--- updatedAt: 2026-08-14T02:53:56.000Z agentTools: projectIndex: https://docs.recordedfuture.com/llms.txt --- # Fetch Domain risk list Download domains filtered by risk rule in CSV/Splunk or STIX format for SIEM and firewall integration. ### What this endpoint does This endpoint downloads a bulk file of domains, designed for integration into SIEMs, firewalls, proxy servers, and threat intelligence platforms. By default it returns the "default" risk list, which surfaces higher-scoring (Malicious-tier and above) domains; use the `list` parameter with a risk rule name to filter to domains that trigger that specific rule. You can filter by any of approximately 70 risk rules such as recently detected phishing sites, botnet domains, C2 nameservers, or typosquatting domains—use the Domain Risk Rules endpoint to retrieve the full list of valid rule names and their descriptions. The output is available in CSV/Splunk (default), STIX 1.1.1, STIX 1.2, or STIX 2.1 formats. Use the companion HEAD Domain Risk List endpoint to check file metadata and ETags before downloading, which is useful for polling workflows that only fetch updated lists. ### Response data The response is a binary file download (not JSON). In the default CSV/Splunk format, each row contains a domain name, its composite risk score, a risk string showing the ratio of triggered to total rules, and a JSON-encoded evidence details field. The evidence details break down every triggered risk rule with human-readable descriptions, criticality levels, source counts, sighting counts, and timestamps. When using STIX output formats, the same intelligence is structured as STIX indicators and observables suitable for automated threat intelligence sharing. # OpenAPI definition ```json { "openapi": "3.1.1", "info": { "title": "Connect API", "version": "2.0.0", "description": "A collection of APIs suitable for a number of use cases.\n\nFurther documentation is available at [Recorded Future Docs](https://docs.recordedfuture.com/reference/get-started)\n" }, "servers": [ { "url": "https://api.recordedfuture.com/v2" } ], "paths": { "/domain/risklist": { "get": { "summary": "Fetch Domain risk list", "tags": [ "Domain" ], "x-readme": { "explorer-enabled": false }, "description": "Download domains filtered by risk rule in CSV/Splunk or STIX format for SIEM and firewall integration.\n", "security": [ { "ApiKeyAuth": [] } ], "parameters": [ { "$ref": "#/components/parameters/FormatParameter" }, { "$ref": "#/components/parameters/GzipParameter" }, { "$ref": "#/components/parameters/DomainRiskListParameter" } ], "responses": { "200": { "description": "Result of operation", "content": { "text/plain": { "schema": { "$ref": "#/components/schemas/RiskListResponse" }, "example": "\"Name\",\"Risk\",\"RiskString\",\"EvidenceDetails\"\n\"digitalcollege.org\",\"99\",\"7/61\",\"{\"\"EvidenceDetails\"\": [{\"\"Name\"\": \"\"malwareSiteDetected\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: External Sensor Data Analysis. digitalcollege.org is observed to be a malware site domain that navigates to malicious content including executables, drive-by infection sites, malicious scripts, viruses, trojans, or code.\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Rule\"\": \"\"Historically Detected Malware Operation\"\", \"\"SourcesCount\"\": 1.0, \"\"Sources\"\": [\"\"source:kBB1fk\"\"], \"\"Timestamp\"\": \"\"2022-02-01T21:22:56.588Z\"\", \"\"SightingsCount\"\": 1.0, \"\"Criticality\"\": 1.0}, {\"\"Name\"\": \"\"dhsAis\"\", \"\"EvidenceString\"\": \"\"2 sightings on 1 source: DHS Automated Indicator Sharing. 