---
title: "Threat intelligence data"
description: "Threat intelligence data from phishing pages, lookalike domains, scam stores and public paste sites: rendered HTML, screenshots and final URLs as evidence."
canonical: https://www.zenrows.com/use-cases/threat-intelligence-data
updated: 2026-10-18
---

# Threat intelligence data

Threat intelligence data is the evidence security teams collect about attacks aimed at their organization or customers, such as phishing pages, lookalike domains, scam storefronts and leaked data posted publicly. Zenrows loads those surface web pages from its own network, renders them like a real visitor, and returns HTML, screenshots and the final URL for analysis and takedown.

## Sample output: one suspected phishing page

```json
{
  "submitted_url": "https://acme-login-verify.example.net/session",
  "final_url": "https://secure-acme.example.org/signin/index.php",
  "captured_at": "2026-10-14T09:27:44Z",
  "page_title": "Sign in | Acme",
  "forms": [
    {
      "action": "https://collect.example.org/p.php",
      "fields": ["email", "password"],
      "posts_off_domain": true
    }
  ],
  "brand_assets_reused": ["acme-logo.svg", "acme-favicon.ico"],
  "background_requests": ["https://collect.example.org/geo.php"],
  "screenshot": "evidence/2026-10-14/acme-login-verify.png",
  "html_sha256": "c41e09a7f2...0b3d",
  "verdict": "phishing_credential_harvest"
}
```

An illustrative record for one URL. Zenrows returns the rendered HTML, the screenshot, background requests and the final URL; the form parsing, asset matching and verdict are your own analysis.

## Threat intelligence collection jobs

External threat intelligence is mostly about seeing what an attacker has published before your customers or staff do. Every job below works on the public, surface web.

| Job | Data you collect | Typical sources |
|---|---|---|
| Phishing page analysis | Rendered HTML, form targets, reused brand assets, screenshot, final URL | URLs from user reports, email gateway quarantine, PhishTank, OpenPhish, URLhaus |
| Lookalike domain monitoring | Whether a domain is parked, redirecting, cloning your site or collecting logins | Newly issued certificates in crt.sh, typo and homoglyph variants you generate |
| Scam storefront detection | Shop pages, prices, payment and contact details, brand terms | Google Search results, social ad landing pages, marketplace links |
| Public leak monitoring | Pastes or files naming your domains, email formats or API key prefixes | Pastebin, public GitHub repositories and gists, public forums |
| Security research feeds | Advisories, attacker techniques, indicators and affected products | Vendor research blogs, CISA advisories, NVD entries, security RSS feeds |
| Takedown evidence | Screenshot, HTML hash, timestamp and hosting details per URL | Every confirmed malicious page, captured before the abuse report |

## Why phishing detection pipelines miss pages

Malicious sites are built to show security tooling nothing. A plain HTTP client from a cloud range often gets a blank page, a decoy or a 404, while a real visitor gets the login form.

| What breaks | What it looks like | How Zenrows handles it |
|---|---|---|
| Cloaking against scanners | Kits serve a harmless page to datacenter IPs and known security ranges | Zenrows' stealth loads the page the way a targeted user would see it |
| Country targeting | A kit only shows its form to visitors from the bank's home country | Geotargeting sends the request from that country |
| Redirect chains and JavaScript | The submitted URL bounces through two hops and builds the form in the browser | A full browser render runs the page, and the `Zr-Final-Url` response header gives the landing URL |
| Challenge pages in front of kits | Attackers put Cloudflare or Turnstile in front of the phishing site | Zenrows gets through the challenge and returns the page behind it |
| Exposure of your own network | Fetching from corporate IPs tells the attacker they have been found | Requests leave from Zenrows' network, so your address ranges stay out of their logs |

## How to collect threat intelligence data with Zenrows

1. **Gather candidate URLs.** Pull reported URLs, new certificates for names close to yours, and search results for your brand plus terms like "login" or "verify".
2. **Render each one.** Fetch each URL with a full browser render, a screenshot and a capture of the page's background network calls, so one response holds the HTML, the image and every request the kit makes. Read the final URL from the headers.
3. **Classify.** Parse forms, password fields and off-domain form targets, and match logos and favicons against your own assets.
4. **Keep the evidence.** Store the screenshot, an HTML hash and the timestamp with each verdict, then send the abuse report.
5. **Feed research sources.** Crawl security blogs and advisories into Markdown for entity extraction on a daily schedule, from code, the CLI or an agent.

```python Python
# pip install requests beautifulsoup4
import base64, requests
from bs4 import BeautifulSoup

response = requests.get("https://api.zenrows.com/v1/", params={
    "apikey": "YOUR_ZENROWS_API_KEY",
    "url": SUSPECT_URL,
    "js_render": "true",
    "premium_proxy": "true",
    "screenshot": "true",
    "json_response": "true",
})
data = response.json()
final_url = response.headers.get("Zr-Final-Url")

soup = BeautifulSoup(data["html"], "html.parser")
forms = [
    {"action": f.get("action"), "has_password": bool(f.select("input[type=password]"))}
    for f in soup.select("form")
]
background = [call["url"] for call in data.get("xhr", [])]
open("evidence/suspect.png", "wb").write(base64.b64decode(data["screenshot"]["data"]))
print(final_url, forms, background)
```

```bash cURL
curl -X POST "https://api.zenrows.com/v1/crawls" \
  -H "X-API-Key: YOUR_ZENROWS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "SECURITY_BLOG_URL",
    "max_items": 200,
    "include_patterns": ["/research/", "/blog/"],
    "exclude_patterns": ["/tag/", "/author/"],
    "output_format": "markdown"
  }'
```

```bash CLI
npx -y @zenrows/cli init
zenrows fetch https://acme-login-verify.example.net/session --screenshot --out evidence/acme-login-verify.png
zenrows fetch https://acme-login-verify.example.net/session --out evidence/acme-login-verify.html
zenrows crawl create https://www.cisa.gov/news-events/cybersecurity-advisories --include-patterns /news-events/cybersecurity-advisories/ --max-pages 200 --output-format markdown --follow
```

```text Claude Code (MCP)
# Connect once
claude mcp add zenrows -e ZENROWS_API_KEY=YOUR_ZENROWS_API_KEY -- npx -y @zenrows/mcp

# Then ask:
Use Zenrows to open https://acme-login-verify.example.net/session, take a screenshot, and tell me the final URL after redirects, whether the page has a password field, where its login form posts to, and whether it reuses the Acme logo.
```

