What are the URL & Domains search parameters of Threat Hunting? | Axur

In this article, you'll find the URL & Domains parameters, along with usage examples for each. Additionally, we provide multiple search options so you can find what you need. All these parameters are available once you access the result details. We have also organized the search parameters according to how they appear in the signal side view.

Risk Score

The Risk Score is an AI-generated score between 1 and 100 that represents how dangerous a signal is. See the full Risk Score article for details on all available fields and use cases.

Parameter	Description	Example
riskScore	Numeric risk score from 1 to 100 — the higher, the more critical	riskScore>90
riskIndicator	Searches by individual risk factors that contributed to the score — returns all signals where that factor was active	riskIndicator="Has Free Hosting Domain"

Threat Analysis

AI-generated fields that classify and describe the threat detected on the page.

Parameter	Description	Example
threatCategory	Threat type classified by Clair. Values: Credentials Harvesting, Payment Scams, Social Engineering, Potential Unauthorized Brand Usage, Malware Technical Abuse, Benign	threatCategory="Credentials Harvesting"
contentType	Content category of the page (e.g., Login page, E-commerce, Adult)	contentType="Login page"
htmlCodeThreatLabel	Whether the HTML and JavaScript analysis identified malicious code patterns	htmlCodeThreatLabel=true
websiteAnalysis	Free-text AI description of the website's visual content and threat indicators	websiteAnalysis="google oauth"
htmlCodeAnalysis	Free-text AI analysis of the page's HTML and JavaScript for malicious patterns	htmlCodeAnalysis="credential harvesting"
imageDescription	Free-text visual description of the page's main screenshot	imageDescription="microsoft logo"

Brand Signals

Fields that identify brand impersonation and brand mentions across the URL structure and page content.

Parameter	Description	Example
impersonatedBrandsHigh	Brand impersonated on the page with high confidence, as detected by Clair	impersonatedBrandsHigh="Netflix"
impersonatedBrandsMedium	Brand impersonated on the page with medium confidence, as detected by Clair	impersonatedBrandsMedium="Netflix"
companiesMentioned	Company names mentioned in the page content	companiesMentioned="Netflix"
companyLogo	Company logo detected in the page images	companyLogo="Netflix"
brandMentionInDomain	Whether the monitored brand name appears in the domain label	brandMentionInDomain=true
brandMentionInSubdomain	Whether the monitored brand name appears in a subdomain	brandMentionInSubdomain=true
brandMentionInPath	Whether the monitored brand name appears in the URL path	brandMentionInPath=true
brandMismatch	Whether the brand shown visually on the page does not match the domain	brandMismatch=true

Data Requested

Fields that indicate whether the page requests sensitive information from users.

Parameter	Description	Example
credentialRequested	Whether the page requests login credentials such as email or username	credentialRequested="yes"
passwordRequested	Whether the page contains a password input field	passwordRequested="yes"
paymentRequested	Whether the page requests payment information	paymentRequested="yes"

Valid values for all three fields: yes, no, possibly

Visual & Language Analysis

Fields extracted from the visual analysis of the page screenshot and detected text.

Parameter	Description	Example
predominantColor	Most predominant color on the page (text value)	predominantColor="blue"
predominantColorHex	Most predominant color in hexadecimal	predominantColorHex="#0066BA"
predominantColorRGB	Most predominant color in RGB	predominantColorRGB="[0, 102, 186]"
languages	Language(s) detected on the page	languages="english"
predominantLanguage	The dominant language on the page	predominantLanguage="english"

Available colors: beige, black, blue, brown, green, grey, navy, orange, pink, purple, red, violet, white, yellow

Primary URL & Domain Identification

These fields are essential for identifying and classifying URLs and domains.

Parameter	Description	Example
reference	Full address of the reference — the URL or domain being analyzed	reference="https://malicious.com/login"
domain	Registered domain of the reference	domain="malicious.com"
host	Host related to the reference	host="login.malicious.com"
subdomain	Subdomain associated with the reference	subdomain="login"
tld	Top-level domain	tld="online"
path	URL path component	path="/netflix/login"
protocol	Protocol used by the URL	protocol="https"
origin	Collector or source that originated the signal	origin="urlscan"
referenceType	Type of reference	referenceType="URL"

Technical URL Indicators

Parameter	Description	Example
queryStrings	URL query string parameters	queryStrings="ref=phish"
finalUrl	Final URL after all redirects are followed	finalUrl="https://real-destination.com"
httpStatus	HTTP status code returned by the page	httpStatus=200
redirects	Number of redirects followed to reach the final URL	redirects>2
htmlLinks	Links extracted from the page HTML	htmlLinks="wa.me"
openPorts	Open ports detected on the host	openPorts=443

WHOIS Data (Domain Registration)

Parameter	Description	Example
domainCreationDate	Date the domain was first registered	domainCreationDate>=2025-01-01
registrant	Registrant name associated with the domain	registrant="John Doe"
registrantOrganization	Organization listed in the WHOIS record	registrantOrganization="Privacy Protection"
registrantEmail	Registrant email address	registrantEmail="[email protected]"
registrar	Domain registrar name	registrar="Namecheap"
nameServers	Name servers associated with the domain	nameServers="ns1.suspiciousdns.com"
domainStatus	Current status of the domain registration	domainStatus="suspended"

DNS Records & Infrastructure

Each DNS record type has its own field. Use a specific value to match records or the wildcard =* to check if a record of that type exists at all.

Parameter	Description	Example
dnsRecordA	IPv4 address record for the domain	dnsRecordA="192.0.2.1" · dnsRecordA=*
dnsRecordAAAA	IPv6 address record for the domain	dnsRecordAAAA="2001:db8::1" · dnsRecordAAAA=*
dnsRecordMX	Mail exchange record — indicates the domain can send/receive email	dnsRecordMX="mail.example.com" · dnsRecordMX=*
dnsRecordNS	Name server record for the domain	dnsRecordNS="ns1.example.com" · dnsRecordNS=*
dnsRecordCNAME	Canonical name record — the domain is an alias for another host	dnsRecordCNAME="target.example.com" · dnsRecordCNAME=*

Tip: Combine DNS fields with other parameters to focus on active infrastructure. For example, impersonatedBrandsHigh="Netflix" AND dnsRecordMX=* returns only brand-impersonating domains that can send email, a strong indicator of active phishing.

Geolocation

Parameter	Description	Example
geolocationCountryName	Country name where the server is hosted	geolocationCountryName="Brazil"
geolocationCountryCode	ISO country code of the hosting location	geolocationCountryCode="BR"
isp	Internet service provider of the server	isp="Cloudflare"

How can I search for signal data from the facebook-ads-coll source in the Meta Ad Library?

You can filter for signals that came specifically from the Meta Ad Library collector by using the origin field. These signals include additional ad-specific metadata:

Parameter	Description	Example
metaAdId	Unique identifier of the ad in Meta's system	metaAdId="23456789012345"
metaAdUrl	URL of the ad in the Meta Ad Library	metaAdUrl="facebook.com/ads/library"
metaProfileId	ID of the Meta page or profile that ran the ad	metaProfileId="123456789"
metaProfileName	Name of the Meta page or profile that ran the ad	metaProfileName="Fake Netflix"
adStartDate	Date the ad started running	adStartDate>=2025-01-01
adEndDate	Date the ad stopped running	adEndDate<=2025-06-01
adPublisherPlatform	Platform where the ad was shown	adPublisherPlatform="FACEBOOK"

If you have any questions, feel free to reach out at [email protected] 😊