v1

latestOpenAPI 3.0.02026-07-24311994.6 KB

Threat Feeds

ClickFix Domain Lookup

Returns a single domain's most-recent full ClickFix record, including the base64 screenshot blobs. Requires the clickfix api permission. If the exact domain misses and it has more than two labels (and isn't a bare IPv4), the lookup retries once with the registrable root domain (eTLD+1); returns 404 if nothing matches.

post/threat-feeds/clickfix/{domain}

Path parameters

domainstring required

The domain to look up (case-insensitive).

Response

Successful operation

Example response

{
  "data": {
    "_id": "665f1a2b3c4d5e6f7a8b9c0d",
    "domain": "clickfix-example.com",
    "url": "https://clickfix-example.com/verify",
    "timestamp": "2026-01-31T10:15:00.000Z",
    "clipboardHijacked": true,
    "malicious": true,
    "isCompromised": true,
    "pageTitle": "Verify you are human",
    "metadata": {
      "ip": "203.0.113.10",
      "country": "US",
      "asn": 64500,
      "server": "nginx"
    }
  }
}