---
title: Domain Squatting
slug: connectors/domain-squatting
docTags: 
createdAt: 2026-06-09T16:29:43.779Z
---

Domain Squatting helps organizations monitor and manage potential domain squatting threats by identifying and responding to suspicious domain registrations.

Domain Squatting is a critical security service that identifies and mitigates the risks associated with domain squatting. This connector enables Swimlane Turbine users to automate the detection, analysis, and response to potential squatting domains. By integrating with Domain Squatting, users can efficiently monitor domain activities, compare current and historical data, and take swift action to deactivate or refresh domain records. This integration enhances security operations by providing real-time insights and automated responses to potential threats, reducing the risk of brand impersonation and phishing attacks.

## Prerequisites

Before you can use the Domain Squatting connector for Turbine, you'll need access to the necessary authentication mechanisms. This requires the following:

- HTTP Basic Authentication using the following parameters:
  - Swimlane URL: The URL endpoint for accessing Swimlane services.
  - Swimlane Username: Your username for authenticating with Swimlane.
  - Swimlane Password: Your password for authenticating with Swimlane.
- API Key Authentication using the following parameters:
  - Swimlane URL: The URL endpoint for accessing Swimlane services.
  - Swimlane API/Admin PAT: Personal Access Token for API authentication.

## Capabilities

This connector provides the following capabilities:

- Check associated threat intelligence records reputation results
- Compare current and previous DOM hashes
- Create & erase snapshot records
- Deactivate all potential squatting domain records
- Find potential squatting domains
- Refresh potential squatting domains
- Retrieve associated monitored domain and threat intelligence records

## Initial Setup

:::BlockQuote
This connector is intended to work with the Swimlane Domain Squatting use case only.
:::

You will need:

- A Swimlane Administrator/API User Personal Access Token (PAT)
- Domain Squatting application(s) deployed to a Swimlane instance
  - Domain Squatting: Monitored Domain
  - Domain Squatting: Potential Squatting Domain
  - Domain Squatting: Snapshot
- Quickstart Application(s)
  - Threat Intel - Indicators and Artifacts

Note: Field names, etc. are case sensitive. Please enter just as you see in this documentation, or if using other field names, pay close attention to case sensitivity throughout setup.

### Required Assets

Swimlane Alert Correlation

- Swimlane URL: "sw-web:443" on SPI installations, "sw-web:4443" on Docker installations
- Swimlane API/Admin PAT: Personal Access Token (PAT) of an Administrative or API user

## Task Details

There are several different tasks within this connector which are specifically tailored to work with the `Domain Squatting` set of applications (e.g. Use Case). To help facilitate any troubleshooting or questions about this connector we have described each task as well as how it is used in connection with the `Domain Squatting` set of applications.

### Find Potential Squatting Domains

:::BlockQuote
This is used as a scheduled task with the Domain Squatting Use Case
:::

The `Find Potential Squatting Domains` task utilizes [dominions](https://github.com/swimlane/dominions) (an open-source project developed by the Swimlane Deep Dive team). `dominions` is a Python package that searches `WhoisDS` for newly registered domains. `dominions` accepts a domain name as input and performs three different algorithms and checks this against newly registered domains:

- contained\_in - Checks to see if the domain is contained within a newly registered domain.
- levenshtein - Checks the Levenshtein Distance the provided domain is to a newly registered domain.
- confusables - Checks to see if the domain contains confusables that match a newly registered domain.

The following inputs for this task are defined below:

- Monitored Domain Application Name (str): The string name of the monitored domain application within Swimlane. Default is `Domain Squatting: Monitored Domain`
- Domain To Monitor Field Display Name (str): The field display name that represents the `Domain to Monitor`. Default is `Domain to Monitor`
- Search Active Field Display Name (str): The field display name that represents whether a search is active or not. Default is `Search Active`
- Maximum Potential Squatting Domains Per Day Field Display Name (str, optional): The field display name that represents the maximum potential squatting domains that should be identified for a given domain. Default is `Maximum Potential Squatting Domains Per Day`

This task will output the following:

