HUhudsonrock
Threat Feeds

ClickFix Site Feed

Changed on

Cursor-paginated, filterable, multi-sortable feed of ClickFix sites. Requires the clickfix api permission. Uses keyset (cursor) pagination: pass pageInfo.nextCursor back as cursor for the next page. Each row is a full record including the base64 screenshot blobs, so limit is capped at 20 (default 20). Boolean filters are opt-in (only true filters); query is a case-insensitive match over domain/url/pageTitle.

post/threat-feeds/clickfix

Request

Request body

querystring

Case-insensitive match over domain/url/pageTitle (regex-safe).

dateFromstring

ISO date/datetime — timestamp >= dateFrom.

dateTostring

ISO date — timestamp <= dateTo (whole end day included).

maliciousboolean

Filter to malicious sites (opt-in).

clipboardHijackedboolean

Opt-in filter.

captchaFoundboolean

Opt-in filter.

isNsfwboolean

Opt-in filter.

countrystring

metadata.country exact match.

sort'date' | 'domain'

date = timestamp, domain = domain.

dir'asc' | 'desc'
cursorstring

Opaque keyset cursor from a previous response's pageInfo.nextCursor. Omit for the first page. Must match the sort/dir it was issued for (else 400).

limitinteger

Rows per page. Clamped to [1, 20] — this feed returns full records including screenshot blobs, so pages are heavier than the C2 feed.

withTotalboolean

When true, also compute pageInfo.total via a full count over the filter. Expensive — avoid unless needed.

Example request

{
  "dateFrom": "2026-01-01",
  "dateTo": "2026-01-31"
}

Response

Successful operation

Example response

{
  "data": [
    {
      "_id": "665f1a2b3c4d5e6f7a8b9c0d",
      "domain": "clickfix-example.com",
      "url": "https://clickfix-example.com/verify",
      "timestamp": "2026-01-31T10:15:00.000Z",
      "clipboardHijacked": true,
      "malicious": true,
      "isCompromised": true,
      "pageTitle": "Verify you are human",
      "metadata": {
        "ip": "203.0.113.10",
        "country": "US",
        "asn": 64500,
        "server": "nginx"
      },
      "compromised_data": {
        "domain": "acme.com",
        "compromised_employees": 42,
        "last_employee_compromised": "2026-06-11T00:00:00.000Z",
        "compromised_users": 1380,
        "last_user_compromised": "2026-07-02T00:00:00.000Z"
      }
    }
  ],
  "pageInfo": {
    "limit": 50,
    "count": 50,
    "hasMore": true,
    "nextCursor": "eyJzIjoiZGF0ZSIsImQiOiJkZXNjIiwidiI6MTc2ODQ3ODQwMDAwMH0",
    "total": 12034,
    "sort": {
      "key": "date",
      "dir": "desc"
    }
  }
}

Changes