class Zetalytics::Api

Public Class Methods

new(api_key=nil, options={}) click to toggle source
# File lib/zetalytics.rb, line 9
def initialize(api_key=nil, options={})
  @base_uri = "https://zonecruncher.com/api/v2"
  @api_key = api_key

  # if we weren't passed a config
  unless @api_key
    # check to see if a config file exists
    config_file_path = "#{File.dirname(__FILE__)}/../config/config.json"
    if File.exist? config_file_path
      config = JSON.parse(File.open(config_file_path,"r").read)
      @api_key = config["api_key"]
    else
      raise "Unable to continue... no api key!"
    end
  end
end

Public Instance Methods

search_by_hostname(domain) click to toggle source

Search passive dns by hostname for mixed resource record types

# File lib/zetalytics.rb, line 227
def search_by_hostname (domain)
  result = JSON.parse RestClient.get "#{@base_uri}/hostname?q=#{domain}&token=#{@api_key}" 
  if result["total"] > 0
    return result
  else
    return
  end
end
search_by_ip(ip) click to toggle source

Search passive dns by IP, CIDR, or Range (v6 compatible)

# File lib/zetalytics.rb, line 237
def search_by_ip (ip)
  result = JSON.parse RestClient.get "#{@base_uri}/ip?q=#{ip}&token=#{@api_key}"
  if result["total"] > 0
    return result
  else
    return
  end
end
search_by_unique_email_address(email) click to toggle source

Search for domains sharing a registration email address or SOA email from passive

# File lib/zetalytics.rb, line 187
def search_by_unique_email_address (email)
  result = JSON.parse RestClient.get "#{@base_uri}/email_address?q=#{email}&token=#{@api_key}" 
  if result["total"] > 0
    return result
  else
    return
  end
end
search_cname2qname(cname) click to toggle source
# File lib/zetalytics.rb, line 27
def search_cname2qname (cname)
  result = JSON.parse RestClient.get "#{@base_uri}/cname2qname?q=#{cname}&token=#{@api_key}"
  if result["total"] > 0
    return result
  else
    return
  end
end
search_domain2cname(domain) click to toggle source

Search passive dns by domain for CNAME records

# File lib/zetalytics.rb, line 59
def search_domain2cname (domain)
  result = JSON.parse RestClient.get "#{@base_uri}/domain2cname?q=#{domain}&token=#{@api_key}"
  if result["total"] > 0
    return result
  else
    return
  end
end
search_domain2ip(domain) click to toggle source

Search passive dns by domain for A (IPv4) records

# File lib/zetalytics.rb, line 80
def search_domain2ip (domain)
  result = JSON.parse RestClient.get "#{@base_uri}/domain2ip?q=#{domain}&token=#{@api_key}"
  if result["total"] > 0
    return result
  else
    return
  end
end
search_domain2malwaredns(domain) click to toggle source

Search malware dns by domain (some of the results are obsolete)

# File lib/zetalytics.rb, line 90
def search_domain2malwaredns (domain)
  result = JSON.parse RestClient.get "#{@base_uri}/domain2malwaredns?q=#{domain}&token=#{@api_key}"
  if result["total"] > 0
    return result
  else
    return
  end
end
search_domain2malwarehttp(domain) click to toggle source

Search malware http by domain (some of the results are obsolete)

# File lib/zetalytics.rb, line 100
def search_domain2malwarehttp (domain)
  result = JSON.parse RestClient.get "#{@base_uri}/domain2malwarehttp?q=#{domain}&token=#{@api_key}"
  if result["total"] > 0
    return result
  else
    return
  end
end
search_domain2mx(domain) click to toggle source

Search passive dns by domain for MX records

# File lib/zetalytics.rb, line 110
def search_domain2mx (domain)
  result = JSON.parse RestClient.get "#{@base_uri}/domain2mx?q=#{domain}&token=#{@api_key}"
  if result["total"] > 0
    return result
  else
    return
  end
end
search_domain2ns(domain) click to toggle source

