Overview
The DomainTools API is organized into distinct products with queries that follow a RESTful URL structure wherever possible. Each product offers free, un-authenticated access for the sample URLs listed with each product. If you haven’t already, you may want to review the getting started document to learn about authentication and response formats.
The PhishEye API provides programmatic access to daily monitor results from the DomainTools PhishEye product. The PhishEye API is only available via our Enterprise Solutions team, and is not included in a membership.
Contact [email protected] for more details.
Term List
https://api.domaintools.com/v1/phisheye/term-list/
This endpoint provides a list of terms that are set up for this account. This call is not charged against your API usage limit. If multiple users in the same group are monitoring the same term, the response key ‘user_monitor_count’ for that term will reflect that with a value greater than 1.
PhishEye Domain List Parameters
| Parameter | Description |
|---|---|
| include_inactive | Use this parameter to display terms that may have been inactivated in users’ lists. Valid values are true or false. The default is false. |
NOTE: The terms must be configured in the PhishEye web UI. There is no API call to set up the terms.
Sample Term List Response
{
"response": {
"terms": [
{
"term": "apple",
"active": true,
"user_monitor_count": 2
},
{
"term": "chevrolet",
"active": true,
"user_monitor_count": 1
},
...
{
"term": "yahoo",
"active": false,
"user_monitor_count": 1
}
]
}
}
Domain List
https://api.domaintools.com/v1/phisheye?query=apple
This endpoint returns domain results for monitored terms. NOTE: We are unable to provide a functioning test URL for this product because the data changes each day. See below for a sample response.
PhishEye Domain List Parameters
| Parameter | Description |
|---|---|
| query | Required. Term for which the day’s domains are desired. Note that this must be a term that is already set up in the account before our processing cycle runs. |
| days_back | Use this parameter in exceptional circumstances where you need to find domains up to seven days prior to the current date. Set the value to an integer in the range of 1-7. |
Note that properties of a domain are only provided if we have been able to obtain them. Many domains will have incomplete data because that information isn’t available in their Whois records, or they don’t have DNS results for a name server or IP address.
Sample Domain List Response
{
"response": {
"term": "apple",
"date": "2016-11-01",
"domains": [
{
"domain" : "firstexample-apple.com",
"tld": "com",
"created_date": "2016-10-30",
"registrant_email": "[email protected]",
"name_servers": [
"ns1.example.com",
"ns2.example.com"
],
"registrar_name": "Some Registrar 1",
"risk_score": 88
},
{
"domain": "appeltypoexample.com",
"tld": "com",
"created_date": "2016-10-31",
"registrant_email": "[email protected]",
"ip_addresses": [
{
"ip": "192.0.2.100",
"country_code": "US"
},
{
"ip": "192.0.2.101",
"country_code": "US"
}
],
"name_servers": [
"ns57.domaincontrol.com",
"ns58.domaincontrol.com"
],
"registrar_name": "GoDaddy.com, LLC",
"risk_score": 24
},
{
"domain": "thirdexample-apple.ru",
"tld": "ru",
"created_date": "2014-09-23",
"registrant_email": "[email protected]",
"registrar_name": "1API GmbH",
"risk_score": 33
},
...
]
}
}
You must provide your API credentials to use this API.
Products
- Account Information
- Brand Monitor
- Domain Profile
- Domain Reputation
- Domain Risk Score
- Domain Search
- Hosting History
- IP Monitor
- IP Registrant Monitor
- Iris Detect
- Iris Enrich
- Iris Investigate
- Iris Pivot
- Name Server Monitor
- Parsed Whois
- PhishEye
- Registrant Monitor
- Reverse IP
- Reverse IP Whois
- Reverse Name Server
- Reverse Whois
- Whois History
- Whois Lookup
