域名高级分析接口
接口说明
域名高级分析接口用于聚合查询指定域名的多维情报信息,包括域名威胁标签、当前解析 IP、域名 WHOIS、TLS 证书、ICP备案、关联样本、Quake 资产和公开报告。
请求地址
https://api.f.360.cn/advanced/domain
请求方法
POST
请求参数
| 参数名 | 类型 | 位置 | 必选 | 示例值 | 说明 |
|---|---|---|---|---|---|
value | string | Body | 是 | yqwyqw3-baidu.com | 需要查询的域名,最大长度 253,格式需符合标准域名格式 |
响应参数
基础响应字段
| 参数名 | 类型 | 说明 |
|---|---|---|
code | int | 响应状态码,200 表示成功 |
message | string | 响应消息 |
data | object | 域名高级分析结果 |
meta | object / null | 扩展元信息 |
data 字段
| 参数名 | 类型 | 说明 |
|---|---|---|
result | object | 域名 IOC 标签和基础威胁情报 |
cur_ips | list | 域名当前 A/AAAA 解析 IP 列表;为空时返回空列表 |
cur_whois | list | 当前域名 WHOIS 记录列表;无数据时返回空列表 |
cert | list | TLS/SSL 证书列表,最多返回 10 条 |
icp | object | ICP 备案信息;无备案时返回空对象 |
samples | list | 关联通信样本摘要,最多返回 10 条 |
quake | list | Quake 域名资产服务信息,最多返回 10 条 |
reports | list | 关联公开报告列表;无数据时返回空列表 |
result 字段
| 参数名 | 类型 | 说明 |
|---|---|---|
ioc | string | 查询域名 |
ioc_type | string | IOC 类型,域名为 domain |
level | int / null | 风险等级数值 |
confidence | int / null | 置信度数值 |
status | string | IOC 状态,例如 OVER |
first_time | string | 首次发现时间 |
last_time | string | 最近发现时间 |
expire_time | string / null | 过期时间 |
tags | list | 域名标签列表;为空时返回空列表 |
tags 字段
| 参数名 | 类型 | 说明 |
|---|---|---|
name | string | 标签名称 |
desc | string | 标签描述 |
severity | int / null | 标签严重程度数值 |
tag_type | string | 标签类型 |
ttps | object / null | TTP 分类信息;常见字段包含 ti_type_main、ti_type_sub、ti_showname |
cur_ips 字段
| 参数名 | 类型 | 说明 |
|---|---|---|
rdata | string | 解析到的 IP |
rtype | string | DNS 记录类型,A 或 AAAA |
level | string / null | 解析 IP 风险等级,例如 unknown、safe、low |
geo | object | 解析 IP 的地理位置和网络归属信息 |
geo 字段
| 参数名 | 类型 | 说明 |
|---|---|---|
continent | string | 大洲 |
country | string | 国家/地区 |
areacode | string | 国家/地区代码 |
province | string | 省份/州 |
city | string | 城市 |
district | string | 区县 |
asn | int / null | ASN |
as | string | AS 名称 |
operator | string | 运营商/组织 |
longitude | string | 经度 |
latitude | string | 纬度 |
cur_whois 字段
| 参数名 | 类型 | 说明 |
|---|---|---|
status | list | 域名状态列表 |
r_domainname | string | 根域名/查询域名 |
whoisserver | list | WHOIS 服务列表 |
domainname | list | 域名列表 |
nameservers | list | NS 服务器列表 |
expiresdate | list | 过期时间列表 |
registrarname | list | 注册商列表 |
updateddate | list | 更新时间列表 |
source | list | 数据来源列表 |
createddate | list | 创建时间列表 |
first_seen | string | 首次观测时间 |
last_seen | string | 最近观测时间 |
cert 字段
| 参数名 | 类型 | 说明 |
|---|---|---|
subject_CN | string | 证书主体 CN |
subject | string | 证书主体 |
issuer | string | 证书签发者 |
validity_status | string | 证书有效性状态,例如 valid、invalid |
trusted_status | string | 证书信任状态,例如 trust、untrusty |
start | string | 证书生效时间 |
end | string | 证书过期时间 |
SAN | list | 证书备用名称列表 |
sources | list | 证书来源列表 |
endpoints | list | 观测到的 IP:端口列表 |
md5 | string | 证书 MD5 指纹 |
sha1 | string | 证书 SHA1 指纹 |
sha256 | string | 证书 SHA256 指纹 |
samples 字段
| 参数名 | 类型 | 说明 |
|---|---|---|
file_name | string | 样本文件名 |
file_size | int / string | 样本大小(Byte);未知时可能为空字符串 |
