Keyword Search Guide

The /search-by-keyword/urls endpoint allows you to search for URLs containing specific keywords and returns results grouped by domain. This is useful for identifying compromised web applications, phishing sites, or specific services.

Request Parameters

• keyword (string, required): Keyword to search for in URLs. Case-insensitive. Examples include 'rdweb', 'citrix', 'webmail', etc.
• cursor (string, optional): Base64 encoded pagination cursor for retrieving the next set of results. Obtained from the 'nextCursor' field in the previous response. Enables efficient pagination through large result sets without data loss.
• sort_direction (string, optional): Direction to sort results. 'desc' returns newest file exposures first (recommended for threat monitoring), while 'asc' returns oldest exposures first (useful for forensic analysis and incident timelines). Default: 'desc'

Example Request

{
 "keyword": "webmail"
}

Response Format

{
    "data": [
        {
            "domain": "example.com",
            "occurrence": 42,
            "urls": [
                "https://webmail.example.com/login",
                "https://webmail.example.com/inbox",
                "https://example.com/webmail/auth"
            ]
        },
        {
            "domain": "acme.org",
            "occurrence": 27,
            "urls": [
                "https://mail.acme.org/webmail",
                "https://acme.org/webmail/login"
            ]
        }
    ],
    "nextCursor": "eyJvY2N1cnJlbmNlIjoyNywiZG9tYWluIjoiYWNtZS5vcmcifQ=="
}

For pagination, include the nextCursor value from the previous response in your next request. When there are no more results, the nextCursor field will be null.