Find domains by risk score, risk rules, dates, or list membership with paginated enrichment results.
What this endpoint does
This endpoint searches the Recorded Future Intelligence Cloud for domain entities matching specified criteria. You can filter domains by risk score ranges, specific risk rules (use the Domain Risk Rules endpoint to get valid rule names), first/last seen dates, and Recorded Future list membership. Results can be sorted by risk score, criticality, total or recent reference counts, or chronological fields, enabling prioritized views of the most dangerous or recently active domains. The enrichment fields system lets you control which data is returned per result, such as entity identifiers and risk scoring—consult the Enrichment: Field Attributes reference for all available field options.
Response data
The response contains a paginated array of matching domain entities, each populated with the requested enrichment fields, along with count metadata showing the number of returned and total matching records. When risk data is requested, each domain includes a composite risk score (0-99), criticality level, and a breakdown of every triggered risk rule with supporting evidence—sighting counts, source descriptions, timestamps, and mitigation notes. Paginated with offset-based pagination; limit max 1,000 and limit + from cannot exceed 1,000. Results are under data.results, with counts as a sibling of data. The limit parameter has a default value of 10. The intention is to use pagination to get further results. Though limit can be set to higher values, depending on which fields are used for enrichment, this might result in slower queries and possibly even time outs.