Skip to content

Single Incident#

The incident endpoint provides a way to retrieve detailed information on a specific incident referenced by its id or by its subject (URL, domain, or subject field value).

Retrieve Incident by ID#

Endpoint#

GET /v1/incident/{id}

Request Example#

curl -X GET 'https://capi.phishfort.com/v1/incident/{id}' \
  -H 'accept: application/json' \
  -H 'x-api-key: YOUR_API_KEY'

import requests

incident_id = "054zKkjCnR1I3B3U812z"
response = requests.get(
    f"https://capi.phishfort.com/v1/incident/{incident_id}",
    headers={
        "accept": "application/json",
        "x-api-key": "YOUR_API_KEY",
    },
)
print(response.json())

const incidentId = "054zKkjCnR1I3B3U812z";
const response = await fetch(
  `https://capi.phishfort.com/v1/incident/${incidentId}`,
  {
    headers: {
      accept: "application/json",
      "x-api-key": "YOUR_API_KEY",
    },
  }
);
const data = await response.json();
console.log(data);

Where {id} is the ID of the incident you wish to query.

Response Example#

The data field returned is a DetailedIncidentStructure type. If the incident cannot be found, a 404 response will be returned.

{
    "data": {
        "id": "054zKkjCnR1I3B3U812z",
        "clientId": "0Xp5voyA4y5xYNoufOVC",
        "safeDomain": "exampleclient.com",
        "subject": "uniformprivate.cc",
        "incidentType": "domain",
        "domain": "uniformprivate.cc",
        "url": "https://uniformprivate.cc/chevrolet/",
        "source": "PHISHFORT_DETECTED",
        "timestamp": "2021-11-08T20:36:43.765Z",
        "lastHistoryUpdateTimestamp": "2021-12-06T15:10:01.299Z",
        "burnStartedTimestamp": "2021-12-06T10:34:43.883Z",
        "takedownTimestamp": "2021-12-06T15:10:01.299Z",
        "reportedBy": "analyst@phishfort.com",
        "threatTaxonomy": {
            "name": "Brand - Website - Impersonation",
            "description": "Unauthorized representation of another person, brand, or entity. Includes fake profiles, cloned websites, or identity theft used to deceive victims.",
            "incidentClass": "phishing",
            "incidentTargetType": {
                "id": "abc123",
                "name": "Website",
                "description": "A website used to deceive victims"
            },
            "incidentType": {
                "id": "def456",
                "name": "Brand",
                "description": "Attacks targeting a specific brand"
            },
            "incidentThreatType": {
                "id": "ghi789",
                "name": "Impersonation",
                "description": "Unauthorized representation of another person, brand, or entity."
            }
        },
        "status": "takedown_success",
        "incidentClass": "phishing",
        "incidentState": {
            "unresponsive": true,
            "warningBanner": false,
            "responsive": false,
            "contentRemoved": false,
            "redirect": false,
            "inconclusive": false,
            "timestamp": "2021-12-21T15:21:02.324Z"
        },
        "registrar": {
            "name": "Example Registrar Inc.",
            "difficulty": "Medium",
            "description": "Registrar typically responds within 48 hours."
        },
        "hostingProvider": "Example Hosting Provider",
        "history": [
            {
                "timestamp": "2021-12-06T15:10:01.812Z",
                "message": "Marked as successful take down."
            },
            {
                "timestamp": "2021-11-08T20:36:43.946Z",
                "message": "Incident detected by mailbox:dashboard-report"
            }
        ],
        "blocklists": [
            {
                "authority": "Google Safe Browsing",
                "type": "warning-banner",
                "status": "listed",
                "listedAt": "2021-12-06T11:02:15.000Z",
                "link": "https://transparencyreport.google.com/safe-browsing/search?url=uniformprivate.cc"
            },
            {
                "authority": "VirusTotal",
                "type": "blocklist",
                "status": "submitted",
                "listedAt": null,
                "link": null
            }
        ],
        "insights": {
            "snapshotTimestamp": "2021-12-06T10:34:44.101Z",
            "dns": {
                "recordTypes": ["A", "MX", "NS"],
                "recordCounts": {
                    "A": 2,
                    "MX": 1,
                    "NS": 2
                }
            },
            "whois": {
                "domain": "uniformprivate.cc",
                "registrar": "Example Registrar Inc.",
                "registrarIANAId": "1234",
                "createdDate": "2021-11-02T00:00:00.000Z",
                "updatedDate": "2021-11-02T00:00:00.000Z",
                "expiryDate": "2022-11-02T00:00:00.000Z",
                "domainAgeDays": 6,
                "isNewDomain": true,
                "isExpired": false,
                "statuses": ["clientTransferProhibited"]
            },
            "certificate": {
                "issuer": "R3",
                "subject": "uniformprivate.cc",
                "validFrom": "2021-11-03T00:00:00.000Z",
                "validTo": "2022-02-01T00:00:00.000Z",
                "isValid": true,
                "subjectAltNames": [
                    "uniformprivate.cc",
                    "www.uniformprivate.cc"
                ]
            }
        }
    },
    "message": "success"
}

Partner Blocklist Listings#

While a takedown runs its course, PhishFort also submits the malicious URL or domain to security partners that can protect users immediately: browser warning pages (Google Safe Browsing, Cloudflare) and threat-intelligence blocklists (VirusTotal, Spamhaus). The blocklists field reports that coverage per partner — an empty array means nothing has been submitted for this incident.

