HUhudsonrock
Threat Feeds

ClickFix Domain Lookup

Changed on

Returns a single domain's most-recent full ClickFix record, including the base64 screenshot blobs. Requires the clickfix api permission. If the exact domain misses and it has more than two labels (and isn't a bare IPv4), the lookup retries once with the registrable root domain (eTLD+1); returns 404 if nothing matches.

post/threat-feeds/clickfix/{domain}

Request

Path parameters

domainstring required

The domain to look up (case-insensitive).

Response

Successful operation

Example response

{
  "data": {
    "_id": "665f1a2b3c4d5e6f7a8b9c0d",
    "domain": "clickfix-example.com",
    "url": "https://clickfix-example.com/verify",
    "timestamp": "2026-01-31T10:15:00.000Z",
    "clipboardHijacked": true,
    "malicious": true,
    "isCompromised": true,
    "pageTitle": "Verify you are human",
    "metadata": {
      "ip": "203.0.113.10",
      "country": "US",
      "asn": 64500,
      "server": "nginx"
    },
    "compromised_data": {
      "domain": "acme.com",
      "compromised_employees": 42,
      "last_employee_compromised": "2026-06-11T00:00:00.000Z",
      "compromised_users": 1380,
      "last_user_compromised": "2026-07-02T00:00:00.000Z"
    }
  }
}

Changes