file_type | string | 文件类型 |
md5 | string | MD5 |
sha1 | string | SHA1 |
sha256 | string | SHA256 |
first_time | string | 首次发现时间 |
level | string / null | 样本风险等级,例如 safe、unknown |
virus_name | string / null | 病毒名 |
quake 字段
| 参数名 | 类型 | 说明 |
|---|---|---|
domain | string | 资产域名 |
ip | string | 资产 IP |
asn | int / string / null | ASN |
transport | string | 传输协议 |
port | int | 端口 |
time | string | 资产记录时间 |
hostname | string | 主机名,可能为空字符串 |
org | string | 组织 |
service | object | 服务信息,当前包含 name |
components | list | 组件信息列表;每项包含产品层级、类型、厂商、中文/英文产品名、产品目录、版本等 |
location | object | Quake 地理位置和场景信息,包含中英文国家/省市、country_code、asname、isp、gps、scene 等 |
reports 字段
| 参数名 | 类型 | 说明 |
|---|---|---|
title | string | 报告标题 |
author | string | 报告作者 |
tags | list | 报告标签 |
url | string | 报告链接 |
update_time | string | 报告更新时间 |
请求示例
支持cUrl、Python、Java、PHP、Go语言的请求,示例如下
#!/usr/bin/env bash
set -euo pipefail
APPID="" # apikey
SECRET="" # salt
URL="https://api.f.360.cn/advanced/domain"
BODY='{"value":"yqwyqw3-baidu.com"}'
NONCE=$(printf '%08d' $((RANDOM % 100000000)))
TIMESTAMP=$(date +%s)
BODY_MD5=$(printf '%s' "$BODY" | openssl dgst -md5 -hex | awk '{print $NF}')
SIGNATURE=$(printf '%s' "${BODY_MD5}${APPID}${NONCE}${TIMESTAMP}${SECRET}" | openssl dgst -md5 -hex | awk '{print $NF}')
SIGNATURE=${SIGNATURE:16}
curl --location --request POST "$URL" \
--header "Content-Type: application/json" \
--header "X-360-Key: ${APPID}" \
--header "X-360-Nonce: ${NONCE}" \
--header "X-360-Timestamp: ${TIMESTAMP}" \
--header "X-360-Signature: ${SIGNATURE}" \
--data "${BODY}"import hashlib
import json
import random
import time
import requests
APPID = "" # apikey
SECRET = "" # salt
def make_headers(appid, secret, body=""):
headers = {}
headers["X-360-Key"] = appid
headers["X-360-Nonce"] = str(random.randint(0, 99999999)).zfill(8)
headers["X-360-Timestamp"] = str(int(time.time()))
s = (
hashlib.md5(body.encode("utf8")).hexdigest()
+ headers["X-360-Key"]
+ headers["X-360-Nonce"]
+ headers["X-360-Timestamp"]
+ secret
)
md5 = hashlib.md5(s.encode("utf8")).hexdigest()
headers["X-360-Signature"] = md5[16:]
headers["Content-Type"] = "application/json"
return headers
def do_post(url, body):
res = requests.post(
url,
data=json.dumps(body), # noqa: F821
headers=make_headers(APPID, SECRET, json.dumps(body)),
)
print(res.text)
def do_get(url, params):
res = requests.get(url, headers=make_headers(APPID, SECRET), params=params)
print(res.json())
if __name__ == "__main__":
# 请求地址
url = "https://api.f.360.cn/advanced/domain"
# 查询参数
params = {"value": "yqwyqw3-baidu.com"}
do_post(url, params)import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.concurrent.ThreadLocalRandom;
public class Demo {
static String md5(String input) throws Exception {
byte[] digest = MessageDigest.getInstance("MD5")
.digest(input.getBytes(StandardCharsets.UTF_8));
StringBuilder sb = new StringBuilder();
