# Fraudulent Domain Search

POST /brp/fraudulent-domains/search: Searches your monitored fraudulent domains by name, type, risk score and indicators.

Source: https://docs.deepinfo.com/reference/brp/fraudulent-domain-search/

Last updated: 2026-09-27

---
`POST https://api.deepinfo.com/v1/brp/fraudulent-domains/search`

Searches your monitored fraudulent domains by name, type, risk score and indicators.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "fraudulent",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "fraudulent",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `fraudulent_type` | Whether the name is a `domain` or a `subdomain` (Domain and Subdomain in the TYPE filter); each detection rule looks at one or the other. |
| `monitoring_indicator.dns` | DNS indicator: `true` when the domain's DNS lookup at its last check returned records (such as A, NS or SOA; an address record is not required); `false` when the name did not exist (NXDOMAIN); null when there is no DNS result. The INDICATORS filter's DNS option finds the domains where it is `true`. |
| `monitoring_indicator.dns_mx` | DNS MX indicator: `true` when the domain had an MX (mail exchanger) record at its last check; `false` when it had none; null when there is no DNS result. The INDICATORS filter's DNS MX option finds the domains where it is `true`. |
| `monitoring_indicator.ssl` | SSL indicator: `true` when a TLS connection to the domain on port 443 succeeded and returned a certificate at its last check; `false` when it failed (for example refused or not resolved); null when there is no result for that check. The INDICATORS filter's SSL option finds the domains where it is `true`. |
| `monitoring_indicator.http` | HTTP indicator: `true` when the domain answered an HTTP request at its last check, after following redirects (in the samples a final 525 error status also counted); `false` when it did not (for example because the name did not resolve); null when there is no result for that check. The INDICATORS filter's HTTP option finds the domains where it is `true`. |
| `is_login_page` | `true` when the domain's site has a login page; the FRAUDULENT DOMAINS list shows a Login Page icon next to its name. |
| `seems_inactive` | `true` when the domain seems inactive; in the samples, inactive domains had no DNS records and no parsed WHOIS data at their last check. The lists show a SEEMS INACTIVE banner on it. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `first_detection_date` | When a detection rule first found the domain (UTC date-time), shown as DETECTION DATE; in the samples it always equals the earliest `detection_date` in `detection_history`. |
| `risk_score` | The domain's risk score, an integer from 0 to 100 (can be null). The platform labels 1 to 20 INFORMATION, over 20 up to 40 LOW, over 40 up to 60 MEDIUM, over 60 up to 80 HIGH and over 80 CRITICAL; 0 has no label. |
| `added_date` | When the domain was added to the fraudulent list (UTC date-time), that is when it was marked as fraudulent, by you or by a rule with Auto Approval. |
| `seems_inactive_first_seen` | When the domain was first found to seem inactive (UTC date-time). In the samples it was empty on every domain, including those with `seems_inactive` true. |
| `seems_inactive_last_seen` | When the domain was most recently found to seem inactive (UTC date-time). In the samples it was empty on every domain, including those with `seems_inactive` true. |

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `fraudulent` | The fraudulent domain or subdomain name in ASCII form, with internationalized names in punycode (starting with `xn--`); `fraudulent_unicode` in the response holds the Unicode form. The DOMAIN filter and the SEARCH box match on it. |
| `tags` | Tags on the domain, as a list of strings; in the samples they are always the tags of the detection rules that found it (the rule's TAGS setting). The TAGS filter matches them. |
| `detection_history.id` | The ID of a detection rule that found the domain, a 24-character hexadecimal string; it is the rule's `id` in Fraudulent Rule Search. Filter on it to list the domains one rule detected. |