Field Meaning
authority The partner the submission was made to, e.g. "Google Safe Browsing".
type warning-banner — visitors see a full-page browser warning; blocklist — the threat is listed in the partner's database, consumed by security products.
status listed — the listing is confirmed live with the partner; submitted — submitted but not yet confirmed live. Protection in progress, not failure.
listedAt When the listing went live. null while the entry is still submitted.
link Public page showing the listing, when the partner provides one. Independent of status — a live listing may have no public page.

See BlocklistListing for the full structure.

Incident Insights#

The insights field summarises the infrastructure behind an incident — its DNS footprint, domain registration and TLS certificate — derived from the snapshots PhishFort captures while working the case. It is returned automatically; no extra parameter is needed.

Signal Field Why it matters
Newly registered domain insights.whois.isNewDomain Phishing domains are typically registered days before they are used.
Domain age insights.whois.domainAgeDays Whole days since registration, for your own thresholds.
Lapsed registration insights.whois.isExpired An expired registration often means the threat is already defunct.
Registrar insights.whois.registrar Pair with the top-level registrar.difficulty to anticipate takedown effort.
Related hostnames insights.certificate.subjectAltNames A certificate covering several lookalikes suggests more infrastructure is staged.
Live certificate insights.certificate.isValid Indicates whether the site can still serve HTTPS traffic.
DNS footprint insights.dns.recordCounts MX records on a lookalike domain point to email abuse alongside the web threat.
Origin behind a CDN insights.hosting.originHints Where a takedown notice actually has to go when the site is fronted.
Credential harvesting insights.page.formInputCount Input fields on an impersonating page mean active harvesting, not a parked site.
Shared attack kit insights.indicators.ssdeepHash, pHash Correlate incidents that share content or appearance across many domains.

Because snapshots are captured at points in time, the block reports the most recent snapshot that carried data, stamped with snapshotTimestamp. Categories that snapshot did not capture are omitted, and the whole insights field is absent when no snapshot carries any. See IncidentInsights for the full structure.

Which categories you get varies by incident

dns, whois and certificate may appear on any incident. hosting, page and indicators come from a richer capture pipeline that does not run for every incident, and are absent otherwise.

Check for each category before reading it. An absent category means "not captured" — never treat it as a negative finding.

When the richer categories are available, the block looks like this:

{
    "snapshotTimestamp": "2026-08-04T07:40:00.000Z",
    "dns": {
        "recordTypes": ["A", "NS"],
        "recordCounts": { "A": 1, "NS": 2 }
    },
    "whois": {
        "domain": "card-shipmoney.com",
        "registrar": "Example Registrar, LLC",
        "createdDate": "2026-07-28T00:00:00.000Z",
        "expiryDate": "2027-07-28T00:00:00.000Z",
        "domainAgeDays": 7,
        "isNewDomain": true,
        "isExpired": false,
        "statuses": ["clientTransferProhibited"]
    },
    "certificate": {
        "issuer": "E5",
        "validFrom": "2026-07-29T00:00:00.000Z",
        "validTo": "2026-10-27T00:00:00.000Z",
        "isValid": true,
        "subjectAltNames": ["card-shipmoney.com", "www.card-shipmoney.com"]
    },
    "hosting": {
        "cdnDetected": true,
        "cdnName": "Example CDN, Inc.",
        "providers": [
            {
                "ip": "104.21.5.9",
                "network": "EXAMPLECDNNET",
                "organization": "Example CDN, Inc.",
                "isCdn": true,
                "abuseEmails": ["abuse@examplecdn.com"]
            }
        ],
        "originHints": [
            {
                "ip": "91.92.1.5",
                "organization": "Example Hosting Ltd",
                "abuseEmails": ["abuse@examplehosting.com"]
            }
        ]
    },
    "page": {
        "title": "Sign in",
        "metaDescription": "Account verification",
        "headings": ["Verify your card"],
        "linkCount": 2,
        "formInputCount": 3,
        "imageCount": 1
    },
    "indicators": {
        "finalUrl": "https://card-shipmoney.com/login/step2",
        "requestedUrl": "https://card-shipmoney.com/login",
        "redirectChain": [
            "https://card-shipmoney.com/login",
            "https://card-shipmoney.com/login/step2"
        ],
        "ssdeepHash": "3:abc:def",
        "pHash": "0x1234",
        "captureDurationMs": 4200,
        "scrapeRoute": {
            "method": "headless",
            "uaType": "mobile",
            "proxyType": "residential",
            "country": "DE",
            "exitIp": "203.0.113.4",
            "mobileExit": true
        }
    }
}

Warning

The boolean signals (isNewDomain, isExpired, isValid) and domainAgeDays are null when the underlying record was missing or unparseable. null means undetermined — treating it as false will produce wrong conclusions.

