What this endpoint does

Downloads a screenshot captured from the attacker domain associated with a Malicious Sites alert. Screenshots show the visual appearance of the suspected phishing or brand-impersonation page — including any detected logotypes — letting analysts verify the abuse without visiting the live site. Obtain the image_id from the evidence returned by Playbook Alerts: Malicious Sites Detail or Playbook Alerts: Malicious Sites Bulk: screenshot ids appear in the attacker panel's screenshots array and as img:-prefixed references in takedown and change evidence. Not every alert has screenshots, so check for them before calling this endpoint.

Response data

The response is a binary PNG image of the attacker page. Save the response body directly to a file for viewing. This is not a JSON response.