What this endpoint does

Downloads a screenshot image captured from a suspicious domain associated with a Domain Abuse alert. These screenshots show the visual appearance of the suspected phishing or typosquatting page, enabling analysts to verify brand impersonation. Obtain the image_id from the screenshots array in the panel_evidence_summary returned by the Playbook Alerts: Domain Abuse Detail or Playbook Alerts: Domain Abuse Bulk endpoints. Not all alerts have screenshots — check that the screenshots array is non-empty before calling this endpoint.

Response data

The response is a binary image in PNG format containing the screenshot of the suspicious domain's web page. Save the response body directly to a file for viewing. This is not a JSON response.