Get Enrichment Data
Get enrichment data for a query.
Curl Example
$ curl -u $USERNAME:$KEY 'https://api.riskiq.net/pt/v2/enrichment?query=passivetotal.org'
Parameters
| Field | Field Type | Description |
|---|---|---|
| query | String | the domain or IP being queried |
Sample Response
{
"subdomains": [],
"sinkhole": false,
"tld": ".org",
"primaryDomain": "passivetotal.org",
"queryValue": "passivetotal.org",
"queryType": "domain",
"everCompromised": false,
"tag_meta": {
"mytag": {
"creator": "johan@riskiq.net",
"created_at": "2017-03-30T01:05:12.629000"
}
},
"classification": "non_malicious",
"tags": [
"mytag"
],
"dynamicDns": false
}
Get Malware
Get malware data for a query.
Curl Example
$ curl -u $USERNAME:$KEY 'https://api.riskiq.net/pt/v2/enrichment/malware?query=badguy.example.org'
Parameters
| Field | Field Type | Description |
|---|---|---|
| query | String | the domain or IP being queried |
Sample Response
{
"success": true,
"results": [
{
"collectionDate": "2016-10-08 04:24:38",
"sample": "cacc5e355b44c5824af4e2a599999999",
"source": "Threatexpert",
"sourceUrl": "http://www.threatexpert.com/report.aspx?md5=cacc5e355b44c5824af4e2a599999999"
},
{
"collectionDate": "2016-10-08 04:24:39",
"sample": "a6ba4a1240fd2e59091cd1bf99999999",
"source": "Emerging threats (proofpoint)",
"sourceUrl": "https://threatintel.proofpoint.com/md5/a6ba4a1240fd2e59091cd1bf99999999"
}
]
}
Get OSINT
Get osint data for a query.
Curl Example
$ curl -u $USERNAME:$KEY 'https://api.riskiq.net/pt/v2/enrichment/osint?query=passivetotal.org'
Parameters
| Field | Field Type | Description |
|---|---|---|
| query | String | the domain or IP being queried |
Sample Response
{
"success": true,
"results": [
{
"derived": false,
"inReport": [
"phishing.example.org"
],
"source": "PhishTank",
"sourceUrl": "http://www.phishtank.com/phish_detail.php?phish_id=999999",
"tags": [
"phishtank",
"verified phish"
]
},
{
"derived": false,
"inReport": [
"phishing.example.org"
],
"source": "PhishTank",
"sourceUrl": "http://www.phishtank.com/phish_detail.php?phish_id=1000000",
"tags": [
"phishtank",
"verified phish"
]
}
]
}
Get Subdomains
Get subdomains data for a query.
Curl Example
$ curl -u $USERNAME:$KEY 'https://api.riskiq.net/pt/v2/enrichment/subdomains?query=passivetotal.org'
Parameters
| Field | Field Type | Description |
|---|---|---|
| query | String | the domain being queried |
Sample Response
{
"success": true,
"primaryDomain":"passivetotal.org"
"subdomains": ["api", "app", "certs", "n1", "n2", "n3", "n4",
"n5", "n6", "nutmeg-beta", "v2", "www"],
"queryValue": "passivetotal.org"
}