Domaintools

DomainTools provides domain and DNS-based threat intelligence to help organizations investigate and monitor domain names.

DomainTools is a leading provider of domain and DNS-based cyber threat intelligence. This connector enables Swimlane Turbine users to automate the enrichment and investigation of domain-related data, enhancing threat detection and response capabilities. By integrating DomainTools, users can efficiently monitor domain activities, assess domain reputations, and retrieve historical domain data, all within the Swimlane platform. This integration empowers security teams to streamline their workflows, reduce manual efforts, and make informed decisions based on comprehensive domain intelligence.

Prerequisites

Before you can use the DomainTools connector for Turbine, you'll need access to the DomainTools API. This requires the following:

API key authentication using the following parameters:

URL: The endpoint URL for accessing DomainTools API services.

API Key: A unique key provided by DomainTools to authenticate API requests.

Capabilities

The DomainTools Connector has the following capabilities:

Add and Remove Domain Watchlist

Get Brand Monitor

Get Domain Profile

Get Hosting History

Get Reputation

Get Reverse IP

Get Reverse WhoIS

Get WhoIS

Get WhoIS History

Additional Documentation

Domaintools Connector Documentation

Domaintools API Documentation

Configurations

DomainTools Intelligence API Key Authentication

Authenticates using an API Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
api_username	Username	string	Optional
api_key	API key	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Add and Remove Domain Watchlist

Add or remove domains from the DomainTools Watchlist to track recent DNS or Whois changes. Requires 'watchlist_domain_ids' and 'state'.

Endpoint

URL: /v1/iris-detect/domains/

Method: PATCH

Input

Argument Name	Type	Required	Description
watchlist_domain_ids	array	Optional	ID(s) of domains being triaged.
state	string	Optional	Add domains to Watchlist or ignore and mute alerts for those domains.

Input Example

{"json_body":{"watchlist_domain_ids":["AaLMA1oOE0"],"state":"watched"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
watchlist_domains	array	Output field: watchlist_domains
watchlist_domains.state	string	Output field: watchlist_domains.state
watchlist_domains.domain	string	Output field: watchlist_domains.domain
watchlist_domains.discovered_date	string	Date value
watchlist_domains.changed_date	string	Date value
watchlist_domains.id	string	Unique identifier
watchlist_domains.assigned_by	string	Output field: watchlist_domains.assigned_by
watchlist_domains.assigned_date	string	Date value

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"watchlist_domains":[{}]}}

Brand Monitor

Search new domain registrations globally for names containing a specified brand or string using DomainTools. Requires a query parameter.

Endpoint

URL: v1/mark-alert

Method: GET

Input

Argument Name	Type	Required	Description
parameters.query	string	Required	Parameters for the Brand Monitor action

Input Example

{"parameters":{"query":"domaintools"}}

Domain Profile

Retrieve basic registration details and a preview of extended data for a specified domain using DomainTools. Requires the domain as a path parameter.

Endpoint

URL: /v1/{{domain}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.domain	string	Required	Parameters for the Domain Profile action

Input Example

{"path_parameters":{"domain":"domaintools.com"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
data	object	Response data
data.response	object	Response data
data.response.registrant	object	Response data
data.response.registrant.name	string	Response data
data.response.registrant.domains	number	Response data
data.response.registrant.product_url	string	Response data
data.response.server	object	Response data
data.response.server.ip_address	string	Response data
data.response.server.other_domains	number	Response data
data.response.server.product_url	string	Response data
data.response.registration	object	Response data
data.response.registration.created	string	Response data
data.response.registration.expires	string	Response data
data.response.registration.updated	string	Response data
data.response.registration.registrar	string	Response data
data.response.registration.statuses	array	Response data
data.response.name_servers	array	Response data
data.response.name_servers.server	string	Response data
data.response.name_servers.product_url	string	Response data
data.response.history	object	Response data
data.response.history.registrar	object	Response data
data.response.history.registrar.earliest_event	string	Response data
data.response.history.registrar.events	number	Response data
data.response.history.registrar.product_url	string	Response data

Output Example

{"data":{"response":{"registrant":{},"server":{},"registration":{},"name_servers":[],"history":{},"seo":{},"website_data":{}}},"response_text":"string"}

Domain Reputation

Retrieve a risk score for a specified domain from DomainTools, aiding in the assessment of its reputation.

Endpoint

URL: v1/reputation

Method: GET

Input

Argument Name	Type	Required	Description
parameters.domain	string	Required	Parameters for the Domain Reputation action

Input Example

{"parameters":{"domain":"domaintools.com"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
data	object	Response data
data.response	object	Response data
data.response.domain	string	Response data
data.response.risk_score	number	Response data
response_text	string	Output field: response_text
reason	string	Response reason phrase

Output Example

{"data":{"response":{"domain":"string","risk_score":123}},"response_text":"string"}

Hosting History

Retrieve a domain's registrar, IP, and name server changes over time using DomainTools' Hosting History API. Requires the domain as a path parameter.

