---
title: "List all the fraudulent domains found for a company."
method: GET
path: "/api/v2/companies/{id}/findings/fraudulentdomains"
tags: ["Findings"]
---

# List all the fraudulent domains found for a company.

`GET /api/v2/companies/{id}/findings/fraudulentdomains`

Fraudulent domains and subdomains are used to run phishing campaigns by attackers. In order to do this, the attackers first register a domain with a name similar to the target company's domain name. Black Kite searches the internet, detects fraudulent websites by calculating the Levenshtein distance, radial distance, and runs a sophisticated machine learning algorithm to classify a domain as a fraudulent domain. 
 This category has 5% effect on total scan score.<br/><br/> For storage optimization, the system <b>permanently</b> deletes all findings that haven't been detected by the Black Kite scanner for over a year. Findings with manually changed statuses or associated tickets are excluded.

## Path parameters

- `id` integer, required

## Query parameters

- `page_number` integer
- `page_size` 10 | 20 | 30 | 50 | 100 | 250
- `status` string
- `severity` string
- `start_date` string, date-time
- `end_date` string, date-time
- `confidence_level` 'VeryHigh' | 'High' | 'Medium' | 'Low'
- `is_rsi_finding` boolean

## Response `200`

Success

- FraudulentDomainFinding[]
  - `FindingId` integer — The unique identifier of this finding.
  - `Domain` string — The domain which this finding is related.
  - `FraudulentDomain` string — The fraudulent domain.
  - `Severity` 'Info' | 'Low' | 'Medium' | 'High' | 'Critical' — The severity of a finding.
  - `Status` 'Active' | 'FalsePositive' | 'Suppressed' | 'Acknowledged' | 'Deleted' | 'Remediated' — The status of this finding. - Active, means the finding is still active with no review as of yet. - FalsePositive, means the finding is considered to be false alarm. - Suppressed, means the finding is suppressed, similar to FalsePositive. - Acknowledged, means the finding is accepted, for example will not be fixed. - Deleted, means the finding is deleted, similar to FalsePositive. - Remediated, means the finding is mitigated.
  - `FindingDate` string, date-time — The date that Black Kite first seen the finding.
  - `LastCheckDate` string, date-time — The date that Black Kite last checked the finding.
  - `ControlId` string — The unique identifier of the control that this finding relates to.
  - `Possibility` number — The possibility of this domain to be fraudulent.
  - `LevenshteinRatio` number — The resemblence of FraudulentDomain to Domain.
  - `Whois` Whois — The registrar, registrant, create date, expire date, registrant country, and registrant e-mail information of the related domain.
    - `Email` string — The email address of the registrant. Parsed from other sources, so output validation might be a good idea when rendering.
    - `Registrar` string — The registrar providing the registration services fro the registrants. Parsed from other sources, so output validation might be a good idea when rendering.
    - `Registrant` string — The registrant is considered the owner of the domain. Parsed from other sources, so output validation might be a good idea when rendering.
    - `CreateDate` string, date-time, nullable — The date the related domain is registered. The format of the this date-time field may differ. A valid example is, 1991-05-02T04:00:00.000Z. Another valid example is 04/24/2020 08:44:02.
    - `ExpireDate` string, date-time, nullable — The date the related domain's registration will expire. The format of the this date-time field may differ. A valid example is, 1991-05-02T04:00:00.000Z. Another valid example is 04/24/2020 08:44:02.
    - `Country` string — The country of the registrant.
  - `Ticket` FindingTicketSummary — A summary information of a finding ticket.
    - `TicketId` number, nullable — The unique identifier of the ticket.
    - `Status` 'Unassigned' | 'Assigned' | 'In Progress' | 'Closed–Acknowledged' | 'Closed–Remediated' | 'Closed–False Positive' | 'On Hold' | 'Recheck' | 'Deleted' — The status of this ticket. A ticket is automatically in “Assigned” status when a user with admin rights assigns it to another user. Depending on the user type, tickets can have different statuses: In Progress, On Hold and Recheck. - Unassigned: No owner has been set; the ticket is pending assignment. - In progress: Means the user takes responsibility of the associated finding and in the remediation process. - On hold: Means the user is waiting for another action to be completed before s/he takes action with regards to the finding. - Recheck: Means the user has completed her/his progress about the finding and waits for the user who assigns the ticket (or follow-up user with admin rights) to close it. An admin user can set a ticket in seven different statuses, In Progress, On Hold, Recheck, Closed-Acknowledged, Closed-Remediated, Closed-False Positive, and Deleted. - Closed-Acknowledged: The definition is very similar to risk acceptance. This means no or limited action can be taken with regards to the finding. There is no way but to accept the risk of the finding. This could be due to an out-of-date system soon to be retired. - Closed–Remediated: The action right after the Recheck status. If a company user sets the ticket in Recheck status, it is then passed to the admin user for him/her to close the issue. Closed status means the issue is fixed. - Closed-False Positive: Indicates a reported issue was a false alarm upon investigation. No action needed, as it poses no genuine risk. - Deleted: As the name suggests, this deletes the ticket (not the finding). It does not necessarily mean the issue is fixed or risk is accepted.
    - `Owner` string, nullable — A ticket may have one or more owners. But this field contains the name or the email address of the first one.
  - `ConfidenceLevel` 'Low' | 'Medium' | 'High' | 'VeryHigh', nullable — The confidence level of this finding.
  - `UpdateDate` string, date-time, nullable — The date that the finding was last updated.
  - `IsRsiFinding` boolean — Indicates whether this finding contributes to the company's Ransomware Susceptibility Index (RSI) score.

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `default` — Failure

---

[API](https://skmtc.net/blackkitetech/apis/black-kite-api.md) · [All operations](https://skmtc.net/blackkitetech/apis/black-kite-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/blackkitetech/black-kite-api/revisions/7dadaba760fb/schema)