<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Analyzing Phishing Infrastructure

## Agent Script

### Commands

| Command | Description |
|---|---|
| `node agent.js domain-recon --domain <domain>` | Full domain reconnaissance |
| `node agent.js ct-search --domain <domain>` | Certificate transparency log search |
| `node agent.js ip-analysis --ip <ip>` | IP address hosting and network analysis |
| `node agent.js ip-neighbors --ip <ip>` | Check IP neighborhood for related domains |
| `node agent.js trace-redirects --url <url>` | Trace HTTP redirect chain |
| `node agent.js jarm-scan --target <domain>` | JARM TLS fingerprint |
| `node agent.js cluster --ioc-file <path> --pivot <fields>` | Cluster domains by infrastructure |

### Examples

```bash
# Full domain investigation
node agent.js domain-recon --domain phishing-domain.com

# Search CT logs for related certificates
node agent.js ct-search --domain phishing-domain.com

# Analyze hosting IP
node agent.js ip-analysis --ip 192.0.2.1

# Trace redirect chain
node agent.js trace-redirects --url "https://phishing-domain.com/login"

# Cluster related phishing domains
node agent.js cluster --ioc-file /tmp/domains.txt --pivot registrant,nameserver,ip_block
```

## External Tool Reference

| Tool | Command | Purpose |
|---|---|---|
| whois | `whois <domain>` | Registration data |
| dig | `dig +short A <domain>` | DNS resolution |
| openssl | `openssl s_client -connect <domain>:443` | Certificate inspection |
| curl | `curl -sIL <url>` | Redirect chain tracing |
| subfinder | `subfinder -d <domain>` | Subdomain enumeration |