Endpoint

URL: v1/{{domain}}/hosting-history

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.domain	string	Required	Parameters for the Hosting History action

Input Example

{"path_parameters":{"domain":"domaintools.com"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
data	object	Response data
data.response	object	Response data
data.response.domain_name	string	Response data
data.response.ip_history	array	Response data
data.response.ip_history.domain	string	Response data
data.response.ip_history.post_ip	string	Response data
data.response.ip_history.pre_ip	string	Response data
data.response.ip_history.action	string	Response data
data.response.ip_history.actiondate	string	Response data
data.response.ip_history.action_in_words	string	Response data
data.response.registrar_history	array	Response data
data.response.registrar_history.domain	string	Response data
data.response.registrar_history.date_updated	string	Response data
data.response.registrar_history.date_created	string	Response data
data.response.registrar_history.date_expires	string	Response data
data.response.registrar_history.date_lastchecked	string	Response data
data.response.registrar_history.registrar	string	Response data
data.response.registrar_history.registrartag	string	Response data
data.response.nameserver_history	array	Response data
data.response.nameserver_history.domain	string	Response data
data.response.nameserver_history.action	string	Response data
data.response.nameserver_history.actiondate	string	Response data
data.response.nameserver_history.action_in_words	string	Response data
data.response.nameserver_history.post_mns	string	Response data

Output Example

{"data":{"response":{"domain_name":"Example Name","ip_history":[],"registrar_history":[],"nameserver_history":[]}},"response_text":"string"}

Iris Detect New

Retrieve a list of monitors and their respective IDs associated with the current DomainTools account.

Endpoint

URL: v1/iris-detect/domains/new/

Method: GET

Input

Argument Name	Type	Required	Description
parameters.monitor_id	string	Optional	Parameters for the Iris Detect New action
parameters.escalation_types	array	Optional	Parameters for the Iris Detect New action
parameters.tlds	array	Optional	Parameters for the Iris Detect New action
parameters.risk_score_ranges	array	Optional	Parameters for the Iris Detect New action
parameters.mx_exists	boolean	Optional	Parameters for the Iris Detect New action
parameters.domain_state	string	Optional	Parameters for the Iris Detect New action
parameters.discovered_since	string	Optional	Parameters for the Iris Detect New action
parameters.changed_since	string	Optional	Parameters for the Iris Detect New action
parameters.escalated_since	string	Optional	Parameters for the Iris Detect New action
parameters.search	string	Optional	Parameters for the Iris Detect New action
parameters.sort	array	Optional	Parameters for the Iris Detect New action
parameters.order	string	Optional	Parameters for the Iris Detect New action
parameters.offset	number	Optional	Parameters for the Iris Detect New action
parameters.limit	number	Optional	Parameters for the Iris Detect New action
parameters.preview	boolean	Optional	Parameters for the Iris Detect New action

Input Example

{"parameters":{"monitor_id":"string","escalation_types":["string"],"tlds":["string"],"risk_score_ranges":["string"],"mx_exists":true,"domain_state":"string","discovered_since":"string","changed_since":"string","escalated_since":"string","search":"string","sort":["string"],"order":"string","offset":123,"limit":123,"preview":true}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
watchlist_domains	array	Output field: watchlist_domains
watchlist_domains.file_name	string	Name of the resource
watchlist_domains.file	string	Output field: watchlist_domains.file
total_count	number	Count value
count	number	Count value
offset	number	Output field: offset
limit	number	Output field: limit

Output Example

{"watchlist_domains":[{"file_name":"Example Name","file":"string"}],"total_count":123,"count":123,"offset":123,"limit":123}

Iris Enrich

Retrieve historical WhoIs information for a specified domain from DomainTools. Requires the domain parameter.

