Keyword Search

Search by Keyword

Search for domains based on keywords.

post/search-by-keyword

Request body

keywordsstring[] required

List of keywords to search for in URLs and domains. Useful for discovering compromises related to specific services (e.g., ['vpn', 'admin', 'portal']). Case-insensitive matching. Between 1-10 keywords required per request.

min_employees_compromisednumber

Minimum number of compromised employees required for results. Useful for filtering out domains with low compromise counts and focusing on significant breaches. Set to 0 to include all results regardless of count.

max_employees_compromisednumber

Maximum number of compromised employees for results. Useful for excluding extremely large breaches or focusing on organizations of specific sizes. Set to 0 to remove upper limit.

min_users_compromisednumber

Minimum number of compromised users (non-employees) required for results. Helps identify services with significant user impact. Set to 0 to include all results regardless of count.

max_users_compromisednumber

Maximum number of compromised users (non-employees) for results. Helps focus on services with specific user impact ranges. Set to 0 to remove upper limit.

last_employee_compromisedstring date-time

ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter for domains with employee compromises after this date. Useful for monitoring recent corporate breaches and active campaigns.

last_user_compromisedstring date-time

ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter for domains with user compromises after this date. Useful for monitoring recent consumer-facing breaches and active campaigns.

last_employee_uploadedstring date-time

ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter for domains with employee data uploaded after this date. Reflects when the data became available in our system rather than infection time.

last_user_uploadedstring date-time

ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter for domains with user data uploaded after this date. Reflects when the data became available in our system rather than infection time.

cursorstring

Base64 encoded pagination cursor for retrieving the next set of results. Obtained from the 'nextCursor' field in the previous response. Enables efficient pagination through large result sets without data loss.

Example request

{
  "keywords": [
    "webmail"
  ],
  "min_employees_compromised": 10,
  "max_employees_compromised": 100,
  "min_users_compromised": 5,
  "max_users_compromised": 50
}

Response

Successful keyword search

nextCursorstring

Cursor for the next page of results

Changes

No recorded changes to this endpoint across all 1 revision of this API.