> ## Documentation Index > Fetch the complete documentation index at: https://wiki.darknetsearch.com/llms.txt > Use this file to discover all available pages before exploring further. # URL Shorteners > Search indexed shortened links to unmask the phishing and malicious destinations they hide Search the index of shortened links — `bit.ly`, `tinyurl`, and the rest — to find ones that resolve to phishing pages or malicious payloads. Attackers lean on shorteners to hide a hostile destination behind a clean-looking link, so a match here tells you a short URL pointing at content tied to your brand or term is already in the wild. This is an **async** source: submit a search, poll until it finishes, then read the results. `POST` your term to [`create_shortener_search_request`](https://client-api.leak.center/scalar-docs/#tag/shortener-search/POST/service/create_shortener_search_request/). It returns a request object with an `id` and a `status`. ```bash theme={"dark"} curl https://client-api.leak.center/api/service/create_shortener_search_request/ \ -X POST \ -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \ -H "Content-Type: application/json" \ -d '{"search_term": "acme.com", "order": "timestamp", "direction": "desc"}' ``` `GET` [`get_shortener_search_request/{id}`](https://client-api.leak.center/scalar-docs/#tag/shortener-search/GET/service/get_shortener_search_request/\{id}/) with the `id` from the submit step. Repeat until `status` reports the job is finished. ```bash theme={"dark"} curl https://client-api.leak.center/api/service/get_shortener_search_request/REQUEST_ID/ \ -H "Authorization: Bearer YOUR_ACCESS_TOKEN" ``` `GET` [`list_shortener_search_result`](https://client-api.leak.center/scalar-docs/#tag/shortener-search/GET/service/list_shortener_search_result/), passing the request id as `searchrequest`. Page through the findings and narrow with the optional filters. ```bash theme={"dark"} curl "https://client-api.leak.center/api/service/list_shortener_search_result/?searchrequest=REQUEST_ID&page=1&page_size=100" \ -H "Authorization: Bearer YOUR_ACCESS_TOKEN" ``` This source costs **0 credits** per search and is throttled to **100 submissions per day**. ### Request parameters **Submit** (`create_shortener_search_request`, JSON body): | Parameter | Type | Required | Notes | | --------------- | ------- | -------- | -------------------------------------------------------------------------------------------------------------------------------- | | `search_term` | string | Yes | The term to match. Space-separated terms use AND logic; a `-` prefix excludes a term (e.g. `login secure -test`). Max 255 chars. | | `extensions` | string | No | Comma-separated file extensions to filter on, e.g. `pdf,docx,txt`. | | `regexp` | boolean | No | When `true`, treats `search_term` as a regular expression. | | `noautocorrect` | boolean | No | When `true`, disables auto-correction of the regex. Only applies when `regexp` is on. | | `order` | string | No | Sort field: `timestamp` (when discovered) or `size`. Default `timestamp`. | | `direction` | string | No | `asc` or `desc`. Default `desc`. | | `org_id` | string | No | Subsidiary organization ID, for system-level users targeting a sub-org. | **Read** (`list_shortener_search_result`, query string): | Parameter | Type | Required | Notes | | ------------------ | ------- | -------- | -------------------------------------------------------------------------------------------------------- | | `searchrequest` | string | Yes | The request `id` from the submit step. | | `page` | integer | No | 1-based page number. Default `1`. | | `page_size` | integer | No | Results per page. Default `100`. | | `search` | string | No | Case-insensitive text search on the `domain` field. | | `extension` | string | No | Exact, case-insensitive file extension filter, e.g. `pdf`. | | `shortened_domain` | string | No | Exact-match filter on the shortener service hostname, e.g. `bit.ly`. | | `exclude_domain` | string | No | Excludes results whose link URL contains this domain. | | `order` | string | No | Sort field: `discovered_date`, `domain`, `shortener`, `extension`, or `link`. Default `discovered_date`. | | `direction` | string | No | `asc` or `desc`. Default `desc`. | ### What comes back **Submit and poll** return the request object: `id`, your `search_term`, `status`, `create_date`, `update_date`, `created_at`, and monitoring flags (`is_monitoring`, `alert_cycle`, `is_email`, `is_reporting`, `report_id`, `follow_up_token`). Watch `status` to know when results are ready. **Read** returns a paginated envelope. Top-level fields: * `count` — results on this page. * `total_count` — total results across all pages. * `next` / `previous` — page cursors, `null` at the ends. * `available_extensions` — every file extension present in this result set, for building the `extension` filter. * `available_shortened_domains` — every shortener hostname present, for building the `shortened_domain` filter. * `results` — the array of matches. Each entry in `results` carries: * `id` — result identifier. * `link` — the destination URL the short link resolves to. * `domain` — the destination's domain. * `shortener` — the full short URL itself. * `shortener_hostname` — the shortener service host, e.g. `bit.ly`. * `extension` — file extension of the destination, when there is one. * `size` — destination file size in bytes; may be `null`. * `appeared_date` — date the link first appeared (`YYYY-MM-DD`). * `discovered_date` — timestamp the link was indexed (`YYYY-MM-DDTHH:MM:SSZ`). * `searchrequest` — the request id this result belongs to. ```json theme={"dark"} { "count": 1, "total_count": 1, "next": null, "previous": null, "available_extensions": ["pdf"], "available_shortened_domains": ["bit.ly"], "results": [ { "id": "a1b2c3d4", "link": "http://login-acme.com/reset/invoice.pdf", "domain": "login-acme.com", "shortener": "https://bit.ly/3xAcmePay", "shortener_hostname": "bit.ly", "extension": "pdf", "size": 184320, "appeared_date": "2026-05-30", "discovered_date": "2026-05-30T14:22:10Z", "searchrequest": "REQUEST_ID" } ] } ``` Treat any short link resolving to a lookalike of your domain (here `login-acme.com` standing in for `acme.com`) as an active phishing lure. Pull the `shortener` URL for takedown with the shortener provider, and feed the destination `domain` and `link` into your blocklists and user-awareness alerts. ### What to do with the results Each match is a live short link pointing at content tied to your term — usually a phishing page or a malicious file. Submit the `shortener` URLs for takedown and block the resolved `domain` and `link` across your mail and web gateways before users click through.