What this endpoint does

Retrieves detailed information for multiple Domain Abuse alerts in a single request (up to 250 alert IDs). These alerts are triggered when Recorded Future detects suspicious domains that may impersonate your organization — including typosquats, phishing domains, and brand abuse. Use the Playbook Alerts: Search endpoint with category domain_abuse to discover alert IDs. This endpoint offers six panel types via the optional panels parameter: "status" (alert metadata), "summary" (detection explanation and screenshots), "dns" (A, MX, NS records for the suspicious domain), "whois" (registration details), "action" (remediation actions), and "log" (change history). For single-alert retrieval, use the Playbook Alerts: Domain Abuse Detail endpoint; to download captured screenshots, use the Playbook Alerts: Domain Abuse Image endpoint.

Response data

Each alert contains panel-organized data: panel_status identifies the suspicious domain, its risk score, the detection rule, and the legitimate targets being impersonated; panel_evidence_summary explains the detection trigger (e.g., typosquat detection) and includes any captured screenshots; panel_evidence_dns provides DNS records (A, MX, NS) with associated risk scores for the suspicious domain; panel_evidence_whois contains WHOIS registration data including registrar, dates, and privacy status; and panel_action tracks available remediation actions such as requesting takedowns, reporting to Google Safe Browsing, blocking on firewalls, or monitoring.