### Sortable Fields

| Field | Description |
|---|---|
| `fraudulent` | The fraudulent domain or subdomain name in ASCII form, with internationalized names in punycode (starting with `xn--`); `fraudulent_unicode` in the response holds the Unicode form. The DOMAIN filter and the SEARCH box match on it. |
| `tags` | Tags on the domain, as a list of strings; in the samples they are always the tags of the detection rules that found it (the rule's TAGS setting). The TAGS filter matches them. |
| `detection_history` | The detection rules that found the domain, one entry per rule with the rule's `id`, its name (`rule`), the `detection_date` and the `enabled` and `deleted` flags; the lists show it as RULES. It can be sorted on but not filtered: filter on `detection_history.id` instead. |
| `first_detection_date` | When a detection rule first found the domain (UTC date-time), shown as DETECTION DATE; in the samples it always equals the earliest `detection_date` in `detection_history`. |
| `monitoring_indicator` | The four indicator flags `dns`, `dns_mx`, `ssl` and `http` as one object (null when there is no check result); the lists show them as the INDICATORS icons. It can be sorted on but not filtered: filter on `monitoring_indicator.dns`, `monitoring_indicator.dns_mx`, `monitoring_indicator.ssl` or `monitoring_indicator.http` instead. |
| `risk_score` | The domain's risk score, an integer from 0 to 100 (can be null). The platform labels 1 to 20 INFORMATION, over 20 up to 40 LOW, over 40 up to 60 MEDIUM, over 60 up to 80 HIGH and over 80 CRITICAL; 0 has no label. |
| `added_date` | When the domain was added to the fraudulent list (UTC date-time), that is when it was marked as fraudulent, by you or by a rule with Auto Approval. |
| `is_login_page` | `true` when the domain's site has a login page; the FRAUDULENT DOMAINS list shows a Login Page icon next to its name. |
| `seems_inactive` | `true` when the domain seems inactive; in the samples, inactive domains had no DNS records and no parsed WHOIS data at their last check. The lists show a SEEMS INACTIVE banner on it. |
| `seems_inactive_first_seen` | When the domain was first found to seem inactive (UTC date-time). In the samples it was empty on every domain, including those with `seems_inactive` true. |
| `seems_inactive_last_seen` | When the domain was most recently found to seem inactive (UTC date-time). In the samples it was empty on every domain, including those with `seems_inactive` true. |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].id` | string |  |
| `results[].fraudulent` | string |  |
| `results[].fraudulent_unicode` | string |  |
| `results[].fraudulent_type` | string | One of `domain`, `subdomain` |
| `results[].tags` | array of string |  |
| `results[].detection_history` | array of object |  |
| `results[].first_detection_date` | string | date-time |
| `results[].monitoring_indicator` | object |  |
| `results[].risk_score` | integer |  |
| `results[].screenshot` | string |  |
| `results[].thumbnail` | string |  |
| `results[].added_date` | string | date-time |
| `results[].is_login_page` | boolean |  |
| `results[].seems_inactive` | boolean |  |
| `results[].seems_inactive_first_seen` | string | date-time |
| `results[].seems_inactive_last_seen` | string | date-time |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].id` | string |
| `results[].fraudulent` | string |
| `results[].fraudulent_unicode` | string |
| `results[].fraudulent_type` | string |
| `results[].tags` | array<string> |
| `results[].detection_history` | array<object> |
| `results[].detection_history[].id` | string |
| `results[].detection_history[].rule` | string |
| `results[].detection_history[].detection_date` | string |
| `results[].detection_history[].enabled` | boolean |
| `results[].detection_history[].deleted` | boolean |
| `results[].first_detection_date` | string |
| `results[].monitoring_indicator` | object |
| `results[].monitoring_indicator.dns` | boolean |
| `results[].monitoring_indicator.dns_mx` | boolean |
| `results[].monitoring_indicator.ssl` | boolean |
| `results[].monitoring_indicator.http` | boolean |
| `results[].risk_score` | number |
| `results[].screenshot` | null |
| `results[].thumbnail` | null |
| `results[].added_date` | string |
| `results[].is_login_page` | boolean |
| `results[].seems_inactive` | boolean |
| `results[].seems_inactive_first_seen` | null |
| `results[].seems_inactive_last_seen` | null |

## Examples

### 200 · OK

```bash
curl -X POST 'https://api.deepinfo.com/v1/brp/fraudulent-domains/search?page_size=25' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{}'
```