for (byte b : digest) {
sb.append(String.format("%02x", b & 0xff));
}
return sb.toString();
}
public static void main(String[] args) throws Exception {
String appid = ""; // apikey
String secret = ""; // salt
String url = "https://api.f.360.cn/advanced/domain";
String body = "{\"value\":\"yqwyqw3-baidu.com\"}";
String nonce = String.format("%08d", ThreadLocalRandom.current().nextInt(100000000));
String timestamp = String.valueOf(System.currentTimeMillis() / 1000);
String signature = md5(md5(body) + appid + nonce + timestamp + secret).substring(16);
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create(url))
.header("Content-Type", "application/json")
.header("X-360-Key", appid)
.header("X-360-Nonce", nonce)
.header("X-360-Timestamp", timestamp)
.header("X-360-Signature", signature)
.POST(HttpRequest.BodyPublishers.ofString(body, StandardCharsets.UTF_8))
.build();
HttpClient client = HttpClient.newHttpClient();
HttpResponse<String> response = client.send(
request, HttpResponse.BodyHandlers.ofString(StandardCharsets.UTF_8));
System.out.println(response.body());
}
}<?php
// apikey
$appid = "";
// salt
$secret = "";
$url = 'https://api.f.360.cn/advanced/domain';
$body = json_encode(['value' => 'yqwyqw3-baidu.com'], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
$nonce = str_pad((string) random_int(0, 99999999), 8, "0", STR_PAD_LEFT);
$timestamp = (string) time();
$signature = substr(md5(md5($body) . $appid . $nonce . $timestamp . $secret), 16);
$ch = curl_init($url);
$options = [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-360-Key: {$appid}",
"X-360-Nonce: {$nonce}",
"X-360-Timestamp: {$timestamp}",
"X-360-Signature: {$signature}",
],
];
$options[CURLOPT_POST] = true;
$options[CURLOPT_POSTFIELDS] = $body;
curl_setopt_array($ch, $options);
$response = curl_exec($ch);
if ($response === false) {
echo curl_error($ch), PHP_EOL;
} else {
echo $response, PHP_EOL;
}
curl_close($ch);package main
import (
"bytes"
"crypto/md5"
"encoding/hex"
"fmt"
"io"
"math/rand"
"net/http"
"time"
)
func md5Hex(s string) string {
sum := md5.Sum([]byte(s))
return hex.EncodeToString(sum[:])
}
func main() {
appid := "" // apikey
secret := "" // salt
url := "https://api.f.360.cn/advanced/domain"
body := []byte(`{"value":"yqwyqw3-baidu.com"}`)
nonce := fmt.Sprintf("%08d", rand.Intn(100000000))
timestamp := fmt.Sprintf("%d", time.Now().Unix())
signature := md5Hex(md5Hex(string(body)) + appid + nonce + timestamp + secret)[16:]
req, err := http.NewRequest(http.MethodPost, url, bytes.NewReader(body))
if err != nil {
panic(err)
}
req.Header.Set("Content-Type", "application/json")
req.Header.Set("X-360-Key", appid)
req.Header.Set("X-360-Nonce", nonce)
req.Header.Set("X-360-Timestamp", timestamp)
req.Header.Set("X-360-Signature", signature)
resp, err := http.DefaultClient.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