## Which Zenrows product fits

| If you need to | Use | Why |
|---|---|---|
| Analyse one reported URL with HTML, screenshot and final URL | [Fetch](/products/fetch) | One rendered request returns the evidence your analyst needs |
| Check thousands of lookalike domains and feed URLs each day | [Batch](/products/batch) | Submit the whole list as one job, results by webhook |
| Turn research blogs and advisories into Markdown | [Crawl](/products/crawl) | Follows a site's links within the domain and returns each page as Markdown |
| Step through a kit that shows the form only after an email step | [Browser](/products/browser) | Drive the page with Playwright and screenshot each stage |

## What success looks like

| Measure | What good looks like | How to check it |
|---|---|---|
| Time to verdict | A reported URL is rendered and classified within minutes of the report | Log report time and verdict time for each URL |
| Cloaked page rate | Few URLs that analysts later confirm as phishing were first seen as benign | Re-review benign verdicts that come back in later reports |
| Evidence completeness | Every confirmed page has a screenshot, HTML hash, final URL and timestamp | Reject abuse reports that miss any of the four |
| Lookalike coverage | Every new certificate or registration close to your names is checked the same day | Compare the day's candidate list with the domains actually fetched |
| Time to takedown | Reported pages stop loading within the host's stated response time | Resubmit reported URLs with Batch daily and record when they go down |

## Threat intelligence data FAQ

### What is threat intelligence data?

Threat intelligence data is information about threats aimed at an organization, collected so the security team can detect, block or remove them. It ranges from indicators such as malicious URLs, domains and IP addresses to context such as the brand a phishing kit imitates or the technique a campaign uses. External sources include public feeds, research blogs and the malicious pages themselves.

### How is this different from buying threat intelligence feeds?

Threat intelligence feeds give you lists of indicators someone else has collected. Collecting your own data gives you the pages aimed at your brand and customers, captured when you need them, with evidence attached. Use both: feeds as one source of candidate URLs, and your own collection to confirm, enrich and document what targets you.

### How does domain monitoring work?

Generate the names an attacker might register, such as typos, swapped letters, homoglyphs and your brand plus words like "login" or "support". Watch certificate transparency logs and new registrations for matches. Then fetch each live domain and classify it: parked, redirecting, cloning your site or collecting credentials. Recheck the parked ones regularly, since a parked domain can start serving a kit at any time.

### Is it safe to load phishing pages through Zenrows?

The page is loaded and rendered on Zenrows' infrastructure, and you receive HTML, a screenshot and metadata, so the kit does not run in your analysts' browsers or see your corporate IP addresses. Treat the returned HTML as untrusted input: parse it in a sandboxed service and do not open it in a normal browser session.

### Which sources can Zenrows collect threat data from?

Zenrows collects from the surface web, meaning anything reachable by URL on the public internet. That covers phishing pages, lookalike domains, scam stores, public paste sites, public code repositories, security blogs and advisories, which together hold the pages aimed at your brand, staff and customers.

### How do you detect phishing sites that use cloaking?

Load each suspect URL the way a target would: through Zenrows' stealth, from the victim's country, with JavaScript running. A kit that shows a blank page to scanners then shows its login form instead. Then compare what you got with earlier scans of the same URL. A page that was benign last week and now has a password field posting off-domain is the signal to escalate.

## Related use cases

- [Brand protection](https://www.zenrows.com/use-cases/brand-protection.md): Unauthorized sellers, trademark misuse and impersonation stores across marketplaces, with screenshot evidence for every takedown.
- [Adverse media screening](https://www.zenrows.com/use-cases/adverse-media-screening.md): Negative news on customers, directors and suppliers from global and local sources, with text and screenshots as evidence.

Start free: https://app.zenrows.com/register. Docs: https://docs.zenrows.com