Suspicious Domain Detail

GEThttps://api.deepinfo.com/v1/brp/suspicious-domains/{detected_fraudulent_id}

Returns one suspicious domain with the rule that detected it.

Example

Request

curl

curl 'https://api.deepinfo.com/v1/brp/suspicious-domains/00000000000000000000000e25cc0001' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json'

Python

import requests

url = "https://api.deepinfo.com/v1/brp/suspicious-domains/00000000000000000000000e25cc0001"

headers = {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json"
}

response = requests.get(url, headers=headers)
response.raise_for_status()
print(response.json())

JavaScript

const url = "https://api.deepinfo.com/v1/brp/suspicious-domains/00000000000000000000000e25cc0001";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json"
  },
});

const data = await response.json();
console.log(data);

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, err := http.NewRequest("GET", "https://api.deepinfo.com/v1/brp/suspicious-domains/00000000000000000000000e25cc0001", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("apikey", "YOUR_API_KEY")
	req.Header.Set("Accept", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	body, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(string(body))
}

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.deepinfo.com/v1/brp/suspicious-domains/00000000000000000000000e25cc0001"))
            .header("apikey", "YOUR_API_KEY")
            .header("Accept", "application/json")
            .GET()
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());

        System.out.println(response.body());
    }
}

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://api.deepinfo.com/v1/brp/suspicious-domains/00000000000000000000000e25cc0001");
request.Headers.Add("apikey", "YOUR_API_KEY");
request.Headers.Add("Accept", "application/json");

using var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

PHP

<?php

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://api.deepinfo.com/v1/brp/suspicious-domains/00000000000000000000000e25cc0001',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'apikey: YOUR_API_KEY',
        'Accept: application/json',
    ],
]);

$response = curl_exec($curl);

if ($response === false) {
    throw new RuntimeException(curl_error($curl));
}

echo $response . PHP_EOL;

Ruby

require 'net/http'
require 'uri'

uri = URI('https://api.deepinfo.com/v1/brp/suspicious-domains/00000000000000000000000e25cc0001')

request = Net::HTTP::Get.new(uri)
request['apikey'] = 'YOUR_API_KEY'
request['Accept'] = 'application/json'

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(request)
end

puts response.body

Response

200 OK · application/json

Response Body

{
  "id": "00000000000000000000000e25cc0001",
  "fraudulent": "acme.example",
  "fraudulent_unicode": "acme.example",
  "fraudulent_type": "domain",
  "state": "in_review",
  "detection_history": [
    {
      "id": "000000000000000e2f900001",
      "rule": "Brand name",
      "detection_date": "2025-06-01T08:00:00Z",
      "enabled": true,
      "deleted": false
    }
  ],
  "first_detection_date": "2025-06-01T08:00:00Z",
  "monitoring_indicator": {
    "dns": true,
    "dns_mx": true,
    "ssl": null,
    "http": true
  },
  "risk_score": 20,
  "monitoring": {
    "whois": {
      "domain_name": "acme.example",
      "raw": "Raw record text.",
      "parsed": {
        "uid": "00000000000000000000000e7db60001",
        "create_date": "2025-06-01T08:00:00Z",
        "update_date": "2025-07-01T08:00:00Z",
        "expiry_date": "2026-06-01T08:00:00Z",
        "registrar": "Kestrel Domains",
        "registrant": {
          "name": "REDACTED FOR PRIVACY",
          "organization": "REDACTED FOR PRIVACY",
          "street": "REDACTED FOR PRIVACY",
          "city": "Springfield",
          "state": null,
          "postal_code": "REDACTED FOR PRIVACY",
          "country": "US",
          "phone": null,
          "email": null
        },
        "name_servers": [
          "ns1.acme.example",
          "ns2.acme.example"
        ],
        "domain_status": [
          "ok"
        ],
        "whois_server": "whois.fernhill.example"
      },
      "check_date": "2025-07-31T08:00:00Z",
      "parse_code": null
    },
    "dns": {
      "fqdn": "acme.example",
      "requested_types": [
        "A",
        "AAAA"
      ],
      "responses": [
        {
          "type": "A",
          "conn_status": "success",
          "rcode": "NOERROR",
          "raw": "Raw record text.",
          "values": [
            "192.0.2.10"
          ],
          "server": "192.0.2.10"
        },
        {
          "type": "AAAA",
          "conn_status": "success",
          "rcode": "NOERROR",
          "raw": null,
          "values": null,
          "server": "192.0.2.10"
        }
      ],
      "servers": [
        "192.0.2.10"
      ],
      "check_date": "2025-07-31T08:00:00Z"
    },
    "ssl": null,
    "http": {
      "requested_url": "http://acme.example/",
      "version": 1,
      "check_date": "2025-07-31T08:00:00Z",
      "connection_status": "success",
      "requested_domain": "acme.example",
      "final_url": "http://acme.example/",
      "final_domain": "acme.example",
      "http": {
        "redirection_history": [
          {
            "url": "http://acme.example/",
            "status_code": 200
          }
        ],
        "headers": [
          {
            "name": "server",
            "value": "<value>"
          },
          {
            "name": "date",
            "value": "Thu, 31 Jul 2025 08:00:00 GMT"
          }
        ],
        "cookies": []
      },
      "html": {
        "source_hash_code": "c61800abcdef0123456789c61800abcdef0123456789c61800abcdef01234567"
      },
      "final_status_code": 200
    }
  },
  "approve_date": null,
  "ignore_date": null,
  "seems_inactive": false
}

