Suspicious Domain Export

POSThttps://api.deepinfo.com/v1/brp/suspicious-domains/search:export

Exports every record matching filters (no pagination). format=csv returns CSV text; format=json returns a JSON array. Large exports can time out: narrow them with filters.

Example

Request

curl

curl -X POST 'https://api.deepinfo.com/v1/brp/suspicious-domains/search:export?format=csv' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{}'

Python

import requests

url = "https://api.deepinfo.com/v1/brp/suspicious-domains/search:export"

params = {
    "format": "csv"
}

headers = {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json",
    "Content-Type": "application/json"
}

payload = {}

response = requests.post(url, params=params, headers=headers, json=payload)
response.raise_for_status()
print(response.json())

JavaScript

const url = "https://api.deepinfo.com/v1/brp/suspicious-domains/search:export?format=csv";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({}),
});

const data = await response.json();
console.log(data);

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	payload := strings.NewReader(`{}`)

	req, err := http.NewRequest("POST", "https://api.deepinfo.com/v1/brp/suspicious-domains/search:export?format=csv", payload)
	if err != nil {
		panic(err)
	}
	req.Header.Set("apikey", "YOUR_API_KEY")
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Content-Type", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	body, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(string(body))
}

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.deepinfo.com/v1/brp/suspicious-domains/search:export?format=csv"))
            .header("apikey", "YOUR_API_KEY")
            .header("Accept", "application/json")
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString("{}"))
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());

        System.out.println(response.body());
    }
}

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://api.deepinfo.com/v1/brp/suspicious-domains/search:export?format=csv");
request.Headers.Add("apikey", "YOUR_API_KEY");
request.Headers.Add("Accept", "application/json");
request.Content = new StringContent("{}", Encoding.UTF8, "application/json");

using var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

PHP

<?php

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://api.deepinfo.com/v1/brp/suspicious-domains/search:export?format=csv',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => [
        'apikey: YOUR_API_KEY',
        'Accept: application/json',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{}',
]);

$response = curl_exec($curl);

if ($response === false) {
    throw new RuntimeException(curl_error($curl));
}

echo $response . PHP_EOL;

Ruby

require 'net/http'
require 'uri'

uri = URI('https://api.deepinfo.com/v1/brp/suspicious-domains/search:export?format=csv')

request = Net::HTTP::Post.new(uri)
request['apikey'] = 'YOUR_API_KEY'
request['Accept'] = 'application/json'
request['Content-Type'] = 'application/json'
request.body = '{}'

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(request)
end

puts response.body

Response

200 OK · text/csv

Response Body

id,fraudulent,fraudulent_type,state,detection_history.id,detection_history.rule,detection_history.detection_date,first_detection_date,monitoring_indicator.dns,monitoring_indicator.dns_mx,monitoring_indicator.ssl,monitoring_indicator.http,risk_score,seems_inactive,ignore_date
00000000000000000000000e25cc0001,acme.example,domain,in_review,000000000000000e2f900001,Brand name,2025-06-01T08:00:00Z,2025-06-01T08:00:00Z,True,True,,True,20,False,
00000000000000000000000e25cc0002,fernhill.example,domain,in_review,000000000000000e2f900002,Product names,2025-05-25T08:00:00Z,2025-05-25T08:00:00Z,True,True,,True,21,False,
00000000000000000000000e25cc0003,kestrel.example,domain,in_review,000000000000000e2f900003,Campaign names,2025-05-18T08:00:00Z,2025-05-18T08:00:00Z,True,True,True,True,22,False,

Content-Type: text/csv; charset=utf-8
deepinfo-request-id: 00000000-0000-4000-8000-0000356d0001

Request

curl

curl -X POST 'https://api.deepinfo.com/v1/brp/suspicious-domains/search:export?format=invalid_value' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{}'

Python

import requests

url = "https://api.deepinfo.com/v1/brp/suspicious-domains/search:export"

params = {
    "format": "invalid_value"
}

headers = {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json",
    "Content-Type": "application/json"
}

payload = {}

response = requests.post(url, params=params, headers=headers, json=payload)
response.raise_for_status()
print(response.json())

JavaScript

const url = "https://api.deepinfo.com/v1/brp/suspicious-domains/search:export?format=invalid_value";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({}),
});

const data = await response.json();
console.log(data);

