v1

latestOpenAPI 3.0.0Proprietary - Commercial Use Only2026-08-06172139621.6 KB

Findings

List all the fraudulent domains found for a company.

Fraudulent domains and subdomains are used to run phishing campaigns by attackers. In order to do this, the attackers first register a domain with a name similar to the target company's domain name. Black Kite searches the internet, detects fraudulent websites by calculating the Levenshtein distance, radial distance, and runs a sophisticated machine learning algorithm to classify a domain as a fraudulent domain. This category has 5% effect on total scan score.<br/><br/> For storage optimization, the system <b>permanently</b> deletes all findings that haven't been detected by the Black Kite scanner for over a year. Findings with manually changed statuses or associated tickets are excluded.

get/api/v2/companies/{id}/findings/fraudulentdomains

Path parameters

idinteger required

The id of the target company.

Query parameters

page_numberinteger

Example:1

The number of the page requested.

page_size10 | 20 | 30 | 50 | 100 | 250

Example:10

The number of result items in a single response.

statusstring

Example:Suppressed,Acknowledged

Comma separated current status of this finding. Possible values are; Active, FalsePositive, Suppressed, Acknowledged and Deleted. When left out, all is implied.

severitystring

Example:Critical,High

Comma separated severity values of this finding. Possible values are; Info, Low, Medium, High and Critical. When left out, all is implied.

start_datestring date-time

Example:2024-01-01T00:00:00.000Z

The start date for filtering findings by date range (format: date-time). Must be used together with end_date. The date range must not exceed 15 days.

end_datestring date-time

Example:2024-01-15T23:59:59.000Z

The end date for filtering findings by date range (format: date-time). Must be used together with start_date. The date range must not exceed 15 days.

confidence_level'VeryHigh' | 'High' | 'Medium' | 'Low'

Example:High

Filter findings by confidence level. Possible values are: VeryHigh, High, Medium, Low. When left out, all is implied.

is_rsi_findingboolean

Example:true

Filter findings by whether they contribute to the Ransomware Susceptibility Index (RSI).

Response

Success

FindingIdinteger

The unique identifier of this finding.

Domainstring

The domain which this finding is related.

FraudulentDomainstring

The fraudulent domain.

Severity'Info' | 'Low' | 'Medium' | 'High' | 'Critical'

The severity of a finding.

The status of this finding.

Active, means the finding is still active with no review as of yet.
FalsePositive, means the finding is considered to be false alarm.
Suppressed, means the finding is suppressed, similar to FalsePositive.
Acknowledged, means the finding is accepted, for example will not be fixed.
Deleted, means the finding is deleted, similar to FalsePositive.
Remediated, means the finding is mitigated.

FindingDatestring date-time

The date that Black Kite first seen the finding.

LastCheckDatestring date-time

The date that Black Kite last checked the finding.

ControlIdstring

The unique identifier of the control that this finding relates to.

Possibilitynumber

The possibility of this domain to be fraudulent.

LevenshteinRationumber

The resemblence of FraudulentDomain to Domain.

ConfidenceLevel'Low' | 'Medium' | 'High' | 'VeryHigh' nullable

The confidence level of this finding.

UpdateDatestring date-time nullable

The date that the finding was last updated.

IsRsiFindingboolean

Indicates whether this finding contributes to the company's Ransomware Susceptibility Index (RSI) score.

Example response

[
  {
    "FindingId": 2590965999,
    "Domain": "acmeinc.com",
    "FraudulentDomain": "acmeinc_fraud.com",
    "Severity": "Medium",
    "Status": "Active",
    "FindingDate": "2021-08-09T08:30:30.682Z",
    "LastCheckDate": "2021-08-09T08:30:30.682Z",
    "ControlId": "FRADOM-001",
    "Whois": {
      "Email": "admin@acmeinc.com",
      "Registrar": "MarkMonitor Inc.",
      "Registrant": "Acme, Inc MV",
      "Country": "Canada"
    },
    "Ticket": {
      "Status": "Assigned",
      "Owner": "John Doe"
    },
    "ConfidenceLevel": "High",
    "UpdateDate": "2021-08-09T08:30:30.682Z",
    "IsRsiFinding": true
  }
]