- Potential Squatting Domain (str): The potential squatting domain from the `Domain To Monitor Field Display Name` field.
- Monitored Domain Record ID (str): The potential squatting domain Swimlane application record ID.
- Matched Domain (str): A matched domain
- Search Term (str): The search term that identified the matched domain.
- Search Term Match Methods (list): All match methods. Options include `contained_in`,`levenshtein`, and `confusables`

### Refresh Active Potential Squatting Domains

:::BlockQuote
This is used as a scheduled task with the Domain Squatting Use Case
:::

The `Refresh Active Potential Squatting Domains` task periodically runs and runs `patch` (update) on any `Potential Squatting Domain` records `status` field to `Preparing for Submission` which will in turn kick off workflow within that application record.

The following inputs for this task are defined below:

- Potential Squatting Domain Application Name (str): The string name of the potential squatting domain application within Swimlane. Default is `Domain Squatting: Potential Squatting Domain`
- Scan Active Field Display Name (str): The field display name that represents whether there is an active scan on a record. Default is `Scan Active`
- Status Field Display Name (str): The field display name that represents the current status for a potential squatting domain record. Default is `Status`
- Target Status Field Display Name (str): The status to set within all potential squatting domain recods. Default is `Preparing for Submission`

This task will output the following:

- Success (bool): Whether the task was successful.
- Errors (str): Errors if they occured when running the task.
- Completed (datetime): An ISO8601 date timestamp when the task was completed.
- Records Refreshed (list): A list of records refreshed.

### Check Threat Intelligence Reputation

:::BlockQuote
This is used as part of workflow within the `Potential Squatting Domain` application
:::

The `Check Threat Intelligence Reputation` task is triggered via workflow to check a `Threat Intel - Indicators and Artifacts` application for any associated IOCs.

The following inputs for this task are defined below:

- Landing Page Threat Intelligence Reference Record Display Name (str): The field display name that represents the a reference record containing a potential squatting domains landing page record. Default is `Landing Page Threat Intelligence Records`
- Langing Page Threat Intelligence Reference Record Verdict Field Display Name (str): The field display name that represents the verdict for the provided `Landing Page Threat Intelligence Reference Record Display Name` reference record. Default is `TI Tag`
- Associated IOC Threat Intelligence Reference Record Display Name (str): The field display name that represents any associated threat intelligence via a Associated IOC reference record. Default is `Associated IOC Threat Intelligence Records`
- Associated IOC Threat Intelligence Reference Record Verdict Field Display Name (str): The field display name that represents the verdict for the provided `Associated IOC Threat Intelligence Reference Record Display Name` reference record. Default is `TI Tag`

This task will output the following:

- Current Landing Page Verdict (str): The current landing page verdict (e.g. Malicious, Suspicious, etc.)
- Current Associated IOC Verdict (str): The current associated IOC verdict (e.g. Malicious, Suspicious, etc.)
- Current Automated Verdict (str): The current overall automated verdict (e.g. Malicious, Suspicious, etc.)
- Completed (datetime): An ISO8601 date timestamp when the task was completed.

### Compare Current DOM Hashes to Previous DOM Hashes

:::BlockQuote
This is used as part of workflow within the `Potential Squatting Domain` application
:::

The `Compare Current DOM Hashes to Previous DOM Hashes` task is triggered via workflow and compares the current DOM hash to all previous DOM hashes.

The following inputs for this task are defined below:

- Most Recent DOM (str): The most recent captured DOM string.
- Previous DOM Fuzzy Hashes (str): All previous DOM fuzzy hashes.
- Snapshot Match Threshold (int, optional). The snapshot threshold for matching current DOM to previous DOMs. Default is 75.

This task will output the following:

- Previous DOM Fuzzy Hashes (list): An updated list of DOM fuzzy hashes from current plus previous DOM hashes.
- Create New Snapshot Record (bool): Whether or not to create a new snaphsot record.
- Most Recent DOM Fuzzy Hash (str): The most recent DOM fuzzy hash.
- Max Match Percentage (int): The maximum TLSH match percentage identified.