Search passive dns by domain for NS records

# File lib/zetalytics.rb, line 120
def search_domain2ns (domain)
  result = JSON.parse RestClient.get "#{@base_uri}/domain2ns?q=#{domain}&token=#{@api_key}"
  if result["total"] > 0
    return result
  else
    return
  end
end
search_domain2nsglue(domain) click to toggle source

Search name server glue (IP) records by domain name. NOTE: these are only the glue records found in gTLD zone files and NOT all IP records for every name server domain. what is dns glue record? => ns1.com/blog/glue-records-and-dedicated-dns#:~:text=What%20is%20a%20Glue%20Record,ns2.example.net%E2%80%9D.

# File lib/zetalytics.rb, line 133
def search_domain2nsglue (domain)
  result = JSON.parse RestClient.get "#{@base_uri}/domain2nsglue?q=#{domain}&token=#{@api_key}"
  if result["total"] > 0
    return result
  else
    return
  end
end
search_domain2ptr(domain) click to toggle source

Search passive dns by domain for PTR records

# File lib/zetalytics.rb, line 143
def search_domain2ptr (domain)
  result = JSON.parse RestClient.get "#{@base_uri}/domain2ptr?q=#{domain}&token=#{@api_key}"
  if result["total"] > 0
    return result
  else
    return
  end
end
search_domain2txt(domain) click to toggle source

Search passive dns by domain for TXT records

# File lib/zetalytics.rb, line 153
def search_domain2txt (domain)
  result = JSON.parse RestClient.get "#{@base_uri}/domain2txt?q=#{domain}&token=#{@api_key}"
  
  
  if result["total"] > 0
    return result
  else
    return
  end
end
search_domain2whois(domain) click to toggle source

Search historical whois records

# File lib/zetalytics.rb, line 165
def search_domain2whois (domain)
  result = JSON.parse RestClient.get "#{@base_uri}/domain2whois?q=#{domain}&token=#{@api_key}"
  if result["total"] > 0
    return result
  else
    return
  end
end
search_domain_dname_records(domain) click to toggle source

Search zonefile changes by domain for DNAME record. A DNAME record creates an alias for an entire subtree of the domain name tree

# File lib/zetalytics.rb, line 38
def search_domain_dname_records (domain)
  domain_name =  domain.split('.')[0]
  result = JSON.parse RestClient.get "#{@base_uri}/domain-zone-activity?q=#{domain}&token=#{@api_key}"
  if result["total"] > 0
    return result
  else
    return
  end
end
search_domain_for_ipv6_records(domain) click to toggle source

Search passive dns by domain for AAAA (IPv6) records

# File lib/zetalytics.rb, line 49
def search_domain_for_ipv6_records (domain)
  result = JSON.parse RestClient.get "#{@base_uri}/domain2aaaa?q=#{domain}&token=#{@api_key}"
  if result["total"] > 0
    return result
  else
    return
  end
end
search_email_address(domain) click to toggle source

Search for domains sharing a known registered email address or SOA email from passive

# File lib/zetalytics.rb, line 175
def search_email_address (domain)
  # using "a*@" is for identifying a large number of domains since the majority of DNS recorded contains else the administrator contact or abuse contact
  email = "a*@"+ domain
  result = JSON.parse RestClient.get "#{@base_uri}/email_address?q=#{email}&token=#{@api_key}" 
  if result["total"] > 0
    return result
  else
    return
  end
end
search_email_domain(domain) click to toggle source

Search for domains sharing a registration email address domain

# File lib/zetalytics.rb, line 197
def search_email_domain (domain)
  result = JSON.parse RestClient.get "#{@base_uri}/email_domain?q=#{domain}&token=#{@api_key}" 
  if result["total"] > 0
    return result
  else
    return
  end
end
search_hash2malwaredns(hash) click to toggle source

