---
title: "ClickFix Site Feed"
method: POST
path: "/threat-feeds/clickfix"
tags: ["Threat Feeds"]
---

# ClickFix Site Feed

`POST /threat-feeds/clickfix`

Cursor-paginated, filterable, multi-sortable feed of ClickFix sites. Requires the `clickfix` api permission. Uses keyset (cursor) pagination: pass `pageInfo.nextCursor` back as `cursor` for the next page. Each row is a full record including the base64 screenshot blobs, so `limit` is capped at 20 (default 20). Boolean filters are opt-in (only `true` filters); `query` is a case-insensitive match over `domain`/`url`/`pageTitle`.

## Request body

- object
  - `query` string — Case-insensitive match over domain/url/pageTitle (regex-safe).
  - `dateFrom` string — ISO date/datetime — `timestamp >= dateFrom`.
  - `dateTo` string — ISO date — `timestamp <= dateTo` (whole end day included).
  - `malicious` boolean — Filter to malicious sites (opt-in).
  - `clipboardHijacked` boolean — Opt-in filter.
  - `captchaFound` boolean — Opt-in filter.
  - `isNsfw` boolean — Opt-in filter.
  - `country` string — metadata.country exact match.
  - `sort` 'date' | 'domain' — `date` = timestamp, `domain` = domain.
  - `dir` 'asc' | 'desc'
  - `cursor` string — Opaque keyset cursor from a previous response's `pageInfo.nextCursor`. Omit for the first page. Must match the `sort`/`dir` it was issued for (else `400`).
  - `limit` integer — Rows per page. Clamped to [1, 20] — this feed returns full records including screenshot blobs, so pages are heavier than the C2 feed.
  - `withTotal` boolean — When true, also compute `pageInfo.total` via a full count over the filter. Expensive — avoid unless needed.

## Response `200`

Successful operation

- object
  - `data` object[]
    - `_id` string — Unique record identifier.
    - `domain` string — Captured domain.
    - `url` string — Captured URL.
    - `timestamp` string, date-time — Capture time.
    - `captchaFound` boolean — A CAPTCHA/verification widget was present.
    - `clipboardHijacked` boolean — The page hijacked the clipboard.
    - `malicious` boolean — Flagged malicious.
    - `isNsfw` boolean — Flagged NSFW.
    - `isCompromised` boolean — Whether the domain has compromised credentials.
    - `clipboardContent` string, nullable — Content the page wrote to the clipboard.
    - `pageTitle` string, nullable — Page title.
    - `screenshots` object — Base64-encoded screenshots of the ClickFix page.
      - `before` string, nullable — Screenshot before interaction (base64).
      - `after` string, nullable — Screenshot after interaction (base64).
    - `metadata` object
      - `ip` string, nullable
      - `country` string, nullable — ISO-2 country code.
      - `asn` integer, nullable
      - `server` string, nullable
      - `technologies` string[]
      - `tags` string[]
      - `urlscanLink` string, nullable
    - `createdAt` string, date-time — Record creation time.
    - `updatedAt` string, date-time — Record last-update time.
  - `pageInfo` object
    - `limit` integer
    - `count` integer
    - `hasMore` boolean
    - `nextCursor` string, nullable — Opaque keyset cursor for the next page. Pass it back as `cursor` to fetch the next page. `null` when `hasMore` is false. A cursor is bound to its sort+filter context — changing `sort`/`dir`/filters invalidates it.
    - `total` integer — Total documents matching the filter (no cursor). Present only when `withTotal: true` was sent. Expensive — a full count over the filter.
    - `sort` object
      - `key` string
      - `dir` 'asc' | 'desc'

## Other responses

- `400` — Validation error — malformed date, unknown sort/dir, or a cursor that does not match the requested sort.
- `401` — Missing or invalid `api-key`.
- `403` — The API key lacks the required permission for this feed.
- `500` — Internal server error.

---

[API](https://skmtc.net/hudsonrock/apis/cavalier-api.md) · [All operations](https://skmtc.net/hudsonrock/apis/cavalier-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/hudsonrock/cavalier-api/revisions/5ba0142eec4d/schema)