### Create Snapshot Record from Current Snapshot

:::BlockQuote
This is used as part of workflow within the `Potential Squatting Domain` application
:::

The `Create Snapshot Record from Current Snapshot` task is triggered via workflow and creates a `Snapshot` record using the current record data. This task is essentially a pass through that takes inputs you've defined and outputs them so you can create a new record in the `Snapshot` application. The only addition is the `Completed` timestamp field is added as an output.

There are several inputs for this task (too many to list out here) and all are optional but we recommend that you use as many as possible for your application.

### Deactivate All Potential Squatting Domains

:::BlockQuote
This is used as part of workflow within the `Monitored Domain` application
:::

The `Deactivate All Potential Squatting Domains` task is used to deactivate all potential squatting domains within the `Monitored Domain` application.

The following inputs for this task are defined below:

- Potential Squatting Domains Display Name (str): The field display name that represents a potential squatting domain(s) within `Monitored Domain` records. Default is `Potential Squatting Domains`
- Scan Active Field Display Name (str): The field display name that represents whether there is an active scan on a record. Default is `Scan Active`

This task will output the following:

- Deactivation Status (str): The deactivation status.
- Completed (datetime): An ISO8601 date timestamp when the task was completed.

### Erase Current Snapshot Info

:::BlockQuote
This is used as part of workflow within the `Potential Squatting Domain` application
:::

The `Erase Current Snapshot Info` task is triggered via a widget/button and will erase data from provided fields within a Snapshot record.

The following inputs for this task are defined below:

- Field Names (list): The field display name(s) to erase data from. Default is `Most Recent URLScan DOM, Most Recent URLScan JSON, URLScan Most Recent UUID, URLScan Result, URLScan Message, Create New Snapshot Record, Most Recent Status Code, Requests, Certificates, Domains Contacted, Countries Contacted, IPs Contacted, Link Domains, Servers Contacted, URLs Requested,Final URL, Links, Current Indicators, Current Landing Page Verdict, Current Associated IOC Verdict, Current Automated Verdict, Landing Page Submitted to Threat Intelligence, Associated IOCs Submitted to Threat Intelligence, Max Match Percentage, Most Recent URLScan Screenshot Attachment, Associated IOC Threat Intelligence Records`

```javascript
Most Recent URLScan DOM, Most Recent URLScan JSON, URLScan Most Recent UUID, URLScan Result, URLScan Message, Create New Snapshot Record, Most Recent Status Code, Requests, Certificates, Domains Contacted, Countries Contacted, IPs Contacted, Link Domains, Servers Contacted, URLs Requested,Final URL, Links, Current Indicators, Current Landing Page Verdict, Current Associated IOC Verdict, Current Automated Verdict, Landing Page Submitted to Threat Intelligence, Associated IOCs Submitted to Threat Intelligence, Max Match Percentage, Most Recent URLScan Screenshot Attachment, Associated IOC Threat Intelligence Records
```

This task will output the following:

- Success (bool): Whether the task was successful.
- Errors (str): Errors if they occured when running the task.
- Completed (datetime): An ISO8601 date timestamp when the task was completed.

### Retrieve Associated Monitored Domain Record

:::BlockQuote
This is used as part of workflow within the `Potential Squatting Domain` application
:::

The `Retrieve Associated Monitored Domain Record` retrieves all associated monitored domain records within the `Potential Squatting Domain` application.

The following inputs for this task are defined below:

- Reference Field Display Name (str): The field display name that represents reference record of monitored domains. Default is `Monitored Domains`
- Reference Field ID Display Name (str): The field display name that represents the monitored domain record ID. Default is `Monitored Domain Record ID`

This task will output the following:

- Success (bool): Whether the task was successful.
- Errors (str): Errors if they occured when running the task.
- Completed (datetime): An ISO8601 date timestamp when the task was completed.

### Retrieve Associated Threat Intelligence Records

:::BlockQuote
This is used as part of workflow within the `Snapshot` application
:::

The `Retrieve Associated Threat Intelligence Records` retrieves all associated threat intelligence records on a potential squatting domain.