Content-Type: application/json
deepinfo-request-id: 00000000-0000-4000-8000-0000356d0001

Request

curl

curl 'https://api.deepinfo.com/v1/brp/suspicious-domains/ffffffffffffffffffffffff' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json'

Python

import requests

url = "https://api.deepinfo.com/v1/brp/suspicious-domains/ffffffffffffffffffffffff"

headers = {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json"
}

response = requests.get(url, headers=headers)
response.raise_for_status()
print(response.json())

JavaScript

const url = "https://api.deepinfo.com/v1/brp/suspicious-domains/ffffffffffffffffffffffff";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json"
  },
});

const data = await response.json();
console.log(data);

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, err := http.NewRequest("GET", "https://api.deepinfo.com/v1/brp/suspicious-domains/ffffffffffffffffffffffff", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("apikey", "YOUR_API_KEY")
	req.Header.Set("Accept", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	body, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(string(body))
}

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.deepinfo.com/v1/brp/suspicious-domains/ffffffffffffffffffffffff"))
            .header("apikey", "YOUR_API_KEY")
            .header("Accept", "application/json")
            .GET()
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());

        System.out.println(response.body());
    }
}

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://api.deepinfo.com/v1/brp/suspicious-domains/ffffffffffffffffffffffff");
request.Headers.Add("apikey", "YOUR_API_KEY");
request.Headers.Add("Accept", "application/json");

using var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

PHP

<?php

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://api.deepinfo.com/v1/brp/suspicious-domains/ffffffffffffffffffffffff',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'apikey: YOUR_API_KEY',
        'Accept: application/json',
    ],
]);

$response = curl_exec($curl);

if ($response === false) {
    throw new RuntimeException(curl_error($curl));
}

echo $response . PHP_EOL;

Ruby

require 'net/http'
require 'uri'

uri = URI('https://api.deepinfo.com/v1/brp/suspicious-domains/ffffffffffffffffffffffff')

request = Net::HTTP::Get.new(uri)
request['apikey'] = 'YOUR_API_KEY'
request['Accept'] = 'application/json'

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(request)
end

puts response.body

Response

404 Not Found · application/json

Response Body

{
  "code": 30003,
  "details": [
    "Detected fraudulent with id=ffffffffffffffffffffffff does not exist."
  ],
  "solution": "https://docs.deepinfo.com/reference/"
}

Content-Type: application/json
deepinfo-request-id: 00000000-0000-4000-8000-0000356d0001

Authentication

Send your API key in the apikey request header.

Path Parameters

Parameter	Required	Description
`detected_fraudulent_id`	Required	Example`00000000000000000000000e25cc0001`

Response Fields

Field	Type	Description
`id`	string
`fraudulent`	string
`fraudulent_unicode`	string
`fraudulent_type`	string	One of `domain`, `subdomain`
`state`	string	One of `in_review`, `approved`, `ignored`
`detection_history`	array of object
`first_detection_date`	string	date-time
`monitoring_indicator`	object
`risk_score`	integer
`monitoring`	object
`approve_date`	string	date-time
`ignore_date`	string	date-time
`seems_inactive`	boolean

