Incident Snapshots

PhishFort captures snapshots of an incident's infrastructure over its lifetime — at detection, at status changes, and during takedown. Each snapshot records the DNS, WHOIS and TLS certificate state at that moment.

This endpoint returns the full capture history with the records unprocessed. If you want the signals already worked out — domain age, expiry, certificate validity, record counts — the single incident endpoint returns an insights block derived from the most recent capture.

Endpoint

GET /v1/incident/{incidentId}/snapshots

Request Example

cURLPythonNode.js

curl -X GET 'https://capi.phishfort.com/v1/incident/{incidentId}/snapshots' \
  -H 'accept: application/json' \
  -H 'x-api-key: YOUR_API_KEY'

import requests

incident_id = "054zKkjCnR1I3B3U812z"
response = requests.get(
    f"https://capi.phishfort.com/v1/incident/{incident_id}/snapshots",
    headers={
        "accept": "application/json",
        "x-api-key": "YOUR_API_KEY",
    },
)
print(response.json())

const incidentId = "054zKkjCnR1I3B3U812z";
const response = await fetch(
  `https://capi.phishfort.com/v1/incident/${incidentId}/snapshots`,
  {
    headers: {
      accept: "application/json",
      "x-api-key": "YOUR_API_KEY",
    },
  }
);
const data = await response.json();
console.log(data);

Where {incidentId} is the ID of the incident, or its inc_ reference.

Response Example

The data field contains the incident id you queried with and an array of SnapshotStructure entries. If the incident cannot be found, or does not belong to your API key, a 404 response is returned.

{
    "data": {
        "incidentId": "054zKkjCnR1I3B3U812z",
        "snapshots": [
            {
                "id": "3f9a1c22-7b40-4c18-9d55-1e2b6a0f8c31",
                "incidentId": "054zKkjCnR1I3B3U812z",
                "type": "incident_created",
                "timestamp": "2021-11-08T20:36:44.101Z",
                "description": "Snapshot on incident creation",
                "dns": {
                    "A": {
                        "records": ["3.79.173.192", "18.185.25.67"],
                        "rcode": "NOERROR"
                    },
                    "MX": {
                        "records": ["10 mail.uniformprivate.cc"],
                        "rcode": "NOERROR"
                    },
                    "NS": {
                        "records": ["ns1.example.com", "ns2.example.com"],
                        "rcode": "NOERROR"
                    }
                },
                "whois": {
                    "domain": "uniformprivate.cc",
                    "registrarIANAId": "1234",
                    "createdDate": "2021-11-02",
                    "updatedDate": "2021-11-02",
                    "expiryDate": "2022-11-02"
                },
                "certificate": {
                    "issuer": "R3",
                    "subject": "uniformprivate.cc",
                    "validFrom": "2021-11-03T00:00:00Z",
                    "validTo": "2022-02-01T00:00:00Z",
                    "sanEntries": [
                        "uniformprivate.cc",
                        "www.uniformprivate.cc"
                    ]
                }
            },
            {
                "id": "8b21d0e4-1c93-4a77-bb02-5d9f3e7a1c60",
                "incidentId": "054zKkjCnR1I3B3U812z",
                "type": "incident_status_updated",
                "timestamp": "2021-12-06T15:10:02.004Z",
                "description": "Snapshot on status change",
                "dns": {
                    "A": {
                        "records": [],
                        "rcode": "NXDOMAIN"
                    }
                }
            }
        ]
    },
    "message": "success"
}

Info

Snapshots are returned newest first. An incident may have no snapshots at all — non-domain incidents such as email, phone and ipv4 have no DNS, WHOIS or certificate state to capture, so an empty array is the normal result for them.

Reading the records

The dns, whois and certificate fields are passed through as captured. Their internal keys come from the resolvers and parsers upstream, so treat every field inside them as optional — a WHOIS server that returned nothing usable produces a sparse object rather than an absent one.

Two comparisons are worth making across the history:

Change between snapshots	What it usually means
A records disappearing, or rcode becoming NXDOMAIN	The domain stopped resolving — often the takedown landing.
Certificate validTo in the past on a later snapshot	The site can no longer serve HTTPS.
A records changing to a different network	The operator moved hosting, frequently in response to a takedown attempt.

Warning

A snapshot records what was observed at timestamp, not the current state. The most recent snapshot may still predate a change. Use the incident's status for where the case actually stands.

Screenshots

Rendered screenshots and page captures are not returned by this endpoint. Snapshots here carry infrastructure records only.