The following inputs for this task are defined below:

- Landing Page Threat Intelligence Field Display Name (str): The field display name that represents the a reference record containing a potential squatting domains landing page record. Default is `Landing Page Threat Intelligence Records`
- Landing Page Record IDs (list): A mapped field that contains a list of Landing Page Record IDs
- Associated IOC Threat Intelligence Reference Record Display Name (str): The field display name that represents any associated threat intelligence via a Associated IOC reference record. Default is `Associated IOC Threat Intelligence Records`
- Associated IOC Record IDs (list):  A mapped field that contains a list of associated IOC record IDs

This task will output the following:

- Completed (datetime): An ISO8601 date timestamp when the task was completed.

# Configurations

## API Key Authentication

Authenticates using an API Key

### Configuration Parameters

| **Parameter**      | **Description**                                                                                         | **Type** | **Required** |
| ------------------ | ------------------------------------------------------------------------------------------------------- | -------- | ------------ |
| url                | Internal URL of your Swimlane Instance, i.e. 'sw-web:443', 'sw-web:4443' or FQDN of Load Balancer.      | string   | Required     |
| swimlane\_api\_pat | Personal Access Token (PAT) for an API/Administrative user of Swimlane.                                 | string   | Required     |
| account\_id        | Account ID for multi-tenant environments. Required for multi-tenant mode (must be used with Tenant ID). | string   | Optional     |
| tenant\_id         | Tenant ID for multi-tenant environments. Required for multi-tenant mode (must be used with Account ID). | string   | Optional     |
| verify\_ssl        | Verify SSL certificate                                                                                  | boolean  | Optional     |
| http\_proxy        | A proxy to route requests through.                                                                      | string   | Optional     |

## HTTP Basic Authentication

Authenticates using username and password.

### Configuration Parameters

| **Parameter** | **Description**                                                                                             | **Type** | **Required** |
| ------------- | ----------------------------------------------------------------------------------------------------------- | -------- | ------------ |
| url           | Internal URL of your Swimlane Instance, i.e. 'sw-web:443', 'sw-web:4443' or FQDN of Load Balancer.          | string   | Required     |
| username      | Username for an API/Administrative user of Swimlane.  Use with password as an alternative to API/Admin PAT. | string   | Required     |
| password      | Password for an API/Administrative user of Swimlane.  Use with username as an alternative to API/Admin PAT. | string   | Required     |
| account\_id   | Account ID for multi-tenant environments. Required for multi-tenant mode (must be used with Tenant ID).     | string   | Optional     |
| tenant\_id    | Tenant ID for multi-tenant environments. Required for multi-tenant mode (must be used with Account ID).     | string   | Optional     |
| verify\_ssl   | Verify SSL certificate                                                                                      | boolean  | Optional     |
| http\_proxy   | A proxy to route requests through.                                                                          | string   | Optional     |

# Actions

## Check Threat Intelligence Reputation

Checks a squatting domain against a Threat Intelligence application using specified ApplicationId and RecordId.

### Input

| **Argument Name**                                                         | **Type** | **Required** | **Description**                                                                            |
| ------------------------------------------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------ |
| `landing_page_threat_intelligence_reference_display_name`                 | string   | Required     | The display name of the landing page threat intelligence reference record.                 |
| `landing_page_threat_intelligence_reference_verdict_field_display_name`   | string   | Required     | The display name of the landing page threat intelligence reference record verdict field.   |
| `associated_ioc_threat_intelligence_reference_display_name`               | string   | Required     | The display name of the associated IOC threat intelligence reference record.               |
| `associated_ioc_threat_intelligence_reference_verdict_field_display_name` | string   | Required     | The display name of the associated IOC threat intelligence reference record verdict field. |
| `ApplicationId`                                                           | string   | Required     | The ID of the application to check the threat intelligence reputation of.                  |
| `RecordId`                                                                | string   | Required     | The ID of the record to check the threat intelligence reputation of.                       |