respBody, err := io.ReadAll(resp.Body)
if err != nil {
panic(err)
}
fmt.Println(string(respBody))
}返回示例
{
"code": 200,
"message": "Success",
"data": {
"result": {
"ioc": "yqwyqw3-baidu.com",
"ioc_type": "domain",
"level": 40,
"confidence": 80,
"status": "OVER",
"first_time": "2024-11-29 03:39:05",
"last_time": "2026-03-13 21:02:54",
"expire_time": "2026-09-09 13:02:54",
"tags": [
{
"name": "Websafe.Phishing",
"desc": "Gambling / Illegal Lottery / phishing website description",
"severity": 50,
"tag_type": "ThreatType",
"ttps": {
"ti_type_main": "Websafe",
"ti_type_sub": "Phishing",
"ti_showname": "Websafe.Phishing"
}
}
]
},
"cur_ips": [
{
"rdata": "38.173.146.74",
"rtype": "A",
"level": "unknown",
"geo": {
"country": "United States",
"province": "California",
"city": "Los Angeles",
"asn": 398823,
"as": "PEG-LA",
"operator": "PEG TECH INC",
"longitude": "-118.24451400",
"latitude": "34.05194100"
}
}
],
"cur_whois": [
{
"status": [
"clientDeleteProhibited",
"clientRenewProhibited",
"clientTransferProhibited",
"clientUpdateProhibited"
],
"r_domainname": "yqwyqw3-baidu.com",
"whoisserver": [
"whois.godaddy.com"
],
"domainname": [
"yqwyqw3-baidu.com"
],
"nameservers": [
"ns1.dnsip.com",
"ns2.dnsip.com"
],
"expiresdate": [
"2027-02-25 12:27:46"
],
"registrarname": [
"GoDaddy.com, LLC"
],
"updateddate": [
"2025-12-19 07:00:19"
],
"source": [
"netlab"
],
"createddate": [
"2023-02-25 12:27:46"
],
"first_seen": "2026-02-13 12:36:55",
"last_seen": "2026-04-15 22:21:16"
}
],
"cert": [
{
"subject_CN": "dbjlhts1-baidu.com",
"subject": "CN=dbjlhts1-baidu.com",
"issuer": "C=US, O=Let's Encrypt, CN=R13",
"validity_status": "valid",
"trusted_status": "trust",
"start": "2026-03-17 19:34:24",
"end": "2026-06-15 19:34:23",
"SAN": [
"dbjlhts1-baidu.com",
"yqwyqw3-baidu.com"
],
"sources": [
"360se",
"360quake"
],
"endpoints": [
"",
"38.173.146.74:443"
],
"md5": "eaf19cffd28f508db09f834571fe75bd",
"sha1": "c7da8cd2bd722512e788c129ee0ce517e631fb79",
"sha256": "bca555e32ea7c65b65d52e8f408052d08be9fcb763d3815b5faa9f3143d3e623"
}
],
"icp": {},
"samples": [
{
"file_name": "msedge_exe",
"file_size": 4291144,
"file_type": "pe_exe_x64",
"md5": "e56e15d656e0241c7b2954c24aac1e65",
"sha1": "d1e157e4cbb11b1e7bbda496f094286db0f7b371",
"sha256": "b7fcce62083df4f781baa4e894a43075c41b9d04ae6285b16fb059f96416fe0a",
"first_time": "2025-03-26 00:00:00",
"level": "safe",
"virus_name": null
}
],
"quake": [
{
"domain": "yqwyqw3-baidu.com",
"ip": "38.173.146.74",
"asn": 398823,
"transport": "tcp",
"port": 443,
"time": "2026-04-28T10:52:14.634Z",
"hostname": "",
"org": "PEG TECH INC",
"service": {
"name": "http/ssl"
},
"location": {
"country_en": "United States",
"country_cn": "美国",
"country_code": "US",
"province_en": "California",
"city_en": "Los Angeles",
"asname": "PEG-LA",
"isp": "PEG TECH INC",
"scene_en": "Used",
"gps": [
-118.244514,
34.051941
]
}
}
],
"reports": []
},
"meta": null
}