What this endpoint does

This endpoint downloads a bulk file of domains matching a specified risk rule, designed for integration into SIEMs, firewalls, proxy servers, and threat intelligence platforms. Only domains with a risk score of 25 or above are included. You can filter by any of approximately 70 risk rules such as recently detected phishing sites, botnet domains, C2 nameservers, or typosquatting domains—use the Domain Risk Rules endpoint to retrieve the full list of valid rule names and their descriptions. The output is available in CSV/Splunk (default), STIX 1.1.1, STIX 1.2, or STIX 2.1 formats. Use the companion HEAD Domain Risk List endpoint to check file metadata and ETags before downloading, which is useful for polling workflows that only fetch updated lists.

Response data

The response is a binary file download (not JSON). In the default CSV/Splunk format, each row contains a domain name, its composite risk score, a risk string showing the ratio of triggered to total rules, and a JSON-encoded evidence details field. The evidence details break down every triggered risk rule with human-readable descriptions, criticality levels, source counts, sighting counts, and timestamps. When using STIX output formats, the same intelligence is structured as STIX indicators and observables suitable for automated threat intelligence sharing.