For the complete capture history including raw DNS, WHOIS and certificate records, use the snapshots endpoint.

Retrieve Incident by Subject#

You can also retrieve incident information using a subject identifier such as a URL, domain, or the subject field itself.

Endpoint#

GET /v1/incident/subject/{subject}

Request Example#

curl -X GET 'https://capi.phishfort.com/v1/incident/subject/uniformprivate.cc' \
  -H 'accept: application/json' \
  -H 'x-api-key: YOUR_API_KEY'

import requests

subject = "uniformprivate.cc"
response = requests.get(
    f"https://capi.phishfort.com/v1/incident/subject/{subject}",
    headers={
        "accept": "application/json",
        "x-api-key": "YOUR_API_KEY",
    },
)
print(response.json())

const subject = "uniformprivate.cc";
const response = await fetch(
  `https://capi.phishfort.com/v1/incident/subject/${subject}`,
  {
    headers: {
      accept: "application/json",
      "x-api-key": "YOUR_API_KEY",
    },
  }
);
const data = await response.json();
console.log(data);

Where {subject} is the URL, domain, or subject field value of the incident you wish to query.

Response Example#

The response structure is identical to the ID-based query, returning a DetailedIncidentStructure in the data field. If no incident is found for the given subject, a 404 response will be returned.

{
    "data": {
        "id": "054zKkjCnR1I3B3U812z",
        "clientId": "0Xp5voyA4y5xYNoufOVC",
        "safeDomain": "exampleclient.com",
        "subject": "uniformprivate.cc",
        "incidentType": "domain",
        "domain": "uniformprivate.cc",
        "url": "https://uniformprivate.cc/chevrolet/",
        "source": "PHISHFORT_DETECTED",
        "timestamp": "2021-11-08T20:36:43.765Z",
        "lastHistoryUpdateTimestamp": "2021-12-06T15:10:01.299Z",
        "burnStartedTimestamp": "2021-12-06T10:34:43.883Z",
        "takedownTimestamp": "2021-12-06T15:10:01.299Z",
        "reportedBy": "analyst@phishfort.com",
        "threatTaxonomy": {
            "name": "Brand - Website - Impersonation",
            "description": "Unauthorized representation of another person, brand, or entity. Includes fake profiles, cloned websites, or identity theft used to deceive victims.",
            "incidentClass": "phishing",
            "incidentTargetType": {
                "id": "abc123",
                "name": "Website",
                "description": "A website used to deceive victims"
            },
            "incidentType": {
                "id": "def456",
                "name": "Brand",
                "description": "Attacks targeting a specific brand"
            },
            "incidentThreatType": {
                "id": "ghi789",
                "name": "Impersonation",
                "description": "Unauthorized representation of another person, brand, or entity."
            }
        },
        "status": "takedown_success",
        "incidentClass": "phishing",
        "incidentState": {
            "unresponsive": true,
            "warningBanner": false,
            "responsive": false,
            "contentRemoved": false,
            "redirect": false,
            "inconclusive": false,
            "timestamp": "2021-12-21T15:21:02.324Z"
        },
        "registrar": {
            "name": "Example Registrar Inc.",
            "difficulty": "Medium",
            "description": "Registrar typically responds within 48 hours."
        },
        "hostingProvider": "Example Hosting Provider",
        "history": [
            {
                "timestamp": "2021-12-06T15:10:01.812Z",
                "message": "Marked as successful take down."
            },
            {
                "timestamp": "2021-11-08T20:36:43.946Z",
                "message": "Incident detected by mailbox:dashboard-report"
            }
        ],
        "blocklists": [
            {
                "authority": "Google Safe Browsing",
                "type": "warning-banner",
                "status": "listed",
                "listedAt": "2021-12-06T11:02:15.000Z",
                "link": "https://transparencyreport.google.com/safe-browsing/search?url=uniformprivate.cc"
            }
        ],
        "insights": {
            "snapshotTimestamp": "2021-12-06T10:34:44.101Z",
            "dns": {
                "recordTypes": ["A", "MX", "NS"],
                "recordCounts": {
                    "A": 2,
                    "MX": 1,
                    "NS": 2
                }
            },
            "whois": {
                "domain": "uniformprivate.cc",
                "registrar": "Example Registrar Inc.",
                "registrarIANAId": "1234",
                "createdDate": "2021-11-02T00:00:00.000Z",
                "updatedDate": "2021-11-02T00:00:00.000Z",
                "expiryDate": "2022-11-02T00:00:00.000Z",
                "domainAgeDays": 6,
                "isNewDomain": true,
                "isExpired": false,
                "statuses": ["clientTransferProhibited"]
            },
            "certificate": {
                "issuer": "R3",
                "subject": "uniformprivate.cc",
                "validFrom": "2021-11-03T00:00:00.000Z",
                "validTo": "2022-02-01T00:00:00.000Z",
                "isValid": true,
                "subjectAltNames": [
                    "uniformprivate.cc",
                    "www.uniformprivate.cc"
                ]
            }
        }
    },
    "message": "success"
}