--- updatedAt: 2026-06-03T00:25:12.000Z agentTools: projectIndex: https://docs.recordedfuture.com/llms.txt --- # Search for Domain entities based on a filter Find domains by risk score, risk rules, dates, or list membership with paginated enrichment results. ### What this endpoint does This endpoint searches the Recorded Future Intelligence Cloud for domain entities matching specified criteria. You can filter domains by risk score ranges, specific risk rules (use the Domain Risk Rules endpoint to get valid rule names), first/last seen dates, and Recorded Future list membership. Results can be sorted by risk score, criticality, total or recent reference counts, or chronological fields, enabling prioritized views of the most dangerous or recently active domains. The enrichment fields system lets you control which data is returned per result, such as entity identifiers and risk scoring—consult the [Enrichment: Field Attributes](https://docs.recordedfuture.com/reference/enrichment-field-attributes) reference for all available field options. ### Response data The response contains a paginated array of matching domain entities, each populated with the requested enrichment fields, along with count metadata showing the number of returned and total matching records. When risk data is requested, each domain includes a composite risk score (0-99), criticality level, and a breakdown of every triggered risk rule with supporting evidence—sighting counts, source descriptions, timestamps, and mitigation notes. Paginated with offset-based pagination; `limit` max 1,000 and `limit + from` cannot exceed 1,000. Results are under `data.results`, with `counts` as a sibling of `data`. The `limit` parameter has a default value of 10. The intention is to use pagination to get further results. Though `limit` can be set to higher values, depending on which fields are used for enrichment, this might result in slower queries and possibly even time outs. # OpenAPI definition ```json { "openapi": "3.1.1", "info": { "title": "Connect API", "version": "2.0.0", "description": "A collection of APIs suitable for a number of use cases.\n\nFurther documentation is available at [Recorded Future Docs](https://docs.recordedfuture.com/reference/get-started)\n" }, "servers": [ { "url": "https://api.recordedfuture.com/v2" } ], "paths": { "/domain/search": { "get": { "summary": "Search for Domain entities based on a filter", "tags": [ "Domain" ], "description": "Find domains by risk score, risk rules, dates, or list membership with paginated enrichment results.\n", "security": [ { "ApiKeyAuth": [] } ], "parameters": [ { "$ref": "#/components/parameters/FieldsParameter" }, { "$ref": "#/components/parameters/MetadataParameter" }, { "$ref": "#/components/parameters/LimitParameter" }, { "$ref": "#/components/parameters/FromParameter" }, { "$ref": "#/components/parameters/RiskScoreParameter" }, { "$ref": "#/components/parameters/FirstSeenParameter" }, { "$ref": "#/components/parameters/LastSeenParameter" }, { "$ref": "#/components/parameters/ListParameter" }, { "$ref": "#/components/parameters/DomainRiskRuleParameter" }, { "$ref": "#/components/parameters/ParentParameter" }, { "$ref": "#/components/parameters/OrderByParameter" }, { "$ref": "#/components/parameters/DirectionParameter" }, { "$ref": "#/components/parameters/CommentParameter" } ], "responses": { "200": { "description": "Result of operation", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SearchResponseWithMetadata" }, "example": { "data": { "results": [ { "risk": { "criticalityLabel": "Very Malicious", "riskString": "7/61", "rules": 7, "criticality": 4, "riskSummary": "7 of 61 Risk Rules currently observed.", "score": 99, "evidenceDetails": [ { "mitigationString": "", "evidenceString": "1 sighting on 1 source: External Sensor Data Analysis. digitalcollege.org is observed to be a malware site domain that navigates to malicious content including executables, drive-by infection sites, malicious scripts, viruses, trojans, or code.", "rule": "Historically Detected Malware Operation", "criticality": 1, "timestamp": "2022-02-01T21:22:56.588Z", "criticalityLabel": "Unusual" }, { "mitigationString": "", "evidenceString": "2 sightings on 1 source: DHS Automated Indicator Sharing. 