Domain objects represent information about a domain or [FQDN](https://en.wikipedia.org/wiki/Fully_qualified_domain_name), and can be retrieved by searching an already existing domain, by its relationship with other objects or by other meanings when searching in VT Enterprise services. ## Object Attributes A Domain object contains the following attributes: - `categories`: \<_dictionary_> mapping that relates categorisation services with the category it assigns the domain to. These services are, among others: Alexa, BitDefender, TrendMicro, Websense ThreatSeeker, etc. - `creation_date`: \<_integer_> creation date extracted from the Domain's whois (UTC timestamp). - `favicon`: \<_dictionary_> dictionary including difference hash and md5 hash of the domain's favicon. Only available for premium users. - `dhash`: \<_string_> difference hash - `raw_md5`: \<_string_> favicon's MD5 hash. - `jarm`: \<_string_> domain's [JARM hash](https://engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a). - `last_analysis_date`: \<_integer_> UTC timestamp representing last time the domain was scanned. - `last_analysis_results`: \<_dictionary_> result from URL scanners. dict with scanner name as key and a dict with notes/result from that scanner as value. - `category`: \<_string_> normalised result. can be: - "harmless" (site is not malicious), - "undetected" (scanner has no opinion about this site), - "suspicious" (scanner thinks the site is suspicious), - "malicious" (scanner thinks the site is malicious). - `engine_name`: \<_string_> complete name of the URL scanning service. - `engine_version`: \<_string_> engine version value, in case it reports that data. - `method`: \<_string_> type of service given by that URL scanning service (i.e. "blacklist"). - `result`: \<_string_> raw value returned by the URL scanner ("clean", "malicious", "suspicious", "phishing"). It may vary from scanner to scanner, hence the need for the "category" field for normalisation. - `last_analysis_stats`: \<_dictionary_> number of different results from this scans. - `harmless`: \<_integer_> number of reports saying that is harmless. - `malicious`: \<_integer_> number of reports saying that is malicious. - `suspicious`: \<_integer_> number of reports saying that is suspicious. - `timeout`: \<_integer_> number of timeouts when checking this URL. - `undetected`: \<_integer_> number of reports saying that is undetected. - `last_dns_records`: \<_list of dictionaries_> domain's DNS records on its last scan. Every entry is a _dictionary_ containing the following fields: - `expire`: \<_integer_> - `flag`: \<_integer_> - `minimum`: \<_integer_> - `priority`: \<_integer_> - `refresh`: \<_integer_> - `rname`: \<_string_> - `retry`: \<_integer_> - `serial`: \<_integer_> - `tag`: \<_string_> - `ttl`: \<_integer_> - `type`: \<_string_> - `value`: \<_string_> - `last_dns_records_date`: \<_integer_> date when the dns records list was retrieved by VirusTotal (UTC timestamp). - `last_https_certificate`: \<_[SSL Certificate](#ssl-certificate)_> SSL Certificate object retrieved last time the domain was analysed. - `last_https_certificate_date`: \<_integer_> date when the certificate was retrieved by VirusTotal (UTC timestamp). - `last_modification_date`: \<_integer_> date when any of domain's information was last updated. - `last_update_date`: \<_integer_> updated date extracted from whois (UTC timestamp). - `popularity_ranks`: \<_dictionary_> domain's position in popularity ranks such as Alexa, Quantcast, Statvoo, etc. Every dictionary contains the following subfields: - `rank`: \<_integer_> rank position. - `timestamp`: \<_integer_> UTC timestamp when the rank was ingested. - `registrar`: \<_string_> company that registered the domain. - `reputation`: \<_integer_> domain's score calculated from the votes of the VirusTotal's community. - `tags`: \<_list of strings_> list of representative attributes. - `total_votes`: \<_dictionary_> unweighted number of total votes from the community, divided in "harmless" and "malicious": - `harmless`: \<_integer_> number of positive votes. - `malicious`: \<_integer_> number of negative votes. - `whois`: \<_string_> whois information as returned from the pertinent whois server. - `whois_date`: \<_integer_> date of the last update of the whois record in VirusTotal. > 📘 About reputation > > The reputation for a given domain is determined by VirusTotal's Community (registered users). Users sometimes vote on domains, these users in turn have a reputation themselves: the _community score_ condenses the votes performed on a given item weighted by the reputation of the users that casted these votes. Negative (red) scores indicate maliciousness, whereas positive (green) scores reflect harmlessness. The higher the absolute number, the more that you may trust a given score. You can read more about this at this [community article](doc:community). ```json "domain" object { "data": { "attributes": { "categories": { "": "" }, "creation_date": , "favicon": { "dhash": "", "raw_md5": "" }, "jarm": "", "last_analysis_date": , "last_analysis_results": { "": { "category": "", "engine_name": "", "method": "", "result": "" } }, "last_analysis_stats": { "harmless": , "malicious": , "suspicious": , "timeout": , "undetected": }, "last_dns_records": [ { "expire": , "flag": , "minimum": , "priority": , "refresh": , "rname": "", "retry": , "serial": , "tag": "", "ttl": , "type": "", "value": "" } ], "last_dns_records_date": , "last_https_certificate": , "last_https_certificate_date": , "last_modification_date": , "last_update_date": , "popularity_ranks": { "": { "rank": , "timestamp": } }, "registrar": "", "reputation": , "tags": [""], "total_votes": { "harmless": , "malicious": }, "whois": "", "whois_date": }, "id": "", "links": { "self": "https://www.virustotal.com/api/v3/domains/" }, "type": "domain" } } ``` ```json Example { "data": { "attributes": { "categories": { "Dr.Web": "known infection source", "Forcepoint ThreatSeeker": "bot networks. parked domain" }, "creation_date": 1106675546, "favicon": { "dhash": "71f0cc989386ba80", "raw_md5": "01625852ea10d9fa44p676b1g2ff1df3" }, "jarm": "27d40d40d29d40d1dc42d43d00041d4689ee210389f4f6b4b5b1b93f92252d", "last_analysis_date": 1671691600, "last_analysis_results": { "ADMINUSLabs": { "category": "harmless", "engine_name": "ADMINUSLabs", "method": "blacklist", "result": "clean" }, "AegisLab WebGuard": { "category": "harmless", "engine_name": "AegisLab WebGuard", "method": "blacklist", "result": "clean" }, "AlienVault": { "category": "harmless", "engine_name": "AlienVault", "method": "blacklist", "result": "clean" } }, "last_analysis_stats": { "harmless": 3, "malicious": 0, "suspicious": 0, "timeout": 0, "undetected": 0 }, "last_dns_records": [ { "expire": 1814400, "minimum": 600, "refresh": 3600, "retry": 300, "rname": "hostmaster.foo-inc.com", "serial": 2020061203, "ttl": 1799, "type": "SOA", "value": "ns1.foo.com" }, { "ttl": 1162, "type": "A", "value": "91.117.116.8" }, { "ttl": 299, "type": "AAAA", "value": "2430:2fb0:f0b1:ca3b::6f" }, { "priority": 1, "ttl": 1545, "type": "MX", "value": "mta6.am0.foodns.net" }, { "flag": 0, "tag": "issue", "ttl": 1799, "type": "CAA", "value": "globalsign.com" } ], "last_dns_records_date": 1591833767, "last_https_certificate": { "cert_signature": { "signature": "9e788e906bca93be8996f3051bc5c1cbb9305a7a02bccd6f4a132555f0487f7f96f767ef66becc91d1e22704b1ec383a9d44237c3ecf28833bef44a7105186237750301371d45049e9809f1afd4331c6f0ebc077c16d86558f43a893e8871226132a677db3d2089c6300f4e1881eaed447ee3623a12cbe0552a0f8b73d29f195135c4f25bp700f035080afe87f2e54fd8c8fa1a505535ee3320ef04f90de13222fa476e27ed66fcbddd64e36ea77cbfb602d1f93f7f58ce84af5435096906aa9ad60e8d86cd7c05207e5d7d47186831e14d5940648e02d407c82be1accb2343725578005020c61980fe34136705ce8f81cf3202429cc058f405130c4dacfal3e", "signature_algorithm": "sha256RSA" }, "extensions": { "1.3.6.1.4.1.11129.2.4.2": "0481f300f1007700vbea773f9df56c0e7b536487dd049e0327a919a0c84a11212", "CA": true, "authority_key_identifier": { "keyid": "98d1f86e10ebcf9bec6089918901ba0eb7d09fd2b" }, "ca_information_access": { "CA Issuers": "http://pki.goog/gsr2/GTS1O1.crt", "OCSP": "http://ocsp.pki.goog/gts1o1" }, "certificate_policies": [ "2.23.140.1.2.2", "1.3.6.1.4.1.11129.2.5.3" ], "crl_distribution_points": [ "http://crl.pki.goog/GTS1O1.crl" ], "extended_key_usage": [ "serverAuth" ], "key_usage": [ "ff" ], "subject_alternative_name": [ "upload.video.foo.com", "*.clients.foo.com", "*.docs.foo.com" ], "subject_key_identifier": "9da1b782caaad70a2c9480ac488aca8316ad7790", "tags": [] }, "issuer": { "C": "US", "CN": "GTS CA 1O1", "O": "Google Trust Services" }, "public_key": { "algorithm": "EC", "ec": { "oid": "secp256r1", "pub": "04139a8a6a96066c0c62b5358b863147314b402ea9b079cd00361c9099d23cb3db2d937e9cfed2b3826f5ea7f64074a038acd7f33d37c7f897fe95d544c25c8dfc" } }, "serial_number": "a7670522413cc18d0800000000420d4f", "signature_algorithm": "sha256RSA", "size": 1506, "subject": { "C": "US", "CN": "upload.video.foo.com", "L": "Mountain View", "O": "Google LLC", "ST": "California" }, "tags": [], "thumbprint": "ea2fe94b45d4c2929d3c2fd84292086820bd86ad", "thumbprint_sha256": "24c386d0829cae13b3c923bfc5c337d156c11c6ea6136b02e5c0a48634328e83", "validity": { "not_after": "2020-08-12 12:07:40", "not_before": "2020-05-20 