DomainTools Action

The web format of this guide reflects the most current release.  Guides for older iterations are available in PDF format.  

DomainTools Iris - Enrich Domains

The DomainTools Iris - Enrich Domains action enriches the input domains using the Iris Enrich/Investigate APIs. Context such as the domain's risk score, popularity rank, and threats will be returned into ThreatQ as attributes. You also can configure the integration to bring in additional context such as MX records, NS records, reverse IPs, and more.

GET https://api.domaintools.com/v1/iris-enrich/ GET https://api.domaintools.com/v1/iris-investigate/

Sample Response:

{
  "response": {
    "limit_exceeded": false,
    "has_more_results": false,
    "message": "Enjoy your data.",
    "results_count": 1,
    "total_count": 1,
    "results": [
      {
        "domain": "kscupdate.com",
        "whois_url": "https://whois.domaintools.com/kscupdate.com",
        "adsense": {
          "value": "",
          "count": 0
        },
        "alexa": "",
        "popularity_rank": "",
        "active": false,
        "google_analytics": {
          "value": "",
          "count": 0
        },
        "ga4": [],
        "gtm_codes": [],
        "fb_codes": [],
        "hotjar_codes": [],
        "baidu_codes": [],
        "yandex_codes": [],
        "matomo_codes": [],
        "statcounter_project_codes": [],
        "statcounter_security_codes": [],
        "admin_contact": {
          "name": {
            "value": "Redacted for Privacy",
            "count": 13976556
          },
          "org": {
            "value": "Privacy service provided by Withheld for Privacy ehf",
            "count": 26541364
          },
          "street": {
            "value": "Kalkofnsvegur 2",
            "count": 15606008
          },
          "city": {
            "value": "Reykjavik",
            "count": 15635545
          },
          "state": {
            "value": "Capital Region",
            "count": 27979376
          },
          "postal": {
            "value": "101",
            "count": 15635860
          },
          "country": {
            "value": "is",
            "count": 28039803
          },
          "phone": {
            "value": "3544212434",
            "count": 15598476
          },
          "fax": {
            "value": "",
            "count": 0
          },
          "email": [
            {
              "value": "3b3d95bb9f3d4706ab96070d181619d6.protect@withheldforprivacy.com",
              "count": 1
            }
          ]
        },
        "billing_contact": {
          "name": {
            "value": "",
            "count": 0
          },
          "org": {
            "value": "",
            "count": 0
          },
          "street": {
            "value": "",
            "count": 0
          },
          "city": {
            "value": "",
            "count": 0
          },
          "state": {
            "value": "",
            "count": 0
          },
          "postal": {
            "value": "",
            "count": 0
          },
          "country": {
            "value": "",
            "count": 0
          },
          "phone": {
            "value": "",
            "count": 0
          },
          "fax": {
            "value": "",
            "count": 0
          },
          "email": []
        },
        "registrant_contact": {
          "name": {
            "value": "Redacted for Privacy",
            "count": 13976556
          },
          "org": {
            "value": "Privacy service provided by Withheld for Privacy ehf",
            "count": 26541364
          },
          "street": {
            "value": "Kalkofnsvegur 2",
            "count": 15606008
          },
          "city": {
            "value": "Reykjavik",
            "count": 15635545
          },
          "state": {
            "value": "Capital Region",
            "count": 27979376
          },
          "postal": {
            "value": "101",
            "count": 15635860
          },
          "country": {
            "value": "is",
            "count": 28039803
          },
          "phone": {
            "value": "3544212434",
            "count": 15598476
          },
          "fax": {
            "value": "",
            "count": 0
          },
          "email": [
            {
              "value": "3b3d95bb9f3d4706ab96070d181619d6.protect@withheldforprivacy.com",
              "count": 1
            }
          ]
        },
        "technical_contact": {
          "name": {
            "value": "Redacted for Privacy",
            "count": 13976556
          },
          "org": {
            "value": "Privacy service provided by Withheld for Privacy ehf",
            "count": 26541364
          },
          "street": {
            "value": "Kalkofnsvegur 2",
            "count": 15606008
          },
          "city": {
            "value": "Reykjavik",
            "count": 15635545
          },
          "state": {
            "value": "Capital Region",