2 reports including AA20-352A APT Compromise of Govt Agencies, Critical Infrastructure, and Private Sector Organizations, from CISA, Government Facilities Sector, CISA, Government Facilities Sector, NCCIC:STIX_Package-673aacd1-1852-4d44-bd93-0c44940a6358 (Feb 3, 2021).", "rule": "Historically Reported by DHS AIS", "criticality": 1, "timestamp": "2021-02-03T21:32:08.000Z", "criticalityLabel": "Unusual" }, { "mitigationString": "", "evidenceString": "22 sightings on 10 sources including: securityscorecard.com, xpda.com, Sesin at, Palo Alto Networks, extrahop.com. Most recent link (Dec 22, 2025): https://xpda.com/junkmail/junk241/AA20-352A-APT_Compromise_of_Government_Agencies%2C_Critical%20Infrastructure%2C_and_Private_Sector_Organizations.pdf", "rule": "Historically Reported as a Defanged DNS Name", "criticality": 1, "timestamp": "2025-12-22T01:08:51.106Z", "criticalityLabel": "Unusual" }, { "mitigationString": "", "evidenceString": "2 sightings on 1 source: Insikt Group. 2 reports including CISA Warns of Attacks Targeting US Government Sector, Critical Infrastructure Entities, and Private Sector Organizations. Most recent link (Dec 18, 2020): https://app.recordedfuture.com/portal/analyst-note/doc:gfT_OG", "rule": "Historically Reported by Insikt Group", "criticality": 1, "timestamp": "2020-12-18T00:00:00.000Z", "criticalityLabel": "Unusual" }, { "mitigationString": "", "evidenceString": "1 sighting on 1 source: Insikt Group. 1 report: SITREP: Updates on the SolarWinds Related Intrusion Activity. Most recent link (Dec 15, 2020): https://app.recordedfuture.com/portal/analyst-note/doc:gca1SJ", "rule": "Historically Referenced by Insikt Group", "criticality": 1, "timestamp": "2020-12-15T00:00:00.000Z", "criticalityLabel": "Unusual" }, { "mitigationString": "", "evidenceString": "Previous sightings on 2 sources: Bambenek Consulting C&C Blocklist, Recently Viewed Integrations Indicators. Observed between Jan 26, 2026, and May 26, 2026.", "rule": "Historically Reported in Threat List", "criticality": 1, "timestamp": "2026-06-02T22:42:43.997Z", "criticalityLabel": "Unusual" }, { "mitigationString": "", "evidenceString": "1 sighting on 1 source: Bambenek Consulting C&C Blocklist.", "rule": "Recent C&C DNS Name", "criticality": 4, "timestamp": "2026-06-02T22:42:43.973Z", "criticalityLabel": "Very Malicious" } ] }, "entity": { "id": "idn:digitalcollege.org", "name": "digitalcollege.org", "type": "InternetDomainName" } }, { "risk": { "criticalityLabel": "Very Malicious", "riskString": "6/61", "rules": 6, "criticality": 4, "riskSummary": "6 of 61 Risk Rules currently observed.", "score": 99, "evidenceDetails": [ { "mitigationString": "", "evidenceString": "5 sightings on 1 source: External Sensor Data Analysis. websitetheme.com is observed to be a malware site domain that navigates to malicious content including executables, drive-by infection sites, malicious scripts, viruses, trojans, or code.", "rule": "Historically Detected Malware Operation", "criticality": 1, "timestamp": "2025-12-18T02:03:23.357Z", "criticalityLabel": "Unusual" }, { "mitigationString": "", "evidenceString": "27 sightings on 1 source: External Sensor Data Analysis. websitetheme.com is suspected to be a malware site URL/Domain that navigates to malicious content including executables, drive-by infections sites, malicious scripts, viruses, trojans, or code.", "rule": "Historically Suspected Malware Operation", "criticality": 