Domains | VirusSign API Documentation

This reference covers the indicator object in a lookup response. See request parameters, response metadata and response conventions. Pro fields provide additional context where available; compact views contain fewer fields.

Fields are conditional unless stated otherwise. Types below describe populated values; optional values may also be null. Access labels describe capability, not guaranteed data for every indicator.

Domain fields

indicator

Fields in indicator
Field	Type	Meaning
`type`	string	Domain record.
`value`	string	Canonical indicator value. File records normally use SHA-256; URL records use an opaque identifier.
`analysis`	object	Threat assessment. Field reference →
`first_seen`	string	First observation time. ISO 8601 timestamp with timezone.
`last_seen`	string	Latest observation time. ISO 8601 timestamp with timezone.
`tags`	array<string>	Descriptive indicator labels.
`crowd_context`	object · Pro	Community and actor context, where available. Field reference →
`relations`	object	Related object groups when requested with full+relations and authorized. See Relationships. Field reference →
`tld`	string	Public suffix or top-level domain.
`rootdomain`	string · Pro	Registrable root domain.
`subdomain`	string · Pro	Subdomain portion.

indicator.contextobject

Context for an object returned through a relationship.

Fields in indicator.context
Field	Type	Meaning
`relationship`	string	Relationship connecting this object to the source indicator.

indicator.linksobject

Optional navigation links.

Fields in indicator.links
Field	Type	Meaning
`self`	string	Canonical resource link, when provided.

Profile & risk

indicator.profileobject · Pro

Domain profile and approximate geographic context.

Fields in indicator.profile
Field	Type	Meaning
`name`	string	Geographic display name, such as a city, region and country.
`latitude`	number	Approximate latitude.
`longitude`	number	Approximate longitude.
`precision`	string	Geographic context: resolved_ip_geo describes the resolved IP location; whois_registrant describes registration location. IP geolocation is not a registrant address.
`region`	string	Region label.
`country`	string	Country code or label.
`administrative_area`	string	State or province.
`city`	string	City label.
`street_address`	string	Street address for the location context, when available; interpret with precision.
`postal_code`	string	Postal code for the location context identified by precision.
`resolved_ip`	string	IP associated with the geographic context.

indicator.dgaobject · Pro

Domain-generation and naming risk signals.

Fields in indicator.dga
Field	Type	Meaning
`dga_score`	number	Domain-generation risk score; higher values indicate a stronger signal. Scale: 0–100; not a probability.
`dga_tag`	boolean	Whether a DGA label is present.
`domain_age_days`	number	Domain age in days; -1 indicates an unknown age.
`suspicious_tld`	boolean	Whether the top-level domain contributes a risk signal.
`homograph_risk`	boolean	Potential visually confusable domain naming risk.
`is_dga`	boolean	DGA classification signal.
`dga_risk`	string	Qualitative risk level.

Registration

indicator.whoisobject · Pro

Domain registration details when available.

Fields in indicator.whois
Field	Type	Meaning
`whois_registrar`	string	Registrar name.
`whois_registrar_iana_id`	string / integer	Registrar IANA identifier.
`whois_created_date`	string	Domain registration date. ISO 8601 timestamp with timezone.
`whois_expiry_date`	string	Registration expiry date. ISO 8601 timestamp with timezone.
`whois_updated_date`	string	Registration update date. ISO 8601 timestamp with timezone.
`whois_status`	string / array	Registration status or statuses.
`whois_privacy_protected`	boolean	Whether registration privacy protection is indicated.
`whois_registrant_org`	string	Registrant organization.
`whois_registrant_email`	string	Registrant contact email.
`whois_registrant_country`	string	Registrant country.

DNS observations

indicator.dns_recordsobject · Pro

Observed DNS records.

Fields in indicator.dns_records
Field	Type	Meaning
`dns_a`	array<string>	IPv4 address records.
`dns_aaaa`	array<string>	IPv6 address records.
`dns_cname`	array<string>	Canonical name records.
`dns_ns`	array<string>	Name server records.
`dns_txt`	array<string>	Text records.
`dns_mx`	array<string>	Mail exchange records.

indicator.dns_records.dns_soaobject · Pro

DNS Start of Authority record.

Fields in indicator.dns_records.dns_soa
Field	Type	Meaning
`mname`	string	Primary name server.
`rname`	string	Responsible mailbox in DNS notation.
`ttl`	integer	Time to live in seconds.
`serial`	integer	Zone serial number.
`refresh`	integer	Refresh interval in seconds.
`retry`	integer	Retry interval in seconds.
`expire`	integer	Expiry interval in seconds.
`minimum`	integer	SOA minimum value in seconds.

indicator.passive_dns[]array<object> · Pro

Passive DNS observations.

Fields in indicator.passive_dns[]
Field	Type	Meaning
`resolved_value`	string	Observed resolved value.
`record_type`	string	DNS record type.
`passive_dns_first_seen`	string	First observation time. ISO 8601 timestamp with timezone.
`passive_dns_last_seen`	string	Latest observation time. ISO 8601 timestamp with timezone.
`source`	string	Observation category label.

Certificates

indicator

Fields in indicator
Field	Type	Meaning
`tls_sans`	array<string> · Pro	TLS certificate subject alternative names.

indicator.ssl_certificates[]array<object> · Pro

TLS certificate summaries.

Fields in indicator.ssl_certificates[]
Field	Type	Meaning
`issuer`	object	Issuer distinguished-name attributes, such as CN, O and C.
`subject`	object	Subject distinguished-name attributes, such as CN, O and C.
`validity`	string	Certificate validity range as a display string. For individual date fields, see certificate relationship records.
`tls_certificate_fingerprints`	array<string>	Certificate fingerprints.

Illustrative response

Illustrative data showing the response structure. Optional fields may be omitted.

JSON · illustrative domains

{
  "meta": {
    "request_id": "example-request",
    "timestamp": "2026-01-15T12:00:00Z",
    "quota_remaining": 100,
    "took_ms": 12
  },
  "indicator": {
    "type": "domain",
    "value": "beacon.example",
    "rootdomain": "beacon.example",
    "analysis": {
      "malicious": true,
      "severity": "medium",
      "confidence": 60,
      "detections": "28/32",
      "family": "ExampleFamily",
      "has_actor": false
    },
    "profile": {
      "name": "Montreal, Quebec, Canada",
      "precision": "resolved_ip_geo",
      "country": "Canada",
      "city": "Montreal",
      "region": "Quebec",
      "resolved_ip": "192.0.2.10"
    },
    "first_seen": "2026-01-15T12:00:00Z",
    "last_seen": "2026-01-15T12:00:00Z",
    "dns_records": {
      "dns_a": [
        "192.0.2.10"
      ],
      "dns_mx": [
        "mail.beacon.example"
      ]
    },
    "dga": {
      "dga_score": 10,
      "is_dga": false,
      "dga_risk": "low"
    },
    "passive_dns": [
      {
        "resolved_value": "192.0.2.10",
        "record_type": "A",
        "passive_dns_first_seen": "2026-01-15T12:00:00Z",
        "passive_dns_last_seen": "2026-01-15T12:00:00Z"
      }
    ]
  }
}

Appearance

Domain intelligence

Search results