---
title: "ClickFix Domain Lookup"
method: POST
path: "/threat-feeds/clickfix/{domain}"
tags: ["Threat Feeds"]
---

# ClickFix Domain Lookup

`POST /threat-feeds/clickfix/{domain}`

Returns a single domain's most-recent full ClickFix record, including the base64 screenshot blobs. Requires the `clickfix` api permission. If the exact domain misses and it has more than two labels (and isn't a bare IPv4), the lookup retries once with the registrable root domain (eTLD+1); returns `404` if nothing matches.

## Path parameters

- `domain` string, required

## Response `200`

Successful operation

- object
  - `data` object
    - `_id` string — Unique record identifier.
    - `domain` string — Captured domain.
    - `url` string — Captured URL.
    - `timestamp` string, date-time — Capture time.
    - `captchaFound` boolean — A CAPTCHA/verification widget was present.
    - `clipboardHijacked` boolean — The page hijacked the clipboard.
    - `malicious` boolean — Flagged malicious.
    - `isNsfw` boolean — Flagged NSFW.
    - `isCompromised` boolean — Whether the domain has compromised credentials.
    - `clipboardContent` string, nullable — Content the page wrote to the clipboard.
    - `pageTitle` string, nullable — Page title.
    - `screenshots` object — Base64-encoded screenshots of the ClickFix page.
      - `before` string, nullable — Screenshot before interaction (base64).
      - `after` string, nullable — Screenshot after interaction (base64).
    - `metadata` object
      - `ip` string, nullable
      - `country` string, nullable — ISO-2 country code.
      - `asn` integer, nullable
      - `server` string, nullable
      - `technologies` string[]
      - `tags` string[]
      - `urlscanLink` string, nullable
    - `createdAt` string, date-time — Record creation time.
    - `updatedAt` string, date-time — Record last-update time.

## Other responses

- `400` — Validation error — malformed date, unknown sort/dir, or a cursor that does not match the requested sort.
- `401` — Missing or invalid `api-key`.
- `403` — The API key lacks the required permission for this feed.
- `404` — No ClickFix record for the domain (after optional root fallback).
- `500` — Internal server error.

---

[API](https://skmtc.net/hudsonrock/apis/cavalier-api.md) · [All operations](https://skmtc.net/hudsonrock/apis/cavalier-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/hudsonrock/cavalier-api/revisions/5ba0142eec4d/schema)