Netlas

Netlas

The Netlas module is an API-backed intelligence engine for domains and IPv4 targets using the Netlas.io Host and Download APIs.

Important

Data Attribution: All host information, anonymity labels, vulnerabilities, threat intelligence data, and associated network context, etc., extracted by this module are exclusively provided by Netlas.io.

To maximize flexibility, this module provides explicit demo mode support and exposes different entities depending on your API subscription plan.

See API Credentials for configuration details.

Capabilities

The Netlas module extracts a wide range of data, from basic host information to premium intelligence (such as Anonymity Labels, CVEs, exploit links, Threat Intelligence Data, etc.), depending on your pricing plan (from Free Tier up to Corporate).

Crucially, while ReconSR always preserves the raw JSON response from Netlas for complete reference, the module does not stop at flat data extraction. It performs deep structural parsing, deduplication, and intelligent filtering to build a comprehensive relationship graph. The following examples illustrate just a portion of the extensive processing performed under the hood across all of its operations:

• DNS Validation & Parsing: Standard DNS records (e.g., A, AAAA, CNAME, MX, NS) discovered via the Host or Download APIs are strictly pre-validated before entering the graph to filter out garbage data. Complex records are deeply unpacked: TXT records are analyzed for SPF and DMARC policies, from which administrative emails, authorized domains, and IP/CIDR blocks are extracted as distinct nodes. Furthermore, PTR records are dynamically evaluated: if a PTR value is a valid domain, it is emitted as a Domain node (tagged for reverse IP filtering); if invalid, it is simply attached as a raw PTR property.
• WHOIS Sanitization: Contact information is deeply parsed to extract actionable graph nodes (Persons, Organizations, Emails, Phones). Addresses are aggregated and cleanly concatenated into single-string address nodes, automatically filtering out privacy placeholders, registrar stubs, and redacted values.
• Threat Intelligence Evaluation: Premium IoC data is analyzed per-tag (e.g., C2, Malware, Phishing, Ransomware). The module evaluates potential false positives (FPs) based on Netlas's own scoring; if a threat is confirmed without a high FP probability, the host is explicitly tagged to aid in downstream risk filtering on the graph.
• Service & Exposure Profiling: Extracts open ports, running software products, and linked exploit references. For vulnerabilities, the module performs strict filtering: it only emits explicit CVE identifiers onto the graph if Netlas matched them by exact software version (CPE), effectively discarding potential false-positive CVEs matched only by general product name. The complete set of vulnerabilities (including broad product-name matches) is still preserved within the saved raw JSON data for manual review.
• Network Context: Resolves ASN metadata, reverse IP relationships (PTR), and Anonymity Labels (identifying VPNs, Proxies, or Tor exit nodes). Geographic location data is similarly aggregated and concatenated into a clean, single-string representation.

The capabilities are split into Host API enrichment and Download API bulk retrieval:

Domain & IP Enrichment (Host API)

Requires a configured API key.

The module accepts Domain (and optionally Subdomain) and IPv4 nodes, pulling exhaustive details from the Netlas Host API. It returns aggregated data from across all Netlas collections in a single response.

• Domain Profiling (get_netlas_domain): Enriches a domain by extracting its resolved IP addresses, ports, software, DNS records, WHOIS data, tags, CVEs, exploit links, etc.
• IP Profiling (get_netlas_ip): Enriches an IPv4 address by extracting ports, software, WHOIS data, ASN info, geolocation, reverse IP domains, Anonymity Labels, Threat Intelligence Data, etc.

Note

By default, the module only scans root domains. You can enable subdomain scanning by setting NetlasScanSubdomains=true in your Network Configuration.

Demo Mode

If you want to test the module without using your own Netlas quota or API key, set the Netlas key to demo-api-key in configs/keys.txt. In demo mode, the module does not connect to the Netlas API. Instead, it returns a hardcoded, fake sample response. The results will be completely identical regardless of the target you are investigating, but they are fully structured to demonstrate the module's parsing and extraction capabilities.

Bulk DNS & Reverse IP (Download API)

Requires a configured API key and NetlasLimitPerOneDownload > 0.

The module utilizes the Netlas Download API for bulk retrieval of related domains. Along with the domains, these functions extract IPs directly from the JSON response and route the associated DNS records through the deep DNS parser (extracting further IPs, domains, and TXT policies).

• Reverse IP (get_netlas_domains_by_ip): Performs bulk retrieval of domains hosted on a specific IPv4 address.
• Passive DNS (get_netlas_domains_by_domain): Performs bulk retrieval of related domains for a given domain.

Warning

These download functions are disabled by default. You must configure NetlasLimitPerOneDownload in your Network Configuration to a value greater than 0 to enable them. Carefully review your Netlas download quota before setting large limits.

Demo Mode

Similarly, setting the Netlas key to demo-api-key enables demo mode for the download functions. ReconSR will return a hardcoded, fake set of Passive DNS/Reverse IP results without making any live API calls. These results are identical for any target and will completely ignore your NetlasLimitPerOneDownload setting, allowing you to safely observe the bulk extraction behavior.