### Input Example

`{"landing_page_threat_intelligence_reference_display_name":"Landing Page Threat Intelligence Records","landing_page_threat_intelligence_reference_verdict_field_display_name":"TI Tag","associated_ioc_threat_intelligence_reference_display_name":"Associated IOC Threat Intelligence Records","associated_ioc_threat_intelligence_reference_verdict_field_display_name":"TI Tag","ApplicationId":"aBLmK0zmAm8gfUY1A","RecordId":"aBLmK0zmAm8gfUY1A"}`

### Output

| **Parameter**    | **Type** | **Description**               |
| ---------------- | -------- | ----------------------------- |
| `landing_page`   | string   | Output field: landing\_page   |
| `associated_ioc` | string   | Output field: associated\_ioc |
| `verdict`        | string   | Output field: verdict         |
| `completed`      | string   | Output field: completed       |

### Output Example

`{"landing_page":"Current Landing Page Verdict","associated_ioc":"Current Associated IOC Verdict","verdict":"Current Automated Verdict","completed":"Tue, 24 Oct 2023 06:28:56 GMT"}`

## Compare Current DOM Text to Previous DOM Hashes

Compare the current DOM text to previously captured DOM SSDeep hashes using Domain Squatting. Requires most\_recent\_dom and previous\_fuzzy\_hashes inputs.

### Input

| **Argument Name**          | **Type** | **Required** | **Description**                               |
| -------------------------- | -------- | ------------ | --------------------------------------------- |
| `most_recent_dom`          | string   | Required     | The most recent DOM.                          |
| `previous_fuzzy_hashes`    | array    | Required     | Previous DOM fuzzy hashes                     |
| `snapshot_match_threshold` | number   | Optional     | SSDeep Snapshot match threshold (percentage). |

### Input Example

`{"most_recent_dom":"<html></html>","previous_fuzzy_hashes":["6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezocKqD:J0+oxBeRmR9etdzRxGez1T"],"snapshot_match_threshold":91}`

### Output

| **Parameter**                | **Type** | **Description**                              |
| ---------------------------- | -------- | -------------------------------------------- |
| `previous_dom_fuzzy_hashes`  | array    | Output field: previous\_dom\_fuzzy\_hashes   |
| `create_new_snapshot_record` | boolean  | Output field: create\_new\_snapshot\_record  |
| `most_recent_dom_fuzzy_hash` | string   | Output field: most\_recent\_dom\_fuzzy\_hash |
| `max_match_percentage`       | number   | Output field: max\_match\_percentage         |

### Output Example

`{"previous_dom_fuzzy_hashes":["Previous DOM Fuzzy Hashes"],"create_new_snapshot_record":true,"most_recent_dom_fuzzy_hash":"Most Recent DOM Fuzzy Hash","max_match_percentage":3}`

## Create Snapshot Record from Current Snapshot

Create a new record in the Domain Squatting Snapshot application using the current snapshot of a potential squatting domain.

### Input

| **Argument Name**            | **Type** | **Required** | **Description**                 |
| ---------------------------- | -------- | ------------ | ------------------------------- |
| `screenshot_attachment`      | string   | Optional     | Screenshot Attachment File.     |
| `most_recent_dom`            | string   | Optional     | The most recent DOM.            |
| `urlscan_result`             | string   | Optional     | URLScan Result.                 |
| `json`                       | string   | Optional     | Most recent URLScan Json.       |
| `requests`                   | string   | Optional     | HTTP requests data.             |
| `certificates`               | string   | Optional     | Certificate data.               |
| `domains_contacted`          | array    | Optional     | Domains contacted.              |
| `countries_contacted`        | array    | Optional     | Countries contacted.            |
| `ips_contacted`              | array    | Optional     | IPs contacted.                  |
| `link_domains`               | array    | Optional     | Link domains.                   |
| `servers_contacted`          | array    | Optional     | Servers contacted.              |
| `urls_requested`             | array    | Optional     | URLs requested.                 |
| `most_recent_dom_fuzzy_hash` | string   | Optional     | Most recent DOM fuzzy hash.     |
| `final_url`                  | string   | Optional     | Final URL.                      |
| `potential_squatting_domain` | string   | Required     | Potential squatting domain.     |
| `automated_verdict`          | string   | Optional     | Current automated verdict.      |
| `landing_page_verdict`       | string   | Optional     | Current landing page verdict.   |
| `associated_ioc_verdict`     | string   | Optional     | Current associated IOC verdict. |
| `analyst_verdict`            | string   | Optional     | Analyst verdict.                |
| `customer`                   | string   | Optional     | Customer.                       |
| `search_term`                | string   | Optional     | Search term.                    |
| `search_term_match_methods`  | array    | Optional     | Search term match methods.      |
| `whois_information`          | string   | Optional     | WHOIS information.              |
| `max_match_percentage`       | number   | Optional     | Maximum match percentage.       |
| `most_recent_status_code`    | string   | Optional     | Most recent status code.        |