2 reports including AA20-352A APT Compromise of Govt Agencies, Critical Infrastructure, and Private Sector Organizations, from CISA, Government Facilities Sector, CISA, Government Facilities Sector, NCCIC:STIX_Package-673aacd1-1852-4d44-bd93-0c44940a6358 (Feb 3, 2021).\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Rule\"\": \"\"Historically Reported by DHS AIS\"\", \"\"SourcesCount\"\": 1.0, \"\"Sources\"\": [\"\"source:UZNze8\"\"], \"\"Timestamp\"\": \"\"2021-02-03T21:32:08.000Z\"\", \"\"SightingsCount\"\": 2.0, \"\"Criticality\"\": 1.0}, {\"\"Name\"\": \"\"defanged\"\", \"\"EvidenceString\"\": \"\"22 sightings on 10 sources including: securityscorecard.com, xpda.com, Sesin at, Palo Alto Networks, extrahop.com. Most recent link (Dec 22, 2025): https://xpda.com/junkmail/junk241/AA20-352A-APT_Compromise_of_Government_Agencies%2C_Critical%20Infrastructure%2C_and_Private_Sector_Organizations.pdf\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Rule\"\": \"\"Historically Reported as a Defanged DNS Name\"\", \"\"SourcesCount\"\": 10.0, \"\"Sources\"\": [\"\"idn:securityscorecard.com\"\", \"\"idn:xpda.com\"\", \"\"source:Z3TZAQ\"\", \"\"source:s1FdiP\"\", \"\"idn:extrahop.com\"\", \"\"source:PA-rR4\"\", \"\"source:sQoNNc\"\", \"\"source:485j-E\"\", \"\"idn:infoblox.com\"\", \"\"source:MIKjae\"\"], \"\"Timestamp\"\": \"\"2025-12-22T01:08:51.106Z\"\", \"\"SightingsCount\"\": 22.0, \"\"Criticality\"\": 1.0}, {\"\"Name\"\": \"\"analystNote\"\", \"\"EvidenceString\"\": \"\"2 sightings on 1 source: Insikt Group. 2 reports including CISA Warns of Attacks Targeting US Government Sector, Critical Infrastructure Entities, and Private Sector Organizations. Most recent link (Dec 18, 2020): https://app.recordedfuture.com/portal/analyst-note/doc:gfT_OG\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Rule\"\": \"\"Historically Reported by Insikt Group\"\", \"\"SourcesCount\"\": 1.0, \"\"Sources\"\": [\"\"source:VKz42X\"\"], \"\"Timestamp\"\": \"\"2020-12-18T00:00:00.000Z\"\", \"\"SightingsCount\"\": 2.0, \"\"Criticality\"\": 1.0}, {\"\"Name\"\": \"\"relatedNote\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Insikt Group. 1 report: SITREP: Updates on the SolarWinds Related Intrusion Activity. Most recent link (Dec 15, 2020): https://app.recordedfuture.com/portal/analyst-note/doc:gca1SJ\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Rule\"\": \"\"Historically Referenced by Insikt Group\"\", \"\"SourcesCount\"\": 1.0, \"\"Sources\"\": [\"\"source:VKz42X\"\"], \"\"Timestamp\"\": \"\"2020-12-15T00:00:00.000Z\"\", \"\"SightingsCount\"\": 1.0, \"\"Criticality\"\": 1.0}, {\"\"Name\"\": \"\"historicalThreatListMembership\"\", \"\"EvidenceString\"\": \"\"Previous sightings on 2 sources: Bambenek Consulting C&C Blocklist, Recently Viewed Integrations Indicators. Observed between Jan 26, 2026, and May 26, 2026.\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Rule\"\": \"\"Historically Reported in Threat List\"\", \"\"SourcesCount\"\": 2.0, \"\"Sources\"\": [\"\"report:QhR8Qs\"\", \"\"report:oJewMx\"\"], \"\"Timestamp\"\": \"\"2026-06-02T22:42:43.997Z\"\", \"\"SightingsCount\"\": -1.0, \"\"Criticality\"\": 1.0}, {\"\"Name\"\": \"\"recentCncSite\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bambenek Consulting C&C Blocklist.