`Content-Type: application/json` · `deepinfo-request-id: 00000000-0000-4000-8000-0000356d0001`

```json
{
  "page": 1,
  "page_size": 25,
  "result_count": 21,
  "results": [
    {
      "id": "000000000000000ee94f0001",
      "fraudulent": "acme.example",
      "fraudulent_unicode": "acme.example",
      "fraudulent_type": "domain",
      "tags": [
        "production"
      ],
      "detection_history": [
        {
          "id": "000000000000000e2f900001",
          "rule": "Brand name",
          "detection_date": "2025-06-01T08:00:00Z",
          "enabled": true,
          "deleted": false
        }
      ],
      "first_detection_date": "2025-06-01T08:00:00Z",
      "monitoring_indicator": {
        "dns": true,
        "dns_mx": true,
        "ssl": true,
        "http": true
      },
      "risk_score": 20,
      "screenshot": null,
      "thumbnail": null,
      "added_date": "2025-06-01T08:00:00Z",
      "is_login_page": false,
      "seems_inactive": false,
      "seems_inactive_first_seen": null,
      "seems_inactive_last_seen": null
    },
    {
      "id": "000000000000000ee94f0002",
      "fraudulent": "fernhill.example",
      "fraudulent_unicode": "fernhill.example",
      "fraudulent_type": "domain",
      "tags": [],
      "detection_history": [
        {
          "id": "000000000000000e2f900004",
          "rule": "Executive names",
          "detection_date": "2025-05-11T08:00:00Z",
          "enabled": true,
          "deleted": false
        }
      ],
      "first_detection_date": "2025-05-25T08:00:00Z",
      "monitoring_indicator": {
        "dns": true,
        "dns_mx": true,
        "ssl": true,
        "http": true
      },
      "risk_score": 21,
      "screenshot": null,
      "thumbnail": null,
      "added_date": "2025-05-25T08:00:00Z",
      "is_login_page": false,
      "seems_inactive": false,
      "seems_inactive_first_seen": null,
      "seems_inactive_last_seen": null
    }
  ]
}
```

### 400 · Invalid Parameter (invalid page=0)

```bash
curl -X POST 'https://api.deepinfo.com/v1/brp/fraudulent-domains/search?page=0' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{}'
```

`Content-Type: application/json` · `deepinfo-request-id: 00000000-0000-4000-8000-0000356d0001`

```json
{
  "code": 10400,
  "parameters": [
    {
      "param": "page",
      "details": [
        "Ensure this value is greater than or equal to 1."
      ]
    }
  ],
  "solution": "https://docs.deepinfo.com/reference/"
}
```

### Request Template

The request only: a request template has no response.

```bash
curl -X POST 'https://api.deepinfo.com/v1/brp/fraudulent-domains/search?page_size=25' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
  "filters": {
    "must": [
      {
        "name": "fraudulent_type",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "monitoring_indicator.dns",
        "type": "eq",
        "value": true
      },
      {
        "name": "monitoring_indicator.dns_mx",
        "type": "eq",
        "value": true
      },
      {
        "name": "monitoring_indicator.ssl",
        "type": "eq",
        "value": true
      },
      {
        "name": "monitoring_indicator.http",
        "type": "eq",
        "value": true
      },
      {
        "name": "is_login_page",
        "type": "eq",
        "value": true
      },
      {
        "name": "seems_inactive",
        "type": "eq",
        "value": true
      },
      {
        "name": "first_detection_date",
        "type": "eq",
        "value": "<date-time>"
      },
      {
        "name": "risk_score",
        "type": "eq",
        "value": 0
      },
      {
        "name": "added_date",
        "type": "eq",
        "value": "<date-time>"
      },
      {
        "name": "seems_inactive_first_seen",
        "type": "eq",
        "value": "<date-time>"
      },
      {
        "name": "seems_inactive_last_seen",
        "type": "eq",
        "value": "<date-time>"
      },
      {
        "name": "fraudulent",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "tags",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "detection_history.id",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "fraudulent",
      "order": "desc"
    }
  ]
}'
```