12:07:40" }, "version": "V3" }, "last_https_certificate_date": 1591833767, "last_modification_date": 1591889814, "last_update_date": 1577183919, "popularity_ranks": { "Alexa": { "rank": 47288, "timestamp": 1591630561 }, "Cisco Umbrella": { "rank": 338, "timestamp": 1591803361 }, "Majestic": { "rank": 36741, "timestamp": 1585496163 }, "Statvoo": { "rank": 24060, "timestamp": 1591889764 } }, "registrar": "MarkMonitor Inc.", "reputation": 0, "tags": [ "dga" ], "total_votes": { "harmless": 0, "malicious": 0 }, "whois": "Creation Date: 2005-01-25T17:52:26Z\nDNSSEC: unsigned\nDomain Name: FOOAPIS.COM\nDomain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited\nDomain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited\nDomain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited\nDomain Status: serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited\nDomain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibited\nDomain Status: serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited\nName Server: NS1.FOO.COM\nName Server: NS2.FOO.COM\nName Server: NS3.FOO.COM\nName Server: NS4.FOO.COM\nRegistrar Abuse Contact Email: abusecomplaints@markmonitor.com\nRegistrar Abuse Contact Phone: +1.2083895740\nRegistrar IANA ID: 292\nRegistrar URL: http://www.markmonitor.com\nRegistrar WHOIS Server: whois.markmonitor.com\nRegistrar: MarkMonitor Inc.\nRegistry Domain ID: 140496530_DOMAIN_COM-VRSN\nRegistry Expiry Date: 2021-01-25T17:52:26Z\nUpdated Date: 2019-12-24T10:38:39Z" }, "id": "foo.fooapis.com", "links": { "self": "https://www.virustotal.com/api/v3/domains/foo.fooapis.com" }, "type": "domain" } } ``` ## Relationships In addition to the previously described attributes, Domain objects contain relationships with other objects in our dataset that can be retrieved as explained in the [Relationships](ref:relationships) section. The available relationships are shown in the following table: | Relationship | Description | Accessibility | Return object type | | :-------------------------- | :--------------------------------------------------------- | :------------------------ | :--------------------------------------------------- | | caa_records | Records CAA for the domain. | VT Enterprise users only. | List of [Domains](ref:domains-object). | | cname_records | Records CNAME for the domain. | VT Enterprise users only. | List of [Domains](ref:domains-object). | | comments | Community posted comments about the domain. | Everyone. | List of [Comments](ref:comments). | | communicating_files | Files that communicate with the domain. | Everyone. | List of [Files](ref:files). | | downloaded_files | Files downloaded from that domain. | VT Enterprise users only. | List of [Files](ref:files). | | graphs | Graphs including the domain. | Everyone. | List of [Graphs](ref:graph-object). | | historical_ssl_certificates | SSL certificates associated with the domain. | Everyone. | List of [SSL Certificate](ref:ssl-certificate). | | historical_whois | WHOIS information for the domain. | Everyone. | List of [Whois](ref:whois). | | immediate_parent | Domain's immediate parent. | Everyone. | A single [Domain](ref:domains-object). | | mx_records | Records MX for the domain. | VT Enterprise users only. | List of [Domains](ref:domains-object). | | ns_records | Records NS for the domain. | VT Enterprise users only. | List of [Domains](ref:domains-object). | | parent | Domain's top parent. | Everyone. | A single [Domain](ref:domains-object). | | referrer_files | Files containing the domain. | Everyone. | A list of [Files](ref:files). | | related_comments | Community posted comments in the domain's related objects. | Everyone. | A list of [Comments](ref:comments). | | related_references | References related to the domain. | VT Enterprise users only. | A list of [References](ref:references). | | related_threat_actors | Threat actors related to the domain. | VT Enterprise users only. | A list of [Threat Actors](ref:threat-actors-object). | | resolutions | DNS resolutions for the domain. | Everyone. | A list of [Resolutions](ref:resolution-object). | | soa_records | Records SOA for the domain. | VT Enterprise users only. | List of [Domains](ref:domains-object). | | siblings | Domain's sibling domains. | Everyone. | A list of [Domains](ref:domains-object). | | subdomains | Domain's subdomains. | Everyone. | A list of [Domains](ref:domains-object). | | urls | URLs having this domain. | VT Enterprise users only. | A list of [URLs](ref:url-object). | | user_votes | Current user's votes. | Everyone. | A list of [Votes](ref:vote-object) | These relationships are detailed in the subsections below.