### Input Example

`{"screenshot_attachment":"Swimlane Attachment","most_recent_dom":"<html></html>","urlscan_result":"<html></html>","json":"[{'requests': []}]","requests":"[{'requests': []}]","certificates":"[{'requests': []}]","domains_contacted":["go.microsoft.com, api.okta.com"],"countries_contacted":["United States, China"],"ips_contacted":["1.2.3.4,123.123.123.123"],"link_domains":["swimlane.com, google.com"],"servers_contacted":["Apache, Microsoft-IIS/10.0"],"urls_requested":["https://swimlane.com, https://google.com"],"most_recent_dom_fuzzy_hash":"1536:KcVCFHMzjwhAWlWAWfWLWhVLvL/iyuLyEIheFoceBkUq6L0z4KjPJXzzZImtNAzr:KcCp5bMC1E+4oRzoCW","final_url":"https://swimlane.com","potential_squatting_domain":"sw1mlan3.com","automated_verdict":"Malicious","landing_page_verdict":"Suspicious","associated_ioc_verdict":"Benign","analyst_verdict":"Malicious","customer":"Swimlane","search_term":"google.com","search_term_match_methods":["levenshtein, contained_in"],"whois_information":"Domain Name: LOGINMICROSOFTONLINECOMCOMNOAUTTHORIZE.XYZ\nRegistry Domain ID: D239882803-CNIC\nRegistrar WHOIS Server: whois.namesilo.com","max_match_percentage":75,"most_recent_status_code":"204","landing_page_threat_intelligence_records":["5b6887bfa7772fa3692516af, 5b6887c09a6cf142fc3824f7"],"associated_ioc_threat_intelligence_records":["5b6887bfa7772fa3692516af, 5b6887c09a6cf142fc3824f7"],"current_indicators":["123.123.123.123, swimlane.com"],"urlscan_most_recent_uuid":"e57c3c76-1902-40eb-be0f-24aa9f299e8b","urlscan_message":"Submission successful"}`

### Output

| **Parameter**                     | **Type** | **Description**                              |
| --------------------------------- | -------- | -------------------------------------------- |
| `screenshot_attachment`           | array    | Output field: screenshot\_attachment         |
| `screenshot_attachment.file_name` | string   | Name of the resource                         |
| `screenshot_attachment.file`      | string   | Output field: screenshot\_attachment.file    |
| `most_recent_dom`                 | string   | Output field: most\_recent\_dom              |
| `urlscan_result`                  | string   | URL endpoint for the request                 |
| `json`                            | string   | Output field: json                           |
| `requests`                        | string   | Output field: requests                       |
| `certificates`                    | string   | Output field: certificates                   |
| `domains_contacted`               | array    | Output field: domains\_contacted             |
| `countries_contacted`             | array    | Output field: countries\_contacted           |
| `ips_contacted`                   | array    | Output field: ips\_contacted                 |
| `link_domains`                    | array    | Output field: link\_domains                  |
| `servers_contacted`               | array    | Output field: servers\_contacted             |
| `urls_requested`                  | array    | URL endpoint for the request                 |
| `most_recent_dom_fuzzy_hash`      | string   | Output field: most\_recent\_dom\_fuzzy\_hash |
| `final_url`                       | string   | URL endpoint for the request                 |
| `potential_squatting_domain`      | string   | Output field: potential\_squatting\_domain   |
| `automated_verdict`               | string   | Output field: automated\_verdict             |
| `landing_page_verdict`            | string   | Output field: landing\_page\_verdict         |
| `associated_ioc_verdict`          | string   | Output field: associated\_ioc\_verdict       |
| `analyst_verdict`                 | string   | Output field: analyst\_verdict               |
| `customer`                        | string   | Output field: customer                       |
| `search_term`                     | string   | Output field: search\_term                   |
| `search_term_match_methods`       | array    | HTTP method to use                           |
| `whois_information`               | string   | Output field: whois\_information             |