Endpoint

URL: /v1/iris-enrich

Method: GET

Input

Argument Name	Type	Required	Description
parameters.domain	string	Required	Parameters for the Iris Enrich action

Input Example

{"parameters":{"domain":"google.com"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
data	object	Response data
data.response	object	Response data
data.response.limit_exceeded	boolean	Response data
data.response.message	string	Response data
data.response.results_count	number	Response data
data.response.results	array	Response data
data.response.results.domain	string	Response data
data.response.results.whois_url	string	Response data
data.response.results.adsense	object	Response data
data.response.results.adsense.value	string	Response data
data.response.results.alexa	number	Response data
data.response.results.popularity_rank	number	Response data
data.response.results.active	boolean	Response data
data.response.results.google_analytics	object	Response data
data.response.results.google_analytics.value	string	Response data
data.response.results.admin_contact	object	Response data
data.response.results.admin_contact.name	object	Response data
data.response.results.admin_contact.org	object	Response data
data.response.results.admin_contact.street	object	Response data
data.response.results.admin_contact.city	object	Response data
data.response.results.admin_contact.state	object	Response data
data.response.results.admin_contact.postal	object	Response data
data.response.results.admin_contact.country	object	Response data
data.response.results.admin_contact.phone	object	Response data

Output Example

{"data":{"response":{"limit_exceeded":true,"message":"string","results_count":123,"results":[],"missing_domains":[]}},"response_text":"string"}

Iris Investigate

Orchestrate and investigate domain-related use cases at human scale with DomainTools.

Endpoint

URL: v1/iris-investigate

Method: POST

Input

Argument Name	Type	Required	Description
parameters.active	boolean	Optional	Parameters for the Iris Investigate action
parameters.adsense	string	Optional	Parameters for the Iris Investigate action
parameters.create_date	string	Optional	Parameters for the Iris Investigate action
parameters.data_updated_after	string	Optional	Parameters for the Iris Investigate action
parameters.domain	string	Optional	Parameters for the Iris Investigate action
parameters.email	string	Optional	Parameters for the Iris Investigate action
parameters.email_domain	string	Optional	Parameters for the Iris Investigate action
parameters.expiration_date	string	Optional	Parameters for the Iris Investigate action
parameters.google_analytics	string	Optional	Parameters for the Iris Investigate action
parameters.ip	string	Optional	Parameters for the Iris Investigate action
parameters.mailserver_domain	string	Optional	Parameters for the Iris Investigate action
parameters.mailserver_host	string	Optional	Parameters for the Iris Investigate action
parameters.mailserver_ip	string	Optional	Parameters for the Iris Investigate action
parameters.nameserver_domain	string	Optional	Parameters for the Iris Investigate action
parameters.nameserver_host	string	Optional	Parameters for the Iris Investigate action
parameters.nameserver_ip	string	Optional	Parameters for the Iris Investigate action
parameters.not_tagged_with_all	string	Optional	Parameters for the Iris Investigate action
parameters.not_tagged_with_any	string	Optional	Parameters for the Iris Investigate action
parameters.position	string	Optional	Parameters for the Iris Investigate action
parameters.redirect_domain	string	Optional	Parameters for the Iris Investigate action
parameters.registrant	string	Optional	Parameters for the Iris Investigate action
parameters.registrant_org	string	Optional	Parameters for the Iris Investigate action
parameters.registrar	string	Optional	Parameters for the Iris Investigate action
parameters.search_hash	string	Optional	Parameters for the Iris Investigate action
parameters.ssl_email	string	Optional	Parameters for the Iris Investigate action

Input Example

{"parameters":{"active":true,"adsense":"string","create_date":"string","data_updated_after":"string","domain":"string","email":"[email protected]","email_domain":"string","expiration_date":"string","google_analytics":"string","ip":"string","mailserver_domain":"string","mailserver_host":"string","mailserver_ip":"string","nameserver_domain":"Example Name","nameserver_host":"Example Name","nameserver_ip":"Example Name","not_tagged_with_all":"string","not_tagged_with_any":"string","position":"string","redirect_domain":"string","registrant":"string","registrant_org":"string","registrar":"string","search_hash":"string","ssl_email":"string","ssl_hash":"string","ssl_org":"string","ssl_subject":"string","tagged_with_all":"string","tagged_with_any":"string","tld":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response	object	Output field: response
response.limit_exceeded	boolean	Output field: response.limit_exceeded
response.has_more_results	boolean	Result of the operation
response.message	string	Response message
response.results_count	number	Result of the operation
response.total_count	number	Count value
response.results	array	Result of the operation
response.results.domain	string	Result of the operation
response.results.whois_url	string	URL endpoint for the request
response.results.adsense	object	Result of the operation
response.results.adsense.value	string	Value for the parameter
response.results.adsense.count	number	Result of the operation
response.results.alexa	number	Result of the operation
response.results.popularity_rank	string	Result of the operation
response.results.active	boolean	Result of the operation
response.results.google_analytics	object	Result of the operation
response.results.google_analytics.value	string	Value for the parameter
response.results.google_analytics.count	number	Result of the operation
response.results.admin_contact	object	Result of the operation
response.results.admin_contact.name	object	Name of the resource
response.results.admin_contact.name.value	string	Name of the resource
response.results.admin_contact.name.count	number	Name of the resource
response.results.admin_contact.org	object	Result of the operation

Output Example

{"response":{"limit_exceeded":true,"has_more_results":true,"message":"string","results_count":123,"total_count":123,"results":[{}],"missing_domains":[{}]}}

Reverse IP

Retrieve a list of domain names hosted on the same IP address using DomainTools, requiring 'domain' as a path parameter.

Endpoint

URL: v1/{{domain}}/reverse-ip

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.domain	string	Required	Parameters for the Reverse IP action

Input Example

{"path_parameters":{"domain":"domaintools.com"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
data	object	Response data
data.response	object	Response data
data.response.ip_addresses	array	Response data
data.response.ip_addresses.ip_address	string	Response data
data.response.ip_addresses.domain_count	number	Response data
data.response.ip_addresses.domain_names	array	Response data
data.response.ip_addresses.domain_names.file_name	string	Response data
data.response.ip_addresses.domain_names.file	string	Response data
response_text	string	Output field: response_text
reason	string	Response reason phrase

Output Example

{"data":{"response":{"ip_addresses":[]}},"response_text":"string"}

Reverse WhoIs

Retrieve domain names with matching registrant information using DomainTools' Reverse Whois API. Requires specific search terms.

Endpoint

URL: v1/reverse-whois

Method: GET

Input

Argument Name	Type	Required	Description
parameters.terms	string	Required	Parameters for the Reverse WhoIs action
parameters.mode	string	Optional	Parameters for the Reverse WhoIs action

Input Example

{"parameters":{"terms":"DomainTools LLC|Seattle","mode":"purchase"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
data	object	Response data
data.response	object	Response data
data.response.domain_count	object	Response data
data.response.domain_count.current	number	Response data
data.response.domain_count.historic	number	Response data
data.response.report_price	object	Response data
data.response.report_price.current	number	Response data
data.response.report_price.historic	number	Response data
data.response.domains	array	Response data
response_text	string	Output field: response_text
reason	string	Response reason phrase

Output Example

{"data":{"response":{"domain_count":{},"report_price":{},"domains":[]}},"response_text":"string"}

Who Is

Retrieve WHOIS information for a specified IP address using DomainTools.

Endpoint

URL: /v1/{{ip}}/whois

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.ip	string	Required	Parameters for the Who Is action

Input Example

{"path_parameters":{"ip":"8.8.8.8"}}

Output

Parameter	Type	Description
response	object	Output field: response
response.registrant	string	Output field: response.registrant
response.registration	object	Output field: response.registration
response.registration.created	string	Output field: response.registration.created
response.registration.expires	string	Output field: response.registration.expires
response.registration.updated	string	Output field: response.registration.updated
response.registration.registrar	string	Output field: response.registration.registrar
response.registration.statuses	array	Status value
response.name_servers	array	Name of the resource
response.whois	object	Output field: response.whois
response.whois.date	string	Date value
response.whois.record	string	Output field: response.whois.record
response.record_source	string	Output field: response.record_source

Output Example

{"response":{"registrant":"string","registration":{"created":"2024-01-01T00:00:00Z","expires":"string","updated":"2024-01-01T00:00:00Z","registrar":"string","statuses":[]},"name_servers":["string"],"whois":{"date":"2024-01-01T00:00:00Z","record":"string"},"record_source":"string"}}

WhoIs History

Retrieve the latest historical WHOIS records for a domain, sorted by record date in descending order. Requires the domain as a path parameter.

Endpoint

URL: v1/{{domain}}/whois/history

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.domain	string	Required	Parameters for the WhoIs History action

Input Example

{"path_parameters":{"domain":"domaintools.com"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
data	object	Response data
data.response	object	Response data
data.response.record_count	number	Response data
data.response.history	array	Response data
data.response.history.date	string	Response data
data.response.history.is_private	number	Response data
data.response.history.whois	object	Response data
data.response.history.whois.registrant	string	Response data
data.response.history.whois.registration	object	Response data
data.response.history.whois.name_servers	array	Response data
data.response.history.whois.server	string	Response data
data.response.history.whois.record	string	Response data
response_text	string	Output field: response_text
reason	string	Response reason phrase

Output Example

{"data":{"response":{"record_count":123,"history":[]}},"response_text":"string"}

Response Headers

Header	Description	Example
Cache-Control	Directives for caching mechanisms
Content-Encoding	HTTP response header: Content-Encoding
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT
Expires	The date/time after which the response is considered stale
Pragma	HTTP response header: Pragma
Server	Information about the software used by the origin server
Set-Cookie	HTTP response header: Set-Cookie
Transfer-Encoding	HTTP response header: Transfer-Encoding
Vary	HTTP response header: Vary
X-TIME	HTTP response header: X-TIME