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	payload := strings.NewReader(`{}`)

	req, err := http.NewRequest("POST", "https://api.deepinfo.com/v1/brp/suspicious-domains/search:export?format=invalid_value", payload)
	if err != nil {
		panic(err)
	}
	req.Header.Set("apikey", "YOUR_API_KEY")
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Content-Type", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	body, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(string(body))
}

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.deepinfo.com/v1/brp/suspicious-domains/search:export?format=invalid_value"))
            .header("apikey", "YOUR_API_KEY")
            .header("Accept", "application/json")
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString("{}"))
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());

        System.out.println(response.body());
    }
}

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://api.deepinfo.com/v1/brp/suspicious-domains/search:export?format=invalid_value");
request.Headers.Add("apikey", "YOUR_API_KEY");
request.Headers.Add("Accept", "application/json");
request.Content = new StringContent("{}", Encoding.UTF8, "application/json");

using var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

PHP

<?php

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://api.deepinfo.com/v1/brp/suspicious-domains/search:export?format=invalid_value',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => [
        'apikey: YOUR_API_KEY',
        'Accept: application/json',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{}',
]);

$response = curl_exec($curl);

if ($response === false) {
    throw new RuntimeException(curl_error($curl));
}

echo $response . PHP_EOL;

Ruby

require 'net/http'
require 'uri'

uri = URI('https://api.deepinfo.com/v1/brp/suspicious-domains/search:export?format=invalid_value')

request = Net::HTTP::Post.new(uri)
request['apikey'] = 'YOUR_API_KEY'
request['Accept'] = 'application/json'
request['Content-Type'] = 'application/json'
request.body = '{}'

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(request)
end

puts response.body

Response

400 Bad Request · application/json

Response Body

{
  "code": 10400,
  "parameters": [
    {
      "param": "format",
      "details": [
        "Select a valid choice."
      ]
    }
  ],
  "solution": "https://docs.deepinfo.com/reference/"
}

Content-Type: application/json
deepinfo-request-id: 00000000-0000-4000-8000-0000356d0001

Request

curl

curl -X POST 'https://api.deepinfo.com/v1/brp/suspicious-domains/search:export?format=csv' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
  "filters": {
    "must": [
      {
        "name": "fraudulent_type",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "monitoring_indicator.dns",
        "type": "eq",
        "value": true
      },
      {
        "name": "monitoring_indicator.dns_mx",
        "type": "eq",
        "value": true
      },
      {
        "name": "monitoring_indicator.ssl",
        "type": "eq",
        "value": true
      },
      {
        "name": "monitoring_indicator.http",
        "type": "eq",
        "value": true
      },
      {
        "name": "seems_inactive",
        "type": "eq",
        "value": true
      },
      {
        "name": "first_detection_date",
        "type": "eq",
        "value": "<date-time>"
      },
      {
        "name": "risk_score",
        "type": "eq",
        "value": 0
      },
      {
        "name": "ignore_date",
        "type": "eq",
        "value": "<date-time>"
      },
      {
        "name": "approve_date",
        "type": "eq",
        "value": "<date-time>"
      },
      {
        "name": "fraudulent",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "tags",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "detection_history.id",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "fraudulent",
      "order": "desc"
    }
  ]
}'

Python

import requests

url = "https://api.deepinfo.com/v1/brp/suspicious-domains/search:export"

params = {
    "format": "csv"
}

headers = {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json",
    "Content-Type": "application/json"
}

payload = {
    "filters": {
        "must": [
            {
                "name": "fraudulent_type",
                "type": "eq",
                "value": "<value>"
            },
            {
                "name": "state",
                "type": "eq",
                "value": "<value>"
            },
            {
                "name": "monitoring_indicator.dns",
                "type": "eq",
                "value": True
            },
            {
                "name": "monitoring_indicator.dns_mx",
                "type": "eq",
                "value": True
            },
            {
                "name": "monitoring_indicator.ssl",
                "type": "eq",
                "value": True
            },
            {
                "name": "monitoring_indicator.http",
                "type": "eq",
                "value": True
            },
            {
                "name": "seems_inactive",
                "type": "eq",
                "value": True
            },
            {
                "name": "first_detection_date",
                "type": "eq",
                "value": "<date-time>"
            },
            {
                "name": "risk_score",
                "type": "eq",
                "value": 0
            },
            {
                "name": "ignore_date",
                "type": "eq",
                "value": "<date-time>"
            },
            {
                "name": "approve_date",
                "type": "eq",
                "value": "<date-time>"
            },
            {
                "name": "fraudulent",
                "type": "eq",
                "value": "<value>"
            },
            {
                "name": "tags",
                "type": "eq",
                "value": "<value>"
            },
            {
                "name": "detection_history.id",
                "type": "eq",
                "value": "<value>"
            }
        ]
    },
    "sort": [
        {
            "field": "fraudulent",
            "order": "desc"
        }
    ]
}

response = requests.post(url, params=params, headers=headers, json=payload)
response.raise_for_status()
print(response.json())

