfuture
Domain

Fetch Domain risk list

Download domains filtered by risk rule in CSV/Splunk or STIX format for SIEM and firewall integration.

get/domain/risklist

Request

  • Base URL
    https://api.recordedfuture.com/v2
  • URL
    https://api.recordedfuture.com/v2/domain/risklist
  • Auth
    API key in header X-RFToken

Query parameters

format'csv/splunk' | 'xml/stix/1.1.1' | 'xml/stix/1.2' | 'application/stix+json;version=2.1'

The desired format of the risk list

gzipboolean

Whether the risk list should be compressed using gzip or be returned uncompressed

list'analystNote' | 'botnetDomain' | 'certTyposquatSandwich' | 'certTyposquatTypo' | 'cncNameserver' | 'cncSite' | 'covidLure' | 'ddns' | 'defanged' | 'default' | 'dhsAis' | 'fastFlux' | 'fraudulentContent' | 'frequentlyAbusedDnsProvider' | 'historicalThreatListMembership' | 'large' | 'linkedToCyberAttack' | 'malwareSiteDetected' | 'malwareSiteSuspected' | 'miningSiteDetected' | 'multiBlacklist' | 'noKnownRisk' | 'observedTelemetry' | 'phishingLure' | 'phishingSiteDetected' | 'phishingSiteSuspected' | 'phishingUrl' | 'proxyDomain' | 'punycode' | 'recentAnalystNote' | 'recentBotnetDomain' | 'recentCncSite' | 'recentCovidLure' | 'recentCovidSpam' | 'recentDefanged' | 'recentDhsAis' | 'recentFraudulentContent' | 'recentLinkedToCyberAttack' | 'recentMalwareSiteDetected' | 'recentMalwareSiteSuspected' | 'recentMiningPool' | 'recentMiningSiteDetected' | 'recentPhishingLureMalicious' | 'recentPhishingLureSuspicious' | 'recentPhishingSiteDetected' | 'recentPhishingSiteSuspected' | 'recentProxyDomain' | 'recentPunycode' | 'recentRelatedNote' | 'recentSpamSiteDetected' | 'recentSuspectedCncDnsName' | 'recentThreatResearcher' | 'recentTyposquatSandwich' | 'recentTyposquatTypo' | 'recentUkraineLure' | 'recentUkraineSpam' | 'recentWeaponizedDomain' | 'recentlyDefaced' | 'relatedNote' | 'resolvedMaliciousIp' | 'resolvedSuspiciousIp' | 'resolvedUnusualIp' | 'resolvedVeryMaliciousIp' | 'rfTrending' | 'spamSiteDetected' | 'suspectedCncDnsName' | 'threatResearcher' | 'typosquatSandwich' | 'typosquatTypo' | 'ukraineLure' | 'weaponizedDomain'

The risk list to download. Can be any of the machine names for risk rules, plus default and large

Response

Result of operation

Changes

No recorded changes to this operation across all 1 revision of this API.