Domain Reputation API¶

The Domain Reputation API returns a risk score for a domain name, with an optional list of reasons contributing to the score.

API endpoint¶

https://api.domaintools.com/v1/reputation/

Parameter	Type	Description
`domain`	string	Required. The domain to query. If you provide a hostname (for example, `www.domaintools.com`) rather than a domain (for example, `domaintools.com`), the API attempts to return the risk score for the domain. The response always includes the domain used for the lookup.
`include_reasons`	boolean	Return a list of reasons for the risk score. Valid values: `true` or `false`. Default: `false`.
`format`	string	Response format. Valid values: `json` (default), `html`, `xml`.

curl -X GET \
  'https://api.domaintools.com/v1/reputation/?domain=domaintools.com&include_reasons=true' \
  -H 'X-Api-Key: YOUR_API_KEY'

{
    "response": {
        "domain": "domaintools.com",
        "risk_score": 0,
        "reasons": [
            "zerolist"
        ]
    }
}

Field	Type	Description
`domain`	string	The domain queried.
`risk_score`	number	Risk score from `0` (least risk) to `100` (known risk).
`reasons`	array	Reasons contributing to the score. Only present when `include_reasons=true`.

Value	Description
`blocklist`	Domain appears on a threat blocklist.
`dns`	DNS infrastructure associated with known-bad actors.
`realtime`	Real-time signals indicate active malicious behavior.
`registrant`	Registrant details associated with known-bad actors.
`zerolist`	Domain is on a known-good list. Score is always `0`.

HTML: https://api.domaintools.com/v1/reputation/?domain=domaintools.com&include_reasons=true&format=html
JSON: https://api.domaintools.com/v1/reputation/?domain=domaintools.com&include_reasons=true
XML: https://api.domaintools.com/v1/reputation/?domain=domaintools.com&include_reasons=true&format=xml

Consult the Domain Risk Score documentation for more information on interpreting risk scores.