JavaScript

const url = "https://api.deepinfo.com/v1/brp/suspicious-domains/search:export?format=csv";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "apikey": "YOUR_API_KEY",
    "Accept": "application/json",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    filters: {
      must: [
        {
          name: "fraudulent_type",
          type: "eq",
          value: "<value>"
        },
        {
          name: "state",
          type: "eq",
          value: "<value>"
        },
        {
          name: "monitoring_indicator.dns",
          type: "eq",
          value: true
        },
        {
          name: "monitoring_indicator.dns_mx",
          type: "eq",
          value: true
        },
        {
          name: "monitoring_indicator.ssl",
          type: "eq",
          value: true
        },
        {
          name: "monitoring_indicator.http",
          type: "eq",
          value: true
        },
        {
          name: "seems_inactive",
          type: "eq",
          value: true
        },
        {
          name: "first_detection_date",
          type: "eq",
          value: "<date-time>"
        },
        {
          name: "risk_score",
          type: "eq",
          value: 0
        },
        {
          name: "ignore_date",
          type: "eq",
          value: "<date-time>"
        },
        {
          name: "approve_date",
          type: "eq",
          value: "<date-time>"
        },
        {
          name: "fraudulent",
          type: "eq",
          value: "<value>"
        },
        {
          name: "tags",
          type: "eq",
          value: "<value>"
        },
        {
          name: "detection_history.id",
          type: "eq",
          value: "<value>"
        }
      ]
    },
    sort: [
      {
        field: "fraudulent",
        order: "desc"
      }
    ]
  }),
});

const data = await response.json();
console.log(data);

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	payload := strings.NewReader(`{
  "filters": {
    "must": [
      {
        "name": "fraudulent_type",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "monitoring_indicator.dns",
        "type": "eq",
        "value": true
      },
      {
        "name": "monitoring_indicator.dns_mx",
        "type": "eq",
        "value": true
      },
      {
        "name": "monitoring_indicator.ssl",
        "type": "eq",
        "value": true
      },
      {
        "name": "monitoring_indicator.http",
        "type": "eq",
        "value": true
      },
      {
        "name": "seems_inactive",
        "type": "eq",
        "value": true
      },
      {
        "name": "first_detection_date",
        "type": "eq",
        "value": "<date-time>"
      },
      {
        "name": "risk_score",
        "type": "eq",
        "value": 0
      },
      {
        "name": "ignore_date",
        "type": "eq",
        "value": "<date-time>"
      },
      {
        "name": "approve_date",
        "type": "eq",
        "value": "<date-time>"
      },
      {
        "name": "fraudulent",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "tags",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "detection_history.id",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "fraudulent",
      "order": "desc"
    }
  ]
}`)

	req, err := http.NewRequest("POST", "https://api.deepinfo.com/v1/brp/suspicious-domains/search:export?format=csv", payload)
	if err != nil {
		panic(err)
	}
	req.Header.Set("apikey", "YOUR_API_KEY")
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Content-Type", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	body, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(string(body))
}

