---
title: "Search for Domain entities based on a filter"
method: GET
path: "/domain/search"
tags: ["Domain"]
---

# Search for Domain entities based on a filter

`GET /domain/search`

## Request

- Base URL: `https://api.recordedfuture.com/v2`
- URL: `https://api.recordedfuture.com/v2/domain/search`
- Auth: API key in header `X-RFToken`

Find domains by risk score, risk rules, dates, or list membership with paginated enrichment results.

## Query parameters

- `fields` string
- `metadata` unknown
- `limit` integer
- `from` integer
- `riskScore` string
- `firstSeen` string
- `lastSeen` string
- `list` string
- `riskRule` 'recentCncSite' | 'recentMalwareSiteDetected' | 'recentPhishingSiteDetected' | 'recentFraudulentContent' | 'recentWeaponizedDomain' | 'recentAnalystNote' | 'recentUkraineLure' | 'recentCovidLure' | 'recentPhishingLureMalicious' | 'recentDetectedEskimmerInfectedDomain' | 'recentPhishingLureSuspicious' | 'recentSuspectedCncDnsName' | 'recentPhishingSiteSuspected' | 'recentMiningSiteDetected' | 'recentBotnetDomain' | 'recentSpamSiteDetected' | 'recentUkraineSpam' | 'recentCovidSpam' | 'weaponizedDomain' | 'recentlyDefaced' | 'multiBlacklist' | 'compromisedUrl' | 'fastFlux' | 'frequentlyAbusedDnsProvider' | 'recentTyposquatSandwich' | 'certTyposquatSandwich' | 'certTyposquatTypo' | 'resolvedVeryMaliciousIp' | 'resolvedMaliciousIp' | 'recentLinkedToCyberAttack' | 'recentThreatResearcher' | 'recentRelatedNote' | 'recentDhsAis' | 'phishingSiteSuspected' | 'botnetDomain' | 'recentProxyDomain' | 'proxyDomain' | 'defanged' | 'recentDefanged' | 'resolvedSuspiciousIp' | 'resolvedUnusualIp' | 'linkedToCyberAttack' | 'phishingUrl' | 'cncNameserver' | 'ddns' | 'rfTrending' | 'recentTyposquatTypo' | 'typosquatSandwich' | 'typosquatTypo' | 'analystNote' | 'relatedNote' | 'threatResearcher' | 'historicalThreatListMembership' | 'recentPunycode' | 'punycode' | 'ukraineLure' | 'covidLure' | 'phishingLure' | 'miningSiteDetected' | 'malwareSiteDetected' | 'phishingSiteDetected' | 'dhsAis' | 'fraudulentContent' | 'spamSiteDetected' | 'cncSite' | 'DetectedEskimmerInfecteddomain' | 'noKnownRisk'
- `parent` string
- `orderBy` 'created' | 'modified' | 'sixtydayshits' | 'sevendayhits' | 'criticality' | 'riskscore' | 'totalhits' | 'firstseen' | 'lastseen' | 'rules'
- `direction` 'asc' | 'desc'
- `comment` string

## Response `200`

Result of operation

- SearchResponseWithMetadata: Paginated search results for entities matching the specified filters.
  - `data` object, required
    - `results` object[], required: Array of matching entity objects. Each includes entity identification and enrichment data controlled by the fields parameter.
      - `entity` object: Entity identification.
        - `id` string: Recorded Future entity ID (e.g., ip:8.8.8.8, idn:example.com, hash:abc123)
        - `name` string: Entity display name
        - `type` string: Entity type classification (e.g., IpAddress, InternetDomainName, Hash, CyberVulnerability, Malware, Company, URL)
        - `description` string: Entity description (present for vulnerabilities and some other types).
      - `risk` object: Risk assessment data (included when fields contains 'risk').
        - `score` integer: Numeric risk score (0-99)
        - `criticality` integer: Numeric criticality level (1-4)
        - `criticalityLabel` 'Informational' | 'Unusual' | 'Suspicious' | 'Moderate' | 'Malicious' | 'High' | 'Very Malicious' | 'Very High': Risk criticality label. IOC entities use: Unusual, Suspicious, Malicious, Very Malicious. Company entities use: Informational, Moderate, High, Very High.
        - `riskString` string: Triggered rules vs total rules (e.g., 16/81)
        - `rules` integer: Number of triggered risk rules
        - `riskSummary` string: Human-readable risk summary
        - `evidenceDetails` object[]: Evidence for each triggered risk rule.
          - `rule` string: Risk rule description
          - `criticality` integer: Rule criticality level
          - `criticalityLabel` string: Rule criticality label
          - `evidenceString` string: Human-readable evidence summary
          - `timestamp` string: ISO 8601 timestamp of the evidence
      - `timestamps` object: First and last seen timestamps for the entity.
        - `firstSeen` string, date-time: ISO 8601 timestamp of first observation.
        - `lastSeen` string, date-time: ISO 8601 timestamp of most recent observation.
  - `counts` CountsData, required: Pagination counts.
    - `returned` integer: Number of results in this response page
    - `total` integer: Total number of matching results across all pages
  - `metadata` object: Request metadata (included when metadata=true).
    - `entries` object[]: Metadata entries describing query parameters and their values.
      - `key` string: Parameter name.
      - `label` string: Human-readable label.
      - `type` string: Parameter type.
      - `item` object: Parameter value details.

---

[API](https://skmtc.dev/recordedfuture/apis/connect-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/connect-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/connect-api/revisions/ca0276d265f0?raw)