Performs paginated search of unclassified lookalike domains with advanced filtering, sorting, and pagination.
Filter Pattern
Filters follow the pattern: {field}[{operator}]={value}
Available Fields
String/Keyword Fields
Operators: contains, equals, is, startsWith, endsWith, isEmpty, isNotEmpty, isAnyOf, not_equal, is_not, not, not_contain, isNotAnyOf
Fields: id, domain, unicodeDomain, looks_like, similarity, dmarc_status, ns_records, apexDomain, matchBasedOn, industry, source, origin, dns_providers, agenticTag, classification, tags, keywords, annotations, face_annotations, ns_records_list, dns_providers_list
Boolean Fields
Values: true, false, any
Fields: email_ready, reputation, web_presence, riskBump, read, is_subdomain, has_screenshot, has_annotations, has_face_annotations, has_detected_keywords, reportedAsFalsePositive, in_takedown, flagged_by_google_safe_browsing, hasSubdomailer, manuallyAdded, hasNotes, detected_emails
Numeric Fields
Operators: equals, equalOrLargerThan, largerThan, lessThan, lessThanOrEqual, between
Fields: traffic_rank, risk_rating, new_risk_rating, numThreatEmails
Date Fields (YYYY-MM-DD format)
Operators: is, not, after, onOrAfter, before, onOrBefore, isEmpty, isNotEmpty
Fields: observed_date, updated_at, lastScanCrux, deletionCountdownSince
Examples
- String:
unicodeDomain[contains]=phish&similarity[equals]=high - Boolean:
email_ready[eq]=true&web_presence[eq]=true - Numeric:
new_risk_rating[largerThan]=7&traffic_rank[lessThan]=1000000 - Date:
observed_date[after]=2024-01-01&updated_at[onOrBefore]=2024-12-31 - Arrays:
tags[isAnyOf]=list[urgent,critical]&classification[contains]=phishing
Sorting
_sortColumn=[field,ordering] (e.g., _sortColumn=[observed_date,desc])
Pagination
Use page and pageSize parameters
Combining Filters
Use linkOperator=and (all must match) or linkOperator=or (any must match)