getPassiveDnsCategories.sh

export EMAIL='YOUR_EMAIL'
export APIKEY='YOUR_APIKEY'
export ZONE_ID='YOUR_ACCOUNT_ID'

curl -sX GET "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/intel/dns?ipv4=43.153.133.9&start=2024-07-23&end=2024-07-26&per_page=200" \
   -H "X-Auth-Email: $EMAIL" \
   -H "X-Auth-Key: $APIKEY" \
   -H "Content-Type: application/json" | jq -r .result.reverse_records > reverse_records.json

for i in {0..$(cat reverse_records.json | jq 'length')}
do
  echo "${i}"
export HOSTNAME=$(cat reverse_records.json | jq -r '.['"${i}"'].hostname')
export DOMAIN=$(echo $HOSTNAME |awk -F'[./]' -v 'OFS=.' '{print $(NF-1),$NF}')
export CATEGORY=$(curl -sX GET "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/intel/domain?domain=$DOMAIN" \
     -H "X-Auth-Email: $EMAIL" \
     -H "X-Auth-Key: $APIKEY" \
     -H "Content-Type: application/json" | jq -r -c '.result.content_categories[]' | tr '\n' ',')
export RISK=$(curl -sX GET "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/intel/domain?domain=$DOMAIN" \
     -H "X-Auth-Email: $EMAIL" \
     -H "X-Auth-Key: $APIKEY" \
     -H "Content-Type: application/json" | jq -r -c '.result.risk_type[]' | tr '\n' ',')
cat reverse_records.json | jq '.['"${i}"'] |= .+ {"content_categories": ['"${CATEGORY%,}"'],"risk_type": ['"${RISK%,}"']} | .['"${i}"']'
done