Services
API Concepts DNSIQ® Newly Observed Domains Newly Observed Hosts WHOISIQ™ SSL Certificates Blacklist
Coming Soon
Host Attributes Enrich
Additional Resources
PassiveTotal API Manage API Key
RiskIQ.com

DNSIQ®

The PDNS endpoints allow you to search RiskIQ's DNSIQ® for passive DNS resource record sets (rrsets) by the record name and the attributes within the records. The API currently supports searching DNSIQ® by the following PDNS record attributes (rdata attributes) directly: hex-encoded rdata field, IP address, and DNS zone name.

 

What It Looks Like

Curl

curl -X GET --header 'Accept: application/json' --header "Authorization: Basic $ENCODED_API_KEY" 'https://api.riskiq.net/test/v0/pdns/name?name=riskiq.net&type=A'
curl -X GET --header 'Accept: application/json' --header "Authorization: Basic $ENCODED_API_KEY" 'https://api.riskiq.net/test/v0/pdns/data/ip?ip=8.8.8.8'
curl -X GET --header 'Accept: application/json' --header "Authorization: Basic $ENCODED_API_KEY" 'https://api.riskiq.net/test/v0/pdns/data/raw?hex=00cf'
curl -X GET --header 'Accept: application/json' --header "Authorization: Basic $ENCODED_API_KEY" 'https://api.riskiq.net/test/v0/pdns/data/name?name=riskiq.net'

Response Body

{
  "recordCount": 5,
  "records": [
    {
      "count": 5,
      "firstSeen": "2009-10-21T14:23:09.000-0700",
      "lastSeen": "2013-01-04T11:35:05.000-0800",
      "name": "riskiq.net.",
      "data": [
        "70.32.68.247"
      ],
      "rrtype": "A"
    },
    {
      "count": 1,
      "firstSeen": "2013-07-19T08:54:00.000-0700",
      "lastSeen": "2013-07-19T08:54:00.000-0700",
      "name": "riskiq.net.",
      "data": [
        "162.209.9.7"
      ],
      "rrtype": "A"
    },
    {
      "count": 411,
      "firstSeen": "2010-08-29T05:06:00.000-0700",
      "lastSeen": "2013-07-06T15:55:37.000-0700",
      "name": "riskiq.net.",
      "data": [
        "70.32.68.247"
      ],
      "rrtype": "A"
    },
    {
      "count": 301065,
      "firstSeen": "2015-07-23T10:33:27.000-0700",
      "lastSeen": "2016-07-21T06:34:05.000-0700",
      "name": "riskiq.net.",
      "data": [
        "162.209.8.240"
      ],
      "rrtype": "A"
    },
    {
      "count": 1848,
      "firstSeen": "2013-07-19T08:54:00.000-0700",
      "lastSeen": "2015-07-22T06:08:27.000-0700",
      "name": "riskiq.net.",
      "data": [
        "162.209.9.7"
      ],
      "rrtype": "A"
    }
  ]
}