### Output Example

`{"screenshot_attachment":[],"most_recent_dom":"Most Recent DOM","urlscan_result":"URLScan Result","json":"Most Recent URLScan JSON","requests":"Requests","certificates":"Certificates","domains_contacted":["Domains Contacted"],"countries_contacted":["Countries Contacted"],"ips_contacted":["IPs Contacted"],"link_domains":["Link Domains"],"servers_contacted":["Servers Contacted"],"urls_requested":["URLs Requested"],"most_recent_dom_fuzzy_hash":"Most Recent DOM Fuzzy Hash","final_url":"Final URL","p...`

## Deactivate All Potential Squatting Domains

Deactivate all potential squatting domains using ApplicationId, RecordId, potential squatting domain display name, and scan active field display name.

### Input

| **Argument Name**                         | **Type** | **Required** | **Description**                                                             |
| ----------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------- |
| `potential_squatting_domain_display_name` | string   | Required     | Potential squatting domain field display name.                              |
| `scan_active_field_display_name`          | string   | Required     | Scan Active field display name.                                             |
| `ApplicationId`                           | string   | Required     | The ID of the application to deactivate all potential squatting domains of. |
| `RecordId`                                | string   | Required     | The ID of the record to deactivate all potential squatting domains of.      |

### Input Example

`{"potential_squatting_domain_display_name":"Potential Squatting Domain","scan_active_field_display_name":"Scan Active","ApplicationId":"aBLmK0zmAm8gfUY1A","RecordId":"aBLmK0zmAm8gfUY1A"}`

### Output

| **Parameter**         | **Type** | **Description**                    |
| --------------------- | -------- | ---------------------------------- |
| `deactivated_records` | array    | Output field: deactivated\_records |
| `completed`           | string   | Output field: completed            |

### Output Example

`{"deactivated_records":["Deactivated Records"],"completed":"Tue, 24 Oct 2023 06:28:56 GMT"}`

## Erase Current Snapshot Info

Erase the current snapshot information in Domain Squatting using RecordId and ApplicationId.

### Input

| **Argument Name** | **Type** | **Required** | **Description**                               |
| ----------------- | -------- | ------------ | --------------------------------------------- |
| `field_names`     | array    | Optional     | Field names to erase data from.               |
| `RecordId`        | string   | Required     | The ID of the record to erase data from.      |
| `ApplicationId`   | string   | Required     | The ID of the application to erase data from. |

### Input Example

`{"field_names":["Most Recent URLScan DOM, Most Recent URLScan Json, etc."],"RecordId":"aBLmK0zmAm8gfUY1A","ApplicationId":"aBLmK0zmAm8gfUY1A"}`

### Output

| **Parameter** | **Type** | **Description**                      |
| ------------- | -------- | ------------------------------------ |
| `success`     | boolean  | Whether the operation was successful |
| `errors`      | string   | Error message if any                 |
| `completed`   | string   | Output field: completed              |

### Output Example

`{"success":true,"errors":"Errors","completed":"Tue, 24 Oct 2023 06:28:56 GMT"}`

## Find Potential Squatting Domains

Identify potential squatting domains by monitoring specified domain names. Requires monitored domain application name, domain to monitor display name, and search active display name.

