๐Ÿ”€ related_domains

Threat actor's related domains

The related_domains relationship returns the list of all domains related to the threat actor.

This relationship can be retrieved using the relationships API endpoint. The response contains a list of Domain objects.

{
    "meta": {
        "count": <int>
    },
    "data": [
        {
            "attributes": {
								...
            },
            "type": "domain",
            "id": <string>,
            "context_attributes": {
                "related_from": [
                    {
                        "type": <string>,
                        "id": <string>
                    }
                ]
            }
        },
        {
            "attributes": {
                ...
            },
            "type": "domain",
            "id": <string>,
            "context_attributes": {
                "related_from": [
                    {
                        "type": <string>,
                        "id": <string>
                    }
                ]
            }
        }
    ],
}
{
	"data": [
		{
			"attributes": {
				"categories": {},
				"creation_date": 874296000,
				"last_analysis_results": {
					"ADMINUSLabs": {
						"category": "harmless",
						"engine_name": "ADMINUSLabs",
						"method": "blacklist",
						"result": "clean"
					},
					"AegisLab WebGuard": {
						"category": "harmless",
						"engine_name": "AegisLab WebGuard",
						"method": "blacklist",
						"result": "clean"
					},
					"AlienVault": {
						"category": "harmless",
						"engine_name": "AlienVault",
						"method": "blacklist",
						"result": "clean"
					},
					"Antiy-AVL": {
						"category": "harmless",
						"engine_name": "Antiy-AVL",
						"method": "blacklist",
						"result": "clean"
					}
				},
				"last_analysis_stats": {
					"harmless": 4,
					"malicious": 0,
					"suspicious": 0,
					"timeout": 0,
					"undetected": 0
				},
				"last_dns_records": [
					{
						"ttl": 299,
						"type": "A",
						"value": "1.2.3.102"
					},
					{
						"ttl": 299,
						"type": "A",
						"value": "1.2.3.139"
					}
				],
				"last_dns_records_date": 1591971990,
				"last_https_certificate": {
					"cert_signature": {
						"signature": "79eeeef08a81a86d0b97c12907d4099a467574945a64671dead9805c204eaaf2dcdaa360179d07ea93f23471dd789188d6b9754e0431eb0bf3be3231ae7051b3f47b9e5a5cf189b89ebd6c360c1007a52ddd7d8ed8c35a09596648a9cbfdaf3b1445949f517ba4a092d4662d8285f791648320099bd26c4941a52400e96ebbcd7aa9e7a0628fce64e6ec40a04bc533e5d4aeab1ec2b99bb4521afbed82f5b9c5fb329e2e4c43c93ed32423e61377924e77e949342a4f1acd3fa793ab47c07ce18ef0c8a143fc45da29854c6784545e7a008b90c5e512ca3449a7b7b44d47acfc2b3d9ba1a639a19d20beb038f51e93faedf2aecb6d7bddf5378f65c29695b280",
						"signature_algorithm": "sha256RSA"
					},
					"extensions": {
						"1.3.6.1.4.1.11129.2.4.2": "0481f300f100770007b75c1be47d48fff1b4c61d4315c4ba46574c4794b76aee",
						"CA": true,
						"authority_key_identifier": {
							"keyid": "98d1f86e10ebcf9bec609f18901ba0eb7d09fd2b"
						},
						"ca_information_access": {
							"CA Issuers": "http://pki.goog/gsr2/GTS1O1.crt",
							"OCSP": "http://ocsp.pki.goog/gts1o1"
						},
						"certificate_policies": [
							"2.23.140.1.2.2",
							"1.3.6.1.4.1.11129.2.5.3"
						],
						"crl_distribution_points": [
							"http://crl.pki.goog/GTS1O1.crl"
						],
						"extended_key_usage": [
							"serverAuth"
						],
						"key_usage": [
							"ff"
						],
						"subject_alternative_name": [
							"*.foo.com",
							"*.bar.com"
						],
						"subject_key_identifier": "f90b2039e77e0d5ecea0eec26ae61ee8a0e1e1d7",
						"tags": []
					},
					"issuer": {
						"C": "US",
						"CN": "FOO CA 1O1",
						"O": "Foo Trust Services"
					},
					"public_key": {
						"algorithm": "EC",
						"ec": {
							"oid": "secp256r1",