1, "timestamp": "2025-10-05T01:16:47.414Z", "criticalityLabel": "Unusual" }, { "mitigationString": "", "evidenceString": "29 sightings on 11 sources including: CSO Online, extrahop.com, Palo Alto Networks, AlienVault, Guidepoint Security | Blog. Most recent tweet: [2/1] Indicators for #SolarWinds #attack: deftsecurity[.]com,13.59.205.66 freescanonline[.]com,54.193.127.66 thedoccloud[.]com,54.215.192.52 websitetheme[.]com,34.203.203.23 highdatabase[.]com,139.99.115.204 @NSDC_ua @cyberpoliceua #НКЦК #APT29 #cozybear #malware #orion. Most recent link (Dec 15, 2020): https://twitter.com/sky31337/statuses/1338706443839672320", "rule": "Historically Reported as a Defanged DNS Name", "criticality": 1, "timestamp": "2020-12-15T04:44:22.000Z", "criticalityLabel": "Unusual" }, { "mitigationString": "", "evidenceString": "2 sightings on 1 source: Insikt Group. 2 reports including UNC2452 (DarkHalo)'s SUNBURST Backdoor; Indicators and Infrastructure. Most recent link (Dec 15, 2020): https://app.recordedfuture.com/portal/analyst-note/doc:gcSJpz", "rule": "Historically Reported by Insikt Group", "criticality": 1, "timestamp": "2020-12-15T00:00:00.000Z", "criticalityLabel": "Unusual" }, { "mitigationString": "", "evidenceString": "Previous sightings on 2 sources: Bambenek Consulting C&C Blocklist, Recently Viewed Integrations Indicators. Observed between Mar 17, 2026, and May 24, 2026.", "rule": "Historically Reported in Threat List", "criticality": 1, "timestamp": "2026-06-03T01:25:55.220Z", "criticalityLabel": "Unusual" }, { "mitigationString": "", "evidenceString": "1 sighting on 1 source: Bambenek Consulting C&C Blocklist.", "rule": "Recent C&C DNS Name", "criticality": 4, "timestamp": "2026-06-03T01:25:55.185Z", "criticalityLabel": "Very Malicious" } ] }, "entity": { "id": "idn:websitetheme.com", "name": "websitetheme.com", "type": "InternetDomainName" } } ] }, "counts": { "returned": 2, "total": 1039266 } } } } } } } } }, "components": { "parameters": { "FieldsParameter": { "in": "query", "name": "fields", "required": false, "schema": { "type": "string" }, "description": "The enrichment fields requested for the entities returned. Several fields can be given as a comma separated string.\n\nSee https://docs.recordedfuture.com/reference/enrichment-field-attributes for a list of values.\n" }, "MetadataParameter": { "in": "query", "name": "metadata", "required": false, "schema": { "enum": [ true, false ] }, "description": "Annotates the response with additional metadata explaining the response data elements." }, "CommentParameter": { "in": "query", "name": "comment", "required": false, "schema": { "type": "string" }, "deprecated": true }, "LimitParameter": { "in": "query", "name": "limit", "required": false, "schema": { "type": "integer", "format": "int32", "maximum": 1000 }, "description": "Maximum number of records returned," }, "FromParameter": { "in": "query", "name": "from", "required": false, "schema": { "type": "integer", "format": "int32", "default": 0 }, "description": "Offsets the pagination of the request. Note that there is a limit of returning only the top 1000 results from a search, meaning if limit plus from exceeds 1000, this will result in a Bad Request message." }, "RiskScoreParameter": { "in": "query", "name": "riskScore", "required": false, "schema": { "type": "string" }, "description": "Filters entities based on risk score, e.g. on the form [20, 80] (20 <= risk score <= 80), [20,) (20 <= risk score), or [,90) (risk score < 90). '[' and ']' are inclusive while '(' and ')' are exclusive.\n" }, "FirstSeenParameter": { "in": "query", "name": "firstSeen", "required": false, "schema": { "type": "string" }, "description": "Filters entities based on the download of the first reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.