### Input

| **Argument Name**                        | **Type** | **Required** | **Description**                                                 |
| ---------------------------------------- | -------- | ------------ | --------------------------------------------------------------- |
| `monitored_domain_application_name`      | string   | Required     | Name of the application containing domains to monitor.          |
| `domain_to_monitor_display_name`         | string   | Required     | Domain to monitor field display name.                           |
| `search_active_display_name`             | string   | Required     | Search active field display name.                               |
| `maximum_squatting_domains_display_name` | string   | Optional     | Maximum potential squatting domains per day field display name. |

### Input Example

`{"monitored_domain_application_name":"Domain Squatting: Monitored Domain","domain_to_monitor_display_name":"Domain to Monitor","search_active_display_name":"Search Active","maximum_squatting_domains_display_name":"Maximum Potential Squatting Domains Per Day"}`

### Output

| **Parameter**                        | **Type** | **Description**         |
| ------------------------------------ | -------- | ----------------------- |
| `results`                            | array    | Result of the operation |
| `results.potential_squatting_domain` | string   | Result of the operation |
| `results.monitored_domain_record_id` | string   | Unique identifier       |
| `results.matched_domain`             | string   | Result of the operation |
| `results.search_term`                | string   | Result of the operation |
| `results.search_term_match_methods`  | array    | HTTP method to use      |

### Output Example

`{"results":[]}`

## Refresh Active Potential Squatting Domains

Refresh data for active potential squatting domain records in Domain Squatting using specified application and field names.

### Input

| **Argument Name**                     | **Type** | **Required** | **Description**                                  |
| ------------------------------------- | -------- | ------------ | ------------------------------------------------ |
| `potential_squatting_domain_app_name` | string   | Required     | The potential squatting domain application name. |
| `scan_active_field_display_name`      | string   | Required     | The display name of the 'scan active' field.     |
| `status_field_display_name`           | string   | Required     | The display name of the 'status' field.          |
| `target_status_field_display_name`    | string   | Required     | The target value for the defined Status field.   |

### Input Example

`{"potential_squatting_domain_app_name":"Domain Squatting: Potential Squatting Domain","scan_active_field_display_name":"Scan Active","status_field_display_name":"Status","target_status_field_display_name":"Preparing for Submission"}`

### Output

| **Parameter**       | **Type** | **Description**                      |
| ------------------- | -------- | ------------------------------------ |
| `success`           | boolean  | Whether the operation was successful |
| `errors`            | string   | Error message if any                 |
| `completed`         | string   | Output field: completed              |
| `records_refreshed` | array    | Output field: records\_refreshed     |

### Output Example

`{"success":true,"errors":"Errors","completed":"Tue, 24 Oct 2023 06:28:56 GMT","records_refreshed":["Records Refreshed"]}`

## Retrieve Associated Record

Retrieve associated records in Domain Squatting using ApplicationId, RecordId, reference\_record\_id\_display\_name, and reference\_field\_display\_name.

### Input

| **Argument Name**                  | **Type** | **Required** | **Description**                                                              |
| ---------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------- |
| `reference_record_id_display_name` | string   | Required     | The display name of a list field containing record IDs.                      |
| `reference_field_display_name`     | string   | Required     | The display name of reference field that the record IDs will be mapped into. |
| `ApplicationId`                    | string   | Required     | The ID of the application to retrieve the associated record from.            |
| `RecordId`                         | string   | Required     | The ID of the record to retrieve the associated record from.                 |

### Input Example

`{"reference_record_id_display_name":"Monitored Domain Record Id","reference_field_display_name":"Monitored Domains","ApplicationId":"aBLmK0zmAm8gfUY1A","RecordId":"aBLmK0zmAm8gfUY1A"}`

### Output

| **Parameter** | **Type** | **Description**                      |
| ------------- | -------- | ------------------------------------ |
| `success`     | boolean  | Whether the operation was successful |
| `errors`      | string   | Error message if any                 |
| `completed`   | string   | Output field: completed              |

### Output Example

`{"success":true,"errors":"Errors","completed":"Tue, 24 Oct 2023 06:28:56 GMT"}`

# Response Headers

| **Header**   | **Description**                                       | **Example**                   |
| ------------ | ----------------------------------------------------- | ----------------------------- |
| Content-Type | The media type of the resource                        | application/json              |
| Date         | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |