Threat intelligence API docs

Domain's Infrastructure Analysis API

For a given domain name, get a collection of its web, mail, and name servers. For each infrastructure entry, find out its IP address, geolocation and subnetwork information.

GEThttps://api.threatintelligenceplatform.com/v1/infrastructureAnalysis?domainName=threatintelligenceplatform.com&apiKey=YOUR_API_KEY

Input parameters

Parameter	Type	What it means
domainName (required)	string	The target domain name.
apiKey (required)	string	Get your personal API KEY on My subscriptions page.

Sample output

[
  {
    "domainName":"threatintelligenceplatform.com",
    "resourceType":"web",
    "ipv4":"64.140.160.2",
    "geolocation":{
      "city":"Clearfield",
      "country":"US",
      "latitude":"41.1144",
      "longitude":"-112.0592",
      "postalCode":"84015",
      "region":"Utah",
      "timezone":"America/Denver"
    },
    "subnetwork":{
      "name":"WEBNX-BLK-14",
      "ipAddressesRange":"64.140.160.0 - 64.140.175.255",
      "country":"",
      "lastUpdateDate":""
    }
  },
  {
    "domainName":"aspmx.l.google.com",
    "resourceType":"MX",
    "ipv4":"173.194.202.26",
    "geolocation":{
      "city":"Mountain View",
      "country":"US",
      "latitude":"37.4192",
      "longitude":"-122.0574",
      "postalCode":"94043",
      "region":"California",
      "timezone":"America/Los_Angeles"
    },
    "subnetwork":{
      "name":"GOOGLE",
      "ipAddressesRange":"173.194.0.0 - 173.194.255.255",
      "country":"",
      "lastUpdateDate":""
    }
  }
]

The data returned

Field	Type	What it means?
domainName	string	The domain name
ipv4	string	The IPv4 address the domain name is resolved to.
resourceType	string	Host kind: web - Web server www.web - Web server subdomain - Subdomain's server (note that subdomains are checked only if the input 'domainName' parameter is a subdomain) MX - Mail server NS - Name servers For more information see the "IP resolution section" in the general documentation.
geolocation	object	Contains the geolocation information for the found IP.
geolocation.city	string	City of the found IP.
geolocation.country	string	Country of the found IP.
geolocation.latitude	string	Latitude of the found IP.
geolocation.longitude	string	Longitude of the found IP.
geolocation.postalCode	string	Postal code of the found IP.
geolocation.region	string	Region of the found IP.
geolocation.timezone	string	Timezone of the found IP.
subnetwork	object	Contains the subnetwork information object
subnetwork.country	string	The Country where the subnetwork is registered.
subnetwork.ipAddressesRange	string	The range of IP address space to which the target IP address belongs to.
subnetwork.name	string	The name of the IP address space range.
subnetwork.lastUpdateDate	datetime	The date and time (UTC) when the subnetwork was updated in the database.

Have questions?

We work hard to improve our services for you. As part of that, we welcome your feedback, questions and suggestions. Please let us know your thoughts and feelings, and any way in which you think we can improve our product.

For a quick response, please select the request type that best suits your needs.