v1
latestOpenAPI 3.1.12026-07-242899061.7 MBDomain Abuse
Bulk Domain Abuse alert lookup
Perform a detailed lookup of data panels for several alerts at once.
post/domain_abuse
Request body
Example request
{
"panels": [
"status",
"summary",
"dns",
"whois",
"log"
]
}Response
Data for the requested panels.
Example response
{
"status": {
"status_code": "Ok",
"status_message": "Ok"
},
"data": [
{
"panel_status": {
"status": "Resolved",
"assignee_name": "Marty McFly",
"assignee_id": "uhash:40wXmPVONA",
"created": "2023-07-21T17:32:28Z",
"updated": "2023-07-21T17:32:28Z",
"creator_name": "Marty McFly",
"creator_id": "uhash:40wXmPVONA",
"owner_id": "uhash:3HX3rIn4Kv",
"owner_name": "Recorded Future",
"organisation_id": "uhash:3HX3rIn4Kv",
"organisation_name": "Recorded Future",
"owner_organisation_details": {
"organisations": [
{
"organisation_id": "uhash:3HX3rIn4Kv",
"organisation_name": "Recorded Future"
}
],
"enterprise_id": "uhash:1HX2qIn4Zy",
"enterprise_name": "Recorded Future"
},
"entity_id": "idn:mail.google.mail.pl",
"entity_name": "mail.google.mail.pl",
"targets": [
"idn:mail.google.mail.pl"
],
"attackers": [
"idn:mail.google.mail.pl"
],
"actions_taken": [
"cyber_vulnerability.patched",
"brand_mentions_on_code_repository.keys_rotated",
"domain_abuse.takedown",
"malicious_sites.takedown",
"third_party_risk.vendor_mitigated_findings",
"identity_novel_exposures.enforced_password_reset"
]
},
"panel_action": [
{
"action": "Domain takedown request.",
"updated": "2023-07-21T17:32:28Z",
"assignee_name": "Marty McFly",
"assignee_id": "uhash:40wXmPVONA",
"status": "Resolved",
"description": "Initiate a takedown request...",
"link": "takedownrequests.com"
}
],
"panel_evidence_summary": {
"screenshots": [
{
"image_id": "img:27368c9c-5bf3-488a-8300-13657f38e37a"
}
],
"reregistration": {
"expiration": "2023-07-21T17:32:28Z"
},
"screenshot_mentions": [
{
"url": "url:https://www.recordedfuture.com",
"screenshot": "img:27368c9c-5bf3-488a-8300-13657f38e37a",
"document": "doc:3tR0p",
"analyzed": "2023-07-21T17:32:28Z",
"mentioned_entities": [
{
"entity": {
"id": "shq4H",
"name": "My Test Product",
"type": "Product"
},
"reference": "19GLiq"
}
],
"mentioned_custom_keywords": [
{
"reference": "19GLiq"
}
]
}
],
"keywords_in_domain_name": {
"security_keywords_in_domain_name": [
{
"word": "sso, bank",
"domain": "idn:sso.bank.com"
}
],
"payment_keywords_in_domain_name": [
{
"word": "sso, bank",
"domain": "idn:sso.bank.com"
}
]
}
},
"panel_evidence_whois": {
"body": [
{
"provider": "whois",
"entity": "idn:mail.google.mail.pl",
"attribute": "attr:whois"
}
]
},
"panel_log": [
{
"actor_name": "Marty McFly",
"actor_id": "uhash:40wXmPVONA",
"created": "2023-07-21T17:32:28Z",
"modified": "2023-07-21T17:32:28Z",
"message": "Sample log message.",
"changes": {
"assignee_change": {
"old": "uhash:Ds92mDX",
"new": "uhash:AbHGsX"
},
"status_change": {
"old": "New",
"new": "InProgress"
},
"priority_change": {
"old": "Moderate",
"new": "High"
},
"reopen_strategy_change": {
"old": "SignificantUpdates",
"new": "Never"
},
"actions_change": {
"removed": [
"task:4d65b0f8-8254-402c-8178-4a9f97afc9b2"
],
"added": [
"task:4d65b0f8-8254-402c-8178-4a9f97afc9b2"
]
},
"assessment_ids_change": {
"removed": [
"Active Mail Server"
],
"added": [
"C&C Server"
]
}
},
"context": {
"changes": [
{
"attacker": "mail.google.mail.pl",
"manual_addition_user_id": "uhash:40wXmPVONA",
"manual_addition_user_name": "User Name",
"typosquat_targets": [
"google.com"
],
"similar_domains_keywords": [
"*infix*"
]
}
]
}
}
],
"panel_log_v2": [
{
"id": "uuid:a3c4f8f0-8dd8-4940-8b0a-75a59764d068",
"author_id": "uhash:40wXmPVONA",
"author_name": "Marty McFly",
"created": "2023-07-21T17:32:28Z",
"changes": [
{
"old": {
"id": "uhash:Ds92mDX",
"name": "Marty"
},
"new": {
"id": "uhash:Ds92mDX",
"name": "Marty"
}
}
]
}
]
}
]
}