Search malware dns by md5 hash

# File lib/zetalytics.rb, line 207
def search_hash2malwaredns (hash)
  result = JSON.parse RestClient.get "#{@base_uri}/hash2malwaredns?q=#{hash}&token=#{@api_key}"
  if result["total"] > 0
    return result
  else
    return
  end
end
search_historical_live_dnsrecords(domain) click to toggle source

Search historical d8s records and/or live d8s

# File lib/zetalytics.rb, line 69
def search_historical_live_dnsrecords (domain)
  result = JSON.parse RestClient.get "#{@base_uri}/domain2d8s?q=#{domain}&token=#{@api_key}"
  if result["total"] > 0
    return result
  else
    return
  end
end
search_ip2malwaredns(ip) click to toggle source

Search malware dns by IP

# File lib/zetalytics.rb, line 247
def search_ip2malwaredns(ip)
  result = JSON.parse RestClient.get "#{@base_uri}/ip2malwaredns?q=#{ip}&token=#{@api_key}"
  if result["total"] > 0
    return result
  else
    return
  end
end
search_ip2malwarehttp(ip) click to toggle source

Search malware http by IP/CIDR for x.x.x.x/ (not the IP a hostname resolved to). These results would not appear in the malware dns result since they do not require a DNS lookup.

# File lib/zetalytics.rb, line 258
def search_ip2malwarehttp(ip)
  result = JSON.parse RestClient.get "#{@base_uri}/ip2malwarehttp?q=#{ip}&token=#{@api_key}"
  if result["total"] > 0
    return result
  else
    return
  end
end
search_ip2nsglue(ip) click to toggle source

Search name server glue (IP) records by IP, CIDR, or Range (v6 compatible) what is dns glue record? => ns1.com/blog/glue-records-and-dedicated-dns#:~:text=What%20is%20a%20Glue%20Record,ns2.example.net%E2%80%9D.

# File lib/zetalytics.rb, line 269
def search_ip2nsglue(ip)
  result = JSON.parse RestClient.get "#{@base_uri}/ip2nsglue?q=#{ip}&token=#{@api_key}"
  if result["total"] > 0
    return result
  else
    return
  end
end
search_livedns(domain) click to toggle source

Perform a live DNS lookup for a domain

# File lib/zetalytics.rb, line 279
def search_livedns(domain)
  result = JSON.parse RestClient.get "#{@base_uri}/liveDNS?q=#{domain}&token=#{@api_key}"
  if result["total"] > 0
    return result
  else
    return
  end
end
search_mx2domain(nameserver) click to toggle source

Search passive dns by MX domain for any domain served by the MX domain

# File lib/zetalytics.rb, line 299
def search_mx2domain(nameserver)
  result = JSON.parse RestClient.get "#{@base_uri}/mx2domain?q=#{nameserver}&token=#{@api_key}"
  if result["total"] > 0
    return result
  else
    return
  end
end
search_ns2domain(nameserver) click to toggle source

Search current zone files and passive DNS for domains served by nameserver.

# File lib/zetalytics.rb, line 309
def search_ns2domain(nameserver)
  result = JSON.parse RestClient.get"#{@base_uri}/ns2domain?q=#{nameserver}&token=#{@api_key}"
  if result["total"] > 0
    return result
  else
    return
  end
end
search_nszoneactivity(nameserver) click to toggle source

Search zonefile changes by nameserver

# File lib/zetalytics.rb, line 289
def search_nszoneactivity(nameserver)
  result = JSON.parse RestClient.get "#{@base_uri}/ns-zone-activity?q=#{nameserver}&token=#{@api_key}"
  if result["total"] > 0
    return result
  else
    return
  end
end
search_subdomains(domain) click to toggle source

Search passive dns by domain for a list of subdomains from any record type.

# File lib/zetalytics.rb, line 319
def search_subdomains(domain)
  result = JSON.parse RestClient.get "#{@base_uri}/subdomains?q=#{domain}&token=#{@api_key}"
  if result["total"] > 0
    return result
  else
    return
  end
end