            "count": 27979376
          },
          "postal": {
            "value": "101",
            "count": 15635860
          },
          "country": {
            "value": "is",
            "count": 28039803
          },
          "phone": {
            "value": "3544212434",
            "count": 15598476
          },
          "fax": {
            "value": "",
            "count": 0
          },
          "email": [
            {
              "value": "3b3d95bb9f3d4706ab96070d181619d6.protect@withheldforprivacy.com",
              "count": 1
            }
          ]
        },
        "create_date": {
          "value": "2023-09-25",
          "count": 268640
        },
        "expiration_date": {
          "value": "2024-09-25",
          "count": 764604
        },
        "email_domain": [
          {
            "value": "withheldforprivacy.com",
            "count": 14959106
          }
        ],
        "soa_email": [
          {
            "value": "dns@cloudflare.com",
            "count": 62959786
          }
        ],
        "ssl_email": [],
        "additional_whois_email": [
          {
            "value": "abuse@namecheap.com",
            "count": 44723965
          }
        ],
        "ip": [
          {
            "address": {
              "value": "172.67.175.217",
              "count": 1359
            },
            "asn": [
              {
                "value": 13335,
                "count": 47095995
              }
            ],
            "country_code": {
              "value": "us",
              "count": 197000302
            },
            "isp": {
              "value": "CloudFlare Inc.",
              "count": 40175752
            }
          }
        ],
        "mx": [],
        "name_server": [
          {
            "host": {
              "value": "donna.ns.cloudflare.com",
              "count": 150627
            },
            "domain": {
              "value": "cloudflare.com",
              "count": 50465465
            },
            "ip": [
              {
                "value": "108.162.192.151",
                "count": 126242
              }
            ]
          }
        ],
        "domain_risk": {
          "risk_score": 100,
          "components": [
            {
              "name": "proximity",
              "risk_score": 100
            },
            {
              "name": "threat_profile",
              "risk_score": 72,
              "threats": ["phishing"],
              "evidence": ["domain name", "name server", "registrar"]
            }
          ]
        },
        "redirect": {
          "value": "www.kaspersky.ru",
          "count": 11
        },
        "redirect_domain": {
          "value": "kaspersky.ru",
          "count": 14
        },
        "registrant_name": {
          "value": "Redacted for Privacy",
          "count": 13985389
        },
        "registrant_org": {
          "value": "Privacy service provided by Withheld for Privacy ehf",
          "count": 26623684
        },
        "registrar": {
          "value": "NAMECHEAP INC",
          "count": 16839368
        },
        "registrar_status": ["clienttransferprohibited"],
        "spf_info": "",
        "ssl_info": [
          {
            "hash": {
              "value": "ce2ac7c0ec5413e5a5e3e38deb06a7c8829af6c5",
              "count": 1
            },
            "subject": {
              "value": "CN=kscupdate.com",
              "count": 1
            },
            "organization": {
              "value": "",
              "count": 0
            },
            "email": [],
            "alt_names": [
              {
                "value": "kscupdate.com",
                "count": 0
              }
            ],
            "sources": {
              "active": 1698129700000
            },
            "common_name": {
              "value": "kscupdate.com",
              "count": 1
            },
            "issuer_common_name": {
              "value": "GTS CA 1P5",
              "count": 17564085
            },
            "not_after": {
              "value": 20231224,
              "count": 572340
            },
            "not_before": {
              "value": 20230925,
              "count": 755678
            },
            "duration": {
              "value": 90,
              "count": 128018286
            }
          }
        ],
        "tld": "com",
        "website_response": 200,
        "data_updated_timestamp": "2023-12-12T22:07:01.792000",
        "website_title": {
          "value": "Защитные решения кибербезопасности для дома и бизнеса | Лаборатория Касперского",
          "count": 2
        },
        "server_type": {
          "value": "nginx",
          "count": 15449368
        },
        "first_seen": {
          "value": "2023-09-25T17:33:31Z",
          "count": 0
        },
        "tags": []
      }
    ],
    "missing_domains": []
  }
}

ThreatQuotient provides the following default mapping for this action:

Mapping is based on each item within the results array.

PDF Guides