Search Phishing

Search ZeroFox’s CTI feed of phishing sites for a specified domain or host IP address.

To search for a specific site, provide Domain or Host IP.

External Documentation

To learn more, visit the ZeroFox documentation.

​

Basic Parameters

Parameter	Description
Domain	The domain of the phishing site to search for.
Host IP	The IP address hosting the phishing site to search for.
Return All Pages	Automatically fetch all resources, page by page.
Scanned After	The date and time to return phishing sites scanned from.

​

Advanced Parameters

Parameter	Description
Cursor	The cursor of the results page to return. You can get it from the next URL of a previous response.

​

Example Output

{
	"next": "https://api.zerofox.com/cti/phishing/?cursor=c2E9MTYyNjQ2NzU0NjAwMCZzYT04MTM4MQ%3D%3D&domain=www.character-try.xyz",
	"results": [
		{
			"scanned": "1970-01-19T19:41:27.989000Z",
			"domain": "www.purfan.com",
			"url": "https://www.purfan.com/modules/pr/-/canada/manage/Canada_en",
			"cert": {
				"authority": "Cloudflare, Inc.",
				"fingerprint": "1900D261A30FBB6930021D9B47C7757FACABF8B0",
				"issued": "1970-01-19T15:18:43.200000Z"
			},
			"host": {
				"ip": "203.0.113.10",
				"asn": 13335,
				"geo": "US"
			}
		}
	]
}