\"\", \"\"CriticalityLabel\"\": \"\"Very Malicious\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Rule\"\": \"\"Recent C&C DNS Name\"\", \"\"SourcesCount\"\": 1.0, \"\"Sources\"\": [\"\"report:QhR8Qs\"\"], \"\"Timestamp\"\": \"\"2026-06-02T22:42:43.973Z\"\", \"\"SightingsCount\"\": 1.0, \"\"Criticality\"\": 4.0}]}\"" } } } } } } }, "components": { "parameters": { "FormatParameter": { "in": "query", "name": "format", "required": false, "schema": { "enum": [ "csv/splunk", "xml/stix/1.1.1", "xml/stix/1.2", "application/stix+json;version=2.1" ], "default": "csv/splunk" }, "description": "The desired format of the risk list\n" }, "GzipParameter": { "in": "query", "name": "gzip", "required": false, "schema": { "type": "boolean", "default": false }, "description": "Whether the risk list should be compressed using gzip or be returned uncompressed\n" }, "DomainRiskListParameter": { "in": "query", "name": "list", "required": false, "schema": { "enum": [ "analystNote", "botnetDomain", "certTyposquatSandwich", "certTyposquatTypo", "cncNameserver", "cncSite", "covidLure", "ddns", "defanged", "default", "dhsAis", "fastFlux", "fraudulentContent", "frequentlyAbusedDnsProvider", "historicalThreatListMembership", "large", "linkedToCyberAttack", "malwareSiteDetected", "malwareSiteSuspected", "miningSiteDetected", "multiBlacklist", "noKnownRisk", "observedTelemetry", "phishingLure", "phishingSiteDetected", "phishingSiteSuspected", "phishingUrl", "proxyDomain", "punycode", "recentAnalystNote", "recentBotnetDomain", "recentCncSite", "recentCovidLure", "recentCovidSpam", "recentDefanged", "recentDhsAis", "recentFraudulentContent", "recentLinkedToCyberAttack", "recentMalwareSiteDetected", "recentMalwareSiteSuspected", "recentMiningPool", "recentMiningSiteDetected", "recentPhishingLureMalicious", "recentPhishingLureSuspicious", "recentPhishingSiteDetected", "recentPhishingSiteSuspected", "recentProxyDomain", "recentPunycode", "recentRelatedNote", "recentSpamSiteDetected", "recentSuspectedCncDnsName", "recentThreatResearcher", "recentTyposquatSandwich", "recentTyposquatTypo", "recentUkraineLure", "recentUkraineSpam", "recentWeaponizedDomain", "recentlyDefaced", "relatedNote", "resolvedMaliciousIp", "resolvedSuspiciousIp", "resolvedUnusualIp", "resolvedVeryMaliciousIp", "rfTrending", "spamSiteDetected", "suspectedCncDnsName", "threatResearcher", "typosquatSandwich", "typosquatTypo", "ukraineLure", "weaponizedDomain" ] }, "description": "The risk list to download. Can be any of the machine names for risk rules, plus default and large\n" } }, "schemas": { "RiskListResponse": { "type": "string", "format": "binary", "description": "Bulk file download of risk-scored entities. Default format is CSV/Splunk with columns: Name, Risk (0-99), RiskString (triggered/total rules), EvidenceDetails (JSON-encoded evidence array). Also available in STIX 1.1.1, STIX 1.2, or STIX 2.1 formats via the format parameter." } }, "securitySchemes": { "ApiKeyAuth": { "description": "API Credential", "type": "apiKey", "in": "header", "name": "X-RFToken" } } }, "x-readme": { "explorer-enabled": true, "proxy-enabled": false } } ``` # Sibling pages * [Search for Domain entities based on a filter](https://docs.recordedfuture.com/reference/domain-search.md) * [Lookup a Domain entity by id](https://docs.recordedfuture.com/reference/domain-lookup.md) * [List Domain risk rules](https://docs.recordedfuture.com/reference/domain-risk-rules.md) * [Stat a domain risk list](https://docs.recordedfuture.com/reference/domain-stat-risk-list.md) * [Lookup a Domain entity by id by querying an Intelligence Card extension](https://docs.recordedfuture.com/reference/domain-lookup-extension.md) * [Fetch Domain risk list demo events](https://docs.recordedfuture.com/reference/domain-demo-events.md)