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        String body = """
            {
              "filters": {
                "must": [
                  {
                    "name": "fraudulent_type",
                    "type": "eq",
                    "value": "<value>"
                  },
                  {
                    "name": "state",
                    "type": "eq",
                    "value": "<value>"
                  },
                  {
                    "name": "monitoring_indicator.dns",
                    "type": "eq",
                    "value": true
                  },
                  {
                    "name": "monitoring_indicator.dns_mx",
                    "type": "eq",
                    "value": true
                  },
                  {
                    "name": "monitoring_indicator.ssl",
                    "type": "eq",
                    "value": true
                  },
                  {
                    "name": "monitoring_indicator.http",
                    "type": "eq",
                    "value": true
                  },
                  {
                    "name": "seems_inactive",
                    "type": "eq",
                    "value": true
                  },
                  {
                    "name": "first_detection_date",
                    "type": "eq",
                    "value": "<date-time>"
                  },
                  {
                    "name": "risk_score",
                    "type": "eq",
                    "value": 0
                  },
                  {
                    "name": "ignore_date",
                    "type": "eq",
                    "value": "<date-time>"
                  },
                  {
                    "name": "approve_date",
                    "type": "eq",
                    "value": "<date-time>"
                  },
                  {
                    "name": "fraudulent",
                    "type": "eq",
                    "value": "<value>"
                  },
                  {
                    "name": "tags",
                    "type": "eq",
                    "value": "<value>"
                  },
                  {
                    "name": "detection_history.id",
                    "type": "eq",
                    "value": "<value>"
                  }
                ]
              },
              "sort": [
                {
                  "field": "fraudulent",
                  "order": "desc"
                }
              ]
            }""";

        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.deepinfo.com/v1/brp/suspicious-domains/search:export?format=csv"))
            .header("apikey", "YOUR_API_KEY")
            .header("Accept", "application/json")
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString(body))
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());

        System.out.println(response.body());
    }
}

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

var body = """
    {
      "filters": {
        "must": [
          {
            "name": "fraudulent_type",
            "type": "eq",
            "value": "<value>"
          },
          {
            "name": "state",
            "type": "eq",
            "value": "<value>"
          },
          {
            "name": "monitoring_indicator.dns",
            "type": "eq",
            "value": true
          },
          {
            "name": "monitoring_indicator.dns_mx",
            "type": "eq",
            "value": true
          },
          {
            "name": "monitoring_indicator.ssl",
            "type": "eq",
            "value": true
          },
          {
            "name": "monitoring_indicator.http",
            "type": "eq",
            "value": true
          },
          {
            "name": "seems_inactive",
            "type": "eq",
            "value": true
          },
          {
            "name": "first_detection_date",
            "type": "eq",
            "value": "<date-time>"
          },
          {
            "name": "risk_score",
            "type": "eq",
            "value": 0
          },
          {
            "name": "ignore_date",
            "type": "eq",
            "value": "<date-time>"
          },
          {
            "name": "approve_date",
            "type": "eq",
            "value": "<date-time>"
          },
          {
            "name": "fraudulent",
            "type": "eq",
            "value": "<value>"
          },
          {
            "name": "tags",
            "type": "eq",
            "value": "<value>"
          },
          {
            "name": "detection_history.id",
            "type": "eq",
            "value": "<value>"
          }
        ]
      },
      "sort": [
        {
          "field": "fraudulent",
          "order": "desc"
        }
      ]
    }
    """;

var request = new HttpRequestMessage(HttpMethod.Post, "https://api.deepinfo.com/v1/brp/suspicious-domains/search:export?format=csv");
request.Headers.Add("apikey", "YOUR_API_KEY");
request.Headers.Add("Accept", "application/json");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

using var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

PHP

<?php

$body = <<<'JSON'
{
  "filters": {
    "must": [
      {
        "name": "fraudulent_type",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "monitoring_indicator.dns",
        "type": "eq",
        "value": true
      },
      {
        "name": "monitoring_indicator.dns_mx",
        "type": "eq",
        "value": true
      },
      {
        "name": "monitoring_indicator.ssl",
        "type": "eq",
        "value": true
      },
      {
        "name": "monitoring_indicator.http",
        "type": "eq",
        "value": true
      },
      {
        "name": "seems_inactive",
        "type": "eq",
        "value": true
      },
      {
        "name": "first_detection_date",
        "type": "eq",
        "value": "<date-time>"
      },
      {
        "name": "risk_score",
        "type": "eq",
        "value": 0
      },
      {
        "name": "ignore_date",
        "type": "eq",
        "value": "<date-time>"
      },
      {
        "name": "approve_date",
        "type": "eq",
        "value": "<date-time>"
      },
      {
        "name": "fraudulent",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "tags",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "detection_history.id",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "fraudulent",
      "order": "desc"
    }
  ]
}
JSON;

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => 'https://api.deepinfo.com/v1/brp/suspicious-domains/search:export?format=csv',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => [
        'apikey: YOUR_API_KEY',
        'Accept: application/json',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => $body,
]);