Response Schema

Inferred from examples Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

Field	Type	Example
`id`	string	`"00000000000000000000000e25cc0001"`
`fraudulent`	string	`"acme.example"`
`fraudulent_unicode`	string	`"acme.example"`
`fraudulent_type`	string	`"domain"`
`state`	string	`"in_review"`
`detection_history`	array<object>
`detection_history[].id`	string	`"000000000000000e2f900001"`
`detection_history[].rule`	string	`"Brand name"`
`detection_history[].detection_date`	string	`"2025-06-01T08:00:00Z"`
`detection_history[].enabled`	boolean	`true`
`detection_history[].deleted`	boolean	`false`
`first_detection_date`	string	`"2025-06-01T08:00:00Z"`
`monitoring_indicator`	object
`monitoring_indicator.dns`	boolean	`true`
`monitoring_indicator.dns_mx`	boolean	`true`
`monitoring_indicator.ssl`	null
`monitoring_indicator.http`	boolean	`true`
`risk_score`	number	`20`
`monitoring`	object
`monitoring.whois`	object
`monitoring.whois.domain_name`	string	`"acme.example"`
`monitoring.whois.raw`	string	`"Raw record text."`
`monitoring.whois.parsed`	object
`monitoring.whois.parsed.uid`	string	`"00000000000000000000000e7db60001"`
`monitoring.whois.parsed.create_date`	string	`"2025-06-01T08:00:00Z"`
`monitoring.whois.parsed.update_date`	string	`"2025-07-01T08:00:00Z"`
`monitoring.whois.parsed.expiry_date`	string	`"2026-06-01T08:00:00Z"`
`monitoring.whois.parsed.registrar`	string	`"Kestrel Domains"`
`monitoring.whois.parsed.registrant`	object
`monitoring.whois.parsed.registrant.name`	string
`monitoring.whois.parsed.registrant.organization`	string
`monitoring.whois.parsed.registrant.street`	string
`monitoring.whois.parsed.registrant.city`	string	`"Springfield"`
`monitoring.whois.parsed.registrant.state`	null
`monitoring.whois.parsed.registrant.postal_code`	string
`monitoring.whois.parsed.registrant.country`	string	`"US"`
`monitoring.whois.parsed.registrant.phone`	null
`monitoring.whois.parsed.registrant.email`	null
`monitoring.whois.parsed.name_servers`	array<string>	`"ns1.acme.example"`
`monitoring.whois.parsed.domain_status`	array<string>	`"ok"`
`monitoring.whois.parsed.whois_server`	string	`"whois.fernhill.example"`
`monitoring.whois.check_date`	string	`"2025-07-31T08:00:00Z"`
`monitoring.whois.parse_code`	null
`monitoring.dns`	object
`monitoring.dns.fqdn`	string	`"acme.example"`
`monitoring.dns.requested_types`	array<string>	`"A"`
`monitoring.dns.responses`	array<object>
`monitoring.dns.responses[].type`	string	`"A"`
`monitoring.dns.responses[].conn_status`	string	`"success"`
`monitoring.dns.responses[].rcode`	string	`"NOERROR"`
`monitoring.dns.responses[].raw`	string \| null	`"Raw record text."`
`monitoring.dns.responses[].values`	array<string> \| null
`monitoring.dns.responses[].server`	string
`monitoring.dns.servers`	array<string>
`monitoring.dns.check_date`	string	`"2025-07-31T08:00:00Z"`
`monitoring.ssl`	null
`monitoring.http`	object
`monitoring.http.requested_url`	string	`"http://acme.example/"`
`monitoring.http.version`	number	`1`
`monitoring.http.check_date`	string	`"2025-07-31T08:00:00Z"`
`monitoring.http.connection_status`	string	`"success"`
`monitoring.http.requested_domain`	string	`"acme.example"`
`monitoring.http.final_url`	string	`"http://acme.example/"`
`monitoring.http.final_domain`	string	`"acme.example"`
`monitoring.http.http`	object
`monitoring.http.http.redirection_history`	array<object>
`monitoring.http.http.redirection_history[].url`	string	`"http://acme.example/"`
`monitoring.http.http.redirection_history[].status_code`	number	`200`
`monitoring.http.http.headers`	array<object>
`monitoring.http.http.headers[].name`	string	`"server"`
`monitoring.http.http.headers[].value`	string	`"<value>"`
`monitoring.http.http.cookies`	array
`monitoring.http.html`	object
`monitoring.http.html.source_hash_code`	string
`monitoring.http.final_status_code`	number	`200`
`approve_date`	null
`ignore_date`	null
`seems_inactive`	boolean	`false`

Examples

Selecting one loads it into the request and response panels.

Reference updated September 27, 2026