\n" }, "LastSeenParameter": { "in": "query", "name": "lastSeen", "required": false, "schema": { "type": "string" }, "description": "Filters entities based on the download of the latest reference which is taken into account during risk scoring of the entity. All Elasticsearch compatible date formats are valid.\n" }, "ListParameter": { "in": "query", "name": "list", "required": false, "schema": { "type": "string" }, "description": "Filters entities based on presence in a single list. Requires the list ID, which can be found using the List API\n" }, "ParentParameter": { "in": "query", "name": "parent", "required": false, "schema": { "type": "string" }, "description": "Filters for companies based on parent company. The expected value is a Company ID.\n" }, "DomainRiskRuleParameter": { "in": "query", "name": "riskRule", "required": false, "schema": { "enum": [ "recentCncSite", "recentMalwareSiteDetected", "recentPhishingSiteDetected", "recentFraudulentContent", "recentWeaponizedDomain", "recentAnalystNote", "recentUkraineLure", "recentCovidLure", "recentPhishingLureMalicious", "recentDetectedEskimmerInfectedDomain", "recentPhishingLureSuspicious", "recentSuspectedCncDnsName", "recentPhishingSiteSuspected", "recentMiningSiteDetected", "recentBotnetDomain", "recentSpamSiteDetected", "recentUkraineSpam", "recentCovidSpam", "weaponizedDomain", "recentlyDefaced", "multiBlacklist", "compromisedUrl", "fastFlux", "frequentlyAbusedDnsProvider", "recentTyposquatSandwich", "certTyposquatSandwich", "certTyposquatTypo", "resolvedVeryMaliciousIp", "resolvedMaliciousIp", "recentLinkedToCyberAttack", "recentThreatResearcher", "recentRelatedNote", "recentDhsAis", "phishingSiteSuspected", "botnetDomain", "recentProxyDomain", "proxyDomain", "defanged", "recentDefanged", "resolvedSuspiciousIp", "resolvedUnusualIp", "linkedToCyberAttack", "phishingUrl", "cncNameserver", "ddns", "rfTrending", "recentTyposquatTypo", "typosquatSandwich", "typosquatTypo", "analystNote", "relatedNote", "threatResearcher", "historicalThreatListMembership", "recentPunycode", "punycode", "ukraineLure", "covidLure", "phishingLure", "miningSiteDetected", "malwareSiteDetected", "phishingSiteDetected", "dhsAis", "fraudulentContent", "spamSiteDetected", "cncSite", "DetectedEskimmerInfecteddomain", "noKnownRisk" ] }, "description": "Filters for domains based on a single risk rule.\n" }, "OrderByParameter": { "in": "query", "name": "orderBy", "required": false, "schema": { "enum": [ "created", "modified", "sixtydayshits", "sevendayhits", "criticality", "riskscore", "totalhits", "firstseen", "lastseen", "rules" ] }, "description": "Sorts the search according to the chosen parameter. Results are sorted before pagination.\n" }, "DirectionParameter": { "in": "query", "name": "direction", "required": false, "schema": { "enum": [ "asc", "desc" ] }, "description": "The direction of the sorting by the orderBy parameter, ascending or descending.\n" } }, "schemas": { "CountsData": { "type": "object", "description": "Pagination counts.", "properties": { "returned": { "type": "integer", "description": "Number of results in this response page" }, "total": { "type": "integer", "description": "Total number of matching results across all pages" } } }, "BaseSearchResponse": { "type": "object", "description": "Paginated search results for entities matching the specified filters.", "properties": { "data": { "type": "object", "properties": { "results": { "type": "array", "description": "Array of matching entity objects. Each includes entity identification and enrichment data controlled by the fields parameter.", "items": { "type": "object", "properties": { "entity": { "type": "object", "description": "Entity identification.", "properties": { "id": { "type": "string", "description": "Recorded Future entity ID (e.g., ip:8.8.8.8, idn:example.com, hash:abc123)" }, "name": { "type": "string", "description": "Entity