$response = curl_exec($curl);

if ($response === false) {
    throw new RuntimeException(curl_error($curl));
}

echo $response . PHP_EOL;

Ruby

require 'net/http'
require 'uri'

uri = URI('https://api.deepinfo.com/v1/brp/suspicious-domains/search:export?format=csv')

request = Net::HTTP::Post.new(uri)
request['apikey'] = 'YOUR_API_KEY'
request['Accept'] = 'application/json'
request['Content-Type'] = 'application/json'
request.body = <<~'JSON'.chomp
  {
    "filters": {
      "must": [
        {
          "name": "fraudulent_type",
          "type": "eq",
          "value": "<value>"
        },
        {
          "name": "state",
          "type": "eq",
          "value": "<value>"
        },
        {
          "name": "monitoring_indicator.dns",
          "type": "eq",
          "value": true
        },
        {
          "name": "monitoring_indicator.dns_mx",
          "type": "eq",
          "value": true
        },
        {
          "name": "monitoring_indicator.ssl",
          "type": "eq",
          "value": true
        },
        {
          "name": "monitoring_indicator.http",
          "type": "eq",
          "value": true
        },
        {
          "name": "seems_inactive",
          "type": "eq",
          "value": true
        },
        {
          "name": "first_detection_date",
          "type": "eq",
          "value": "<date-time>"
        },
        {
          "name": "risk_score",
          "type": "eq",
          "value": 0
        },
        {
          "name": "ignore_date",
          "type": "eq",
          "value": "<date-time>"
        },
        {
          "name": "approve_date",
          "type": "eq",
          "value": "<date-time>"
        },
        {
          "name": "fraudulent",
          "type": "eq",
          "value": "<value>"
        },
        {
          "name": "tags",
          "type": "eq",
          "value": "<value>"
        },
        {
          "name": "detection_history.id",
          "type": "eq",
          "value": "<value>"
        }
      ]
    },
    "sort": [
      {
        "field": "fraudulent",
        "order": "desc"
      }
    ]
  }
JSON

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(request)
end

puts response.body

This request template has no response: keep the filters you need, set their values and send it.

Authentication

Send your API key in the apikey request header.

Query Parameters

Parameter	Required	Description
`format`	Optional	One of: `json`, `csv`. Example`csv`

Request Body

Parameter	Type	Required	Description
`filters`	object	Optional	See Filtering below
`sort`	array	Optional	List of `{field, order}`

application/json

{}

Filtering

Example body:

JSON

{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "fraudulent",
      "order": "desc"
    }
  ]
}

See Getting Started → Search & Filters for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators eq in exists

Field	Description
`fraudulent_type`	Whether the name is a `domain` or a `subdomain` (Domain and Subdomain in the TYPE filter); each detection rule looks at one or the other.
`state`	The review state: `in_review` (on the SUSPICIOUS DOMAINS list, waiting for your decision), `approved` (marked as fraudulent and moved to the fraudulent list) or `ignored` (dismissed, on Ignored Domains); the API also lists `initial`, which was not seen in the data. Without a `state` filter the search is not limited to one state: it returned both `in_review` and `approved` domains.
`monitoring_indicator.dns`	DNS indicator: `true` when the domain's DNS lookup at its last check returned records (such as A, NS or SOA; an address record is not required); `false` when the name did not exist (NXDOMAIN); null when there is no DNS result. The INDICATORS filter's DNS option finds the domains where it is `true`.
`monitoring_indicator.dns_mx`	DNS MX indicator: `true` when the domain had an MX (mail exchanger) record at its last check; `false` when it had none; null when there is no DNS result. The INDICATORS filter's DNS MX option finds the domains where it is `true`.
`monitoring_indicator.ssl`	SSL indicator: `true` when a TLS connection to the domain on port 443 succeeded and returned a certificate at its last check; `false` when it failed (for example refused or not resolved); null when there is no result for that check. The INDICATORS filter's SSL option finds the domains where it is `true`.
`monitoring_indicator.http`	HTTP indicator: `true` when the domain answered an HTTP request at its last check, after following redirects (in the samples a final 525 error status also counted); `false` when it did not (for example because the name did not resolve); null when there is no result for that check. The INDICATORS filter's HTTP option finds the domains where it is `true`.
`seems_inactive`	`true` when the domain seems inactive; in the samples, inactive domains had no DNS records and no parsed WHOIS data at their last check. The lists show a SEEMS INACTIVE banner on it.

