Iris Investigate API filter parameters

Filter parameters refine base search results by adding constraints. These parameters cannot be used on their own and must be combined with at least one base search parameter.

Parameter Reference

Parameter	Description	WHOIS/RDAP Fields Search
`active`	`true` returns domains that have an entry in the global DNS, OR are listed as registered by the registry. `false` returns domains that are not in global DNS, AND are not listed as registered by the registry. Exclude filter to return all domains.
`create_date`	Only include domains created on a specific date, in YYYY-MM-DD format	Yes
`expiration_date`	Only include domains expiring on a specific date, in YYYY-MM-DD format	Yes
`first_seen_since`	Matches domains with a first seen on or after an ISO8601-compliant date/time (including a timezone)
`first_seen_within`	Matches domains with a first seen within a specific number of seconds from when the request is made
`ip_country_code`	Country code for IP A-record
`not_tagged_with_all`	A tag or comma-separated list of tags. Filters for domain that are not tagged with any of the provided tags.
`not_tagged_with_any`	A tag or a comma-separated list of tags. Filters for domains that are not tagged with any of the provided tags.
`rank`	Domain popularity rank (lower = higher traffic; updated daily; top 500,000 domains only; replaces Alexa ranking)
`risk_score`	Domain Risk Score
`server_type`	The web server type
`ssl_not_after`	Validity end date for a certificate (YYYY-MM-DD)
`ssl_not_before`	Validity begin date for a certificate (YYYY-MM-DD)
`tagged_with_all`	A tag or comma-separated list of tags. Filters for domain that are tagged with all of the provided tags.
`tagged_with_any`	A tag or a comma-separated list of tags. Filters for domains that are tagged with any of the provided tags.
`tld`	Limit results to only include domains in a specific top-level domain (i.e., `tld=com`, `tld=ru`)
`website_title`	The value of the website’s title tag

Usage Examples

Filter by TLD

Search for domaintools.com and domaintools.net with a filter for a .com TLD will surface domaintools.com as a result:

https://api.domaintools.com/v1/iris-investigate/?domain=domaintools.com,domaintools.net&tld=com

Filter by Create Date

Search for domains on a specific IP created on a specific date:

https://api.domaintools.com/v1/iris-investigate/?ip=199.30.228.112&create_date=2023-01-15

Filter by Risk Score

Search for high-risk domains on a specific nameserver. The risk_score parameter accepts an integer threshold and returns domains with a risk score greater than that value:

https://api.domaintools.com/v1/iris-investigate/?nameserver_domain=example.com&risk_score=69

Filter by Active Status

Search for inactive domains with a specific registrant:

https://api.domaintools.com/v1/iris-investigate/?registrant=example&active=false

Filter by First Seen

Search for recently discovered domains on a specific IP:

https://api.domaintools.com/v1/iris-investigate/?ip=199.30.228.112&first_seen_within=86400