display name" }, "type": { "type": "string", "description": "Entity type classification (e.g., IpAddress, InternetDomainName, Hash, CyberVulnerability, Malware, Company, URL)" }, "description": { "type": "string", "description": "Entity description (present for vulnerabilities and some other types)." } } }, "risk": { "type": "object", "description": "Risk assessment data (included when fields contains 'risk').", "properties": { "score": { "type": "integer", "description": "Numeric risk score (0-99)" }, "criticality": { "type": "integer", "description": "Numeric criticality level (1-4)" }, "criticalityLabel": { "type": "string", "description": "Risk criticality label. IOC entities use: Unusual, Suspicious, Malicious, Very Malicious. Company entities use: Informational, Moderate, High, Very High.", "enum": [ "Informational", "Unusual", "Suspicious", "Moderate", "Malicious", "High", "Very Malicious", "Very High" ] }, "riskString": { "type": "string", "description": "Triggered rules vs total rules (e.g., 16/81)" }, "rules": { "type": "integer", "description": "Number of triggered risk rules" }, "riskSummary": { "type": "string", "description": "Human-readable risk summary" }, "evidenceDetails": { "type": "array", "description": "Evidence for each triggered risk rule.", "items": { "type": "object", "properties": { "rule": { "type": "string", "description": "Risk rule description" }, "criticality": { "type": "integer", "description": "Rule criticality level" }, "criticalityLabel": { "type": "string", "description": "Rule criticality label" }, "evidenceString": { "type": "string", "description": "Human-readable evidence summary" }, "timestamp": { "type": "string", "description": "ISO 8601 timestamp of the evidence" } } } } } }, "timestamps": { "type": "object", "description": "First and last seen timestamps for the entity.", "properties": { "firstSeen": { "type": "string", "format": "date-time", "description": "ISO 8601 timestamp of first observation." }, "lastSeen": { "type": "string", "format": "date-time", "description": "ISO 8601 timestamp of most recent observation." } } } } } } }, "required": [ "results" ] }, "counts": { "$ref": "#/components/schemas/CountsData" } }, "required": [ "data", "counts" ] }, "SearchResponseWithMetadata": { "description": "Paginated search results with optional request metadata.", "allOf": [ { "$ref": "#/components/schemas/BaseSearchResponse" }, { "type": "object", "properties": { "metadata": { "type": "object", "description": "Request metadata (included when metadata=true).", "properties": { "entries": { "type": "array", "description": "Metadata entries describing query parameters and their values.", "items": { "type": "object", "properties": { "key": { "type": "string", "description": "Parameter name." }, "label": { "type": "string", "description": "Human-readable label." }, "type": { "type": "string", "description": "Parameter type." }, "item": { "type": "object", "description": "Parameter value details." } } } } } } } } ] } }, "securitySchemes": { "ApiKeyAuth": { "description": "API Credential", "type": "apiKey", "in": "header", "name": "X-RFToken" } } }, "x-readme": { "explorer-enabled": true, "proxy-enabled": false } } ``` # Sibling pages * [Lookup a Domain entity by id](https://docs.recordedfuture.com/reference/domain-lookup.md) * [List Domain risk rules](https://docs.recordedfuture.com/reference/domain-risk-rules.md) * [Fetch Domain risk list](https://docs.recordedfuture.com/reference/domain-risk-list.md) * [Stat a domain risk list](https://docs.recordedfuture.com/reference/domain-stat-risk-list.md) * [Lookup a Domain entity by id by querying an Intelligence Card extension](https://docs.recordedfuture.com/reference/domain-lookup-extension.md) * [Fetch Domain risk list demo events](https://docs.recordedfuture.com/reference/domain-demo-events.md)