Operators eq in gte lte exists

Field	Description
`first_detection_date`	When a detection rule first found the domain (UTC date-time), shown as DETECTION DATE; in the samples it always equals the earliest `detection_date` in `detection_history`.
`risk_score`	The domain's risk score, an integer from 0 to 100 (can be null). The platform labels 1 to 20 INFORMATION, over 20 up to 40 LOW, over 40 up to 60 MEDIUM, over 60 up to 80 HIGH and over 80 CRITICAL; 0 has no label.
`ignore_date`	When the domain was ignored (UTC date-time), shown as IGNORED DATE; empty if it was never ignored. A domain restored from Ignored Domains keeps this date, so a filter on it can also match domains that are back in review.
`approve_date`	When the domain was marked as fraudulent (UTC date-time), shown as APPROVE DATE; empty on domains that are still waiting for review.

Operators eq in startswith endswith wildcard fuzzy contains_any contains_all exists

Field	Description
`fraudulent`	The suspicious domain or subdomain name in ASCII form, with internationalized names in punycode (starting with `xn--`); `fraudulent_unicode` in the response holds the Unicode form. The DOMAIN filter and the SEARCH box match on it.
`tags`	Tags on the domain, as a list of strings; in the samples they are always the tags of the detection rules that found it (the rule's TAGS setting). The TAGS filter matches them.
`detection_history.id`	The ID of a detection rule that found the domain, a 24-character hexadecimal string; it is the rule's `id` in Fraudulent Rule Search. Filter on it to list the domains one rule detected.

Sortable Fields

Field	Description
`fraudulent`	The suspicious domain or subdomain name in ASCII form, with internationalized names in punycode (starting with `xn--`); `fraudulent_unicode` in the response holds the Unicode form. The DOMAIN filter and the SEARCH box match on it.
`tags`	Tags on the domain, as a list of strings; in the samples they are always the tags of the detection rules that found it (the rule's TAGS setting). The TAGS filter matches them.
`detection_history`	The detection rules that found the domain, one entry per rule with the rule's `id`, its name (`rule`), the `detection_date` and the `enabled` and `deleted` flags; the lists show it as RULES. It can be sorted on but not filtered: filter on `detection_history.id` instead.
`first_detection_date`	When a detection rule first found the domain (UTC date-time), shown as DETECTION DATE; in the samples it always equals the earliest `detection_date` in `detection_history`.
`monitoring_indicator`	The four indicator flags `dns`, `dns_mx`, `ssl` and `http` as one object (null when there is no check result); the lists show them as the INDICATORS icons. It can be sorted on but not filtered: filter on `monitoring_indicator.dns`, `monitoring_indicator.dns_mx`, `monitoring_indicator.ssl` or `monitoring_indicator.http` instead.
`risk_score`	The domain's risk score, an integer from 0 to 100 (can be null). The platform labels 1 to 20 INFORMATION, over 20 up to 40 LOW, over 40 up to 60 MEDIUM, over 60 up to 80 HIGH and over 80 CRITICAL; 0 has no label.
`ignore_date`	When the domain was ignored (UTC date-time), shown as IGNORED DATE; empty if it was never ignored. A domain restored from Ignored Domains keeps this date, so a filter on it can also match domains that are back in review.
`approve_date`	When the domain was marked as fraudulent (UTC date-time), shown as APPROVE DATE; empty on domains that are still waiting for review.
`seems_inactive`	`true` when the domain seems inactive; in the samples, inactive domains had no DNS records and no parsed WHOIS data at their last check. The lists show a SEEMS INACTIVE banner on it.

Response Fields

Field	Type	Description
`page`	integer
`page_size`	integer
`result_count`	integer
`results`	array of object
`results[].id`	string
`results[].fraudulent`	string
`results[].fraudulent_unicode`	string
`results[].fraudulent_type`	string	One of `domain`, `subdomain`
`results[].state`	string	One of `initial`, `in_review`, `approved`, `ignored`
`results[].tags`	array of string
`results[].detection_history`	array of object
`results[].first_detection_date`	string	date-time
`results[].monitoring_indicator`	object
`results[].risk_score`	integer
`results[].seems_inactive`	boolean
`results[].approve_date`	string	date-time
`results[].ignore_date`	string	date-time

Examples

Selecting one loads it into the request and response panels.

Reference updated September 27, 2026