Domain Search

Query Parameters

• domain = (string) (optional) –

  • name or wildcard pattern of domain names to search for

• domain_regex = (pattern) (optional) –

  • re2 regular expression - overrides domain parameter

    • pattern must be a valid re2 regular expression

• nsname = (string) (optional) –

  • name server name or wildcard pattern of name server used by domains

    • use nsname=self to find domains hosting their own nameservers

• mxname = (string) (optional) –

  • mx server name or wildcard pattern of mx server used by domains

    • use mxname=self to find domains hosting their own mailservers

• first_seen_min = (string) (optional) –

  • only domains that have A records seen for the first time after the given date

• first_seen_max = (string) (optional) –

  • only domains that have A records seen for the first time before the given date

• first_seen_min_mode = (string) (optional) –

  • match mode for first_seen_min parameter

    • strict (default) - select A records that do not have any timestamps before first_seen_min

    • any - select A records that have at least one timestamp after first_seen_min

• first_seen_max_mode = (string) (optional) –

  • match mode for first_seen_max parameter

    • strict (default) - select A records that do not have any timestamps after first_seen_max

    • any - select A records that have at least one timestamp before first_seen_max

• last_seen_min = (string) (optional) –

  • only domains that have A records last seen more recently than the given date

• last_seen_max = (string) (optional) –

  • only domains that have A records last seen earlier than the given date

• last_seen_min_mode = (string) (optional) –

  • match mode for last_seen_min parameter

    • strict - select A records that do not have any timestamps before last_seen_min

    • any (default) - select A records that have at least one timestamp after first_seen_min

• last_seen_max_mode = (string) (optional) –

  • match mode for last_seen_max parameter

    • strict (default) - select A records that do not have any timestamps after last_seen_max

    • any - select A records that have at least one timestamp before last_seen_max

• asnum = (int) (optional) –

  • AS number to search, may be repeated multiple time for additional AS numbers

• asn = (int) (optional) –

  • search for IP addresses in or not in the given AS numbers

    • default = in

• asname = (string) (optional) –

  • search all AS numbers where the AS Name begins with

• asname_starts_with = (string) (optional) –

  • search all AS numbers where the AS Name begins with

• asname_contains = (string) (optional) –

  • search all AS numbers where the AS Name contains

• asn_match = (string) (optional) –

  • how to match AS numbers

    • any (default) - match on any asnum given or derived from asname

    • all - asn diversity timeline must contain all asnums given as asnum parameter or derived from asname

    • limit - apply min and/or max limits as specified by optional asn_match_min and asn_match_max parameters

• asn_match_max = (int) (optional) –

  • maximum of the asnums given as asnum or derived from asname must appear in asn diversity timeline

• asn_match_min = (int) (optional) –

  • minimum of the asnums given as asnum or derived from asname must appear in asn diversity timeline

• network = (string) (optional) –

  • additional network and net mask

    • give option as 1.1.1.1/24

    • network parameter may be given multiple times and the search will be performed as an ‘or’ condition

• timeline =<0|1> (int) (optional) –

  • include details of IPs, ASNs, first_seen and last_seen for each domain

    • 0 (default) = do not include

    • 1 = include timeline

• first_seen_after = (string) (optional) –

  • only domains that have been seen using the NS server in the “nsname=” parameter for the first time after the given date

• first_seen_before = (string) (optional) –

  • only domains that have been seen using the NS server in the “nsname=” parameter for the first time before the given date

• registrar = (string) (optional) –

  • name or partial name of registrar used to register domains - no wildcards, the given string is used in partial match - this is a slow search option and should only be used in combination with the domain match option

• email = (string) (optional) –

  • email used to register domains - no wildcards, the given string is used in exact match - this is a slow search option and should only be used in combination with the domain match option

• whois_date_after = (string) (optional) –

  • only domains that have a created date in Whois after this date – this limits the search to domains for which we have Whois data and makes the search perform slowly – all of the whois specific options should be avoided if at all possible

• nschange_from_ns = (string) (optional) –

  • domain has changed name server from nsname

    • exact match, wildcards and ‘self’ options supported

• nschange_to_ns = (string) (optional) –

  • domain has changed name server to nsname

  • exact match, wildcards and ‘self’ options supported

• nschange_date_after = (string) (optional) –

  • only domains with name server changes that occurred after the given date

  • if nschange_date_after is not given, the default is to find name server changes in the last 30 days, if nschange_date_before is not given

• nschange_date_before = (string) (optional) –

  • only domains with name server changes that occurred before the given date

• cert_date_min = (string) (optional) –

  • only domains that have had ssl certificates issued on or after the given date

• cert_date_max = (string) (optional) –

  • only domains that have had ssl certificates issued on or before the given date

• cert_issuer = (string) (optional) –

  • only domains that have had ssl certificates issued using the named certificate issuer

    • wildcards (*) are supported

    • spaces in name may be represented by ‘+’

• infratag = (string) (optional) –

  • search by infratag

    • infratag must include mx part, ns part, asname part, or registrar part

    • overrides mxname, nsname and registrar parameters, if infratag contains these parts

    • can be combined with all other parameters

• asn_diversity = (int) (optional) –

  • asn diversity - exact match

• asn_diversity_min = (int) (optional) –

  • minimum diversity limit

• asn_diversity_max = (int) (optional) –

  • maximum diversity limit

• ip_diversity_all = (int) (optional) –

  • ip diversity all - exact match

• ip_diversity_all_min = (int) (optional) –

  • minimum diversity limit

    • default = 1

• ip_diversity_all_max = (int) (optional) –

  • maximum diversity limit

• ip_diversity_groups = (int) (optional) –

  • ip diversity groups - exact match

• ip_diversity_groups_min = (int) (optional) –

  • minimum diversity limit

• ip_diversity_groups_max = (int) (optional) –

  • maximum diversity limit

• limit = (int) (optional) –

  • number of results to return

    • default = 100

• skip = (int) (optional) –

  • number of results to skip

• prefer = (string) (optional) –

  • result (default) - return results if available before max_wait timeout, otherwise return job_id

  • job_id - return job_id immediately

• max_wait = (int) (optional) –

  • number of seconds to wait for results before returning job_id

    • default = 25

    • value in the range from 0 to 25

• with_metadata =<0|1> (int) (optional) –

  • include metadata object in response : returned results, total results, job_id

    • 0 (default) = do not include

    • 1 = include metadata

Request headers:

• X-API-KEY - api-key