							"pub": "04e74159ce13c7e5a4a91e0a0514e29b1a0bce1b71c822eefc73e033e0ea54e29e8232ce46bfc998966e2151defc36c7e35a0244e8fb70be9acd9e43b30d7ff832"
						}
					},
					"serial_number": "56fadcce0ebef0ec08e0e0e0e0e355e7",
					"signature_algorithm": "sha256RSA",
					"size": 2387,
					"subject": {
						"C": "US",
						"CN": "*.foo.com",
						"L": "Campbell",
						"O": "Foo LLC",
						"ST": "California"
					},
					"tags": [],
					"thumbprint": "10e6e5ececed1ee1ce002e52bea49ec18ece5ee7",
					"thumbprint_sha256": "8f4ded05ae4e1fe7820e5535ee153de0a735e70eed32e4cde2f2ee98e89e8673",
					"validity": {
						"not_after": "2020-08-18 15:35:06",
						"not_before": "2020-05-26 15:35:06"
					},
					"version": "V3"
				},
				"last_https_certificate_date": 1591971990,
				"last_modification_date": 1591971990,
				"last_update_date": 1568043544,
				"popularity_ranks": {
					"Cisco Umbrella": {
						"rank": 1011,
						"timestamp": 1591889762
					}
				},
				"registrar": "MarkMonitor Inc.",
				"reputation": 0,
				"tags": [],
				"total_votes": {
					"harmless": 0,
					"malicious": 0
				},
				"whois": "Admin Country: US\nAdmin Organization: Foo LLC\nAdmin State/Province: CA\nCreation Date: 1997-09-15T00:00:00-0700\nCreation Date: 1997-09-15T04:00:00Z\nDNSSEC: unsigned\nDomain Name: FOO.COM\nDomain Name: foo.com\nDomain Status: clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)\nDomain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited\nDomain Status: clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited)\nDomain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited\nDomain Status: clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited)\nDomain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited\nDomain Status: serverDeleteProhibited (https://www.icann.org/epp#serverDeleteProhibited)\nDomain Status: serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited\nDomain Status: serverTransferProhibited (https://www.icann.org/epp#serverTransferProhibited)\nDomain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibited\nDomain Status: serverUpdateProhibited (https://www.icann.org/epp#serverUpdateProhibited)\nDomain Status: serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited\nName Server: NS1.FOO.COM\nName Server: NS2.FOO.COM\nName Server: NS3.FOO.COM\nName Server: NS4.FOO.COM\nName Server: ns1.foo.com\nName Server: ns2.foo.com\nName Server: ns3.foo.com\nName Server: ns4.foo.com\nRegistrant Country: US\nRegistrant Email: c44484b4e50484b4s@\nRegistrant Organization: 3304049bb43444c4\nRegistrant State/Province: b1952d4c4474f18a\nRegistrar Abuse Contact Email: [email protected]\nRegistrar Abuse Contact Phone: +1.2083895740\nRegistrar Abuse Contact Phone: +1.2083895770\nRegistrar IANA ID: 292\nRegistrar Registration Expiration Date: 2028-09-13T00:00:00-0700\nRegistrar URL: http://www.markmonitor.com\nRegistrar WHOIS Server: whois.markmonitor.com\nRegistrar: MarkMonitor Inc.\nRegistrar: MarkMonitor, Inc.\nRegistry Domain ID: 2134544_DOMAIN_COM-VRSN\nRegistry Expiry Date: 2028-09-14T04:00:00Z\nTech Country: US\nTech Organization: Foo LLC\nTech State/Province: CA\nUpdated Date: 2019-09-09T08:39:04-0700\nUpdated Date: 2019-09-09T15:39:04Z"
			},
      "context_attributes": {
				"related_from": [
					{
						"attributes": {
							"name": "Emotet"
						},
						"type": "collection",
						"id": "malpedia_win_emotet"
					}
				]
			},
			"id": "bar.foo.com",
			"links": {
				"self": "https://www.virustotal.com/api/v3/domains/bar.foo.com"
			},
			"type": "domain"
		}
	],
  "links": {
    "self": "https://www.virustotal.com/api/v3/threat_actors/1cb7e1cc-d695-42b1-92f4-fd0112a3c9be/related_domains?limit=1",
    "next": "https://www.virustotal.com/api/v3/threat_actors/1cb7e1cc-d695-42b1-92f4-fd0112a3c9be/related_domains?cursor=eyJsaW1pdCI6IDEsICJvZmZzZXQiOiAxfQ%3D%3D&limit=1"
  }
	"meta": {
		"count": 99,
		"cursor": "STewei4="
	}
}