Webamon Search CLI

The Google of Threat Intelligence

A powerful command-line interface for the Webamon Search API. Search & Threat Hunt across the web at scale. Returning unbiased & unfiltered results.

What you can do:

• 🔎 Search the scan corpus by domain, IP, URL, hash or tag — or with full Lucene queries
• 🛰️ Scan any URL on demand and pull the report or screenshot
• 🔑 Infostealers — hunt compromised credentials by domain
• 🎯 Campaigns — tracked phishing/malware estates: domain inventories, change history, analyst tags and stats (Pro)
• 📡 Clusters — the emerging-threat radar: auto-detected fingerprint clusters not yet promoted to campaigns (Pro)
• 📤 Export any result set to JSON, CSV or Markdown

Installation

From PyPI

pip install webamon-cli

Webamon Search - The Google of Threat Intelligence. Access millions of scanned domains, IPs, and threat indicators.

Global Installation (Linux/macOS)

Recommended: Install via Package Manager

# Ubuntu/Debian
sudo apt update && sudo apt install pipx
pipx install webamon-cli
pipx ensurepath

# Fedora/CentOS/RHEL
sudo dnf install pipx
pipx install webamon-cli
pipx ensurepath

# macOS
brew install pipx
pipx install webamon-cli
pipx ensurepath

# Arch Linux
sudo pacman -S python-pipx
pipx install webamon-cli
pipx ensurepath

Alternative: Install from Source

If you need the latest development version or package managers don't work:

1. Install pipx first:

# Ubuntu/Debian: sudo apt install pipx
# Fedora/CentOS: sudo dnf install pipx  
# macOS: brew install pipx
# Arch: sudo pacman -S python-pipx

2. Clone and install:

git clone https://github.com/webamon-org/webamon-cli.git
cd webamon-cli
pipx install .
pipx ensurepath

Verify Installation:

# Test the installation
webamon --help

# If command not found, add to PATH:
export PATH="$HOME/.local/bin:$PATH"
# Then restart your terminal or run:
source ~/.bashrc  # Linux
# or
source ~/.zshrc   # macOS

Development Installation

For development work:

git clone https://github.com/webamon-org/webamon-cli.git
cd webamon-cli
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate
pip install -e .

Quick Start

Install globally:

# Ubuntu/Debian
sudo apt install pipx && pipx install webamon-cli

# Fedora/CentOS  
sudo dnf install pipx && pipx install webamon-cli

# macOS
brew install pipx && pipx install webamon-cli

🚀 Start searching immediately - it's that simple!

Use the explicit search command:

webamon search example.com       # Search for example.com
webamon search malware          # Search for malware
webamon search nrd_20250801     # Search latest domain registrations

Other commands:

webamon search example.com     # Explicit search command
webamon configure             # Configure API key for pro features
webamon status               # Test connection
webamon scan https://example.com  # Scan a website

Usage

API Endpoints

Webamon Search - The Google of Threat Intelligence

The CLI automatically uses the appropriate endpoint:

• Free tier: search.webamon.com (no API key required)
• Pro tier: pro.webamon.com (requires API key)

Configuration

The CLI can be configured in several ways:

1. Interactive configuration:

webamon configure

2. Environment variables:

export WEBAMON_API_KEY="your-api-key"  # Optional, enables pro features

3. Command-line options:

webamon --api-key your-key search example.com domain.name

4. Configuration file: The CLI looks for configuration in:

• ~/.webamon/config.json
• .webamon.json in current directory

Commands

Search

Search the Webamon threat intelligence database:

# Search for domains, IPs, URLs, etc:
webamon search example.com           # Search for example.com
webamon search malware              # Search for malware  
webamon search 1.1.1.1             # Search for IP address
webamon search nrd_20250801 tag     # Search in specific field

How it works:

• webamon search <SEARCH_TERM> - Basic search
• webamon search <SEARCH_TERM> <RESULTS> - Search in specific fields
• SEARCH_TERM: What you're searching for (domain, IP, URL, hash, etc.)
• RESULTS: Comma-separated list of fields to search within
  • Default search fields: page_title,domain.name,resolved_url,dom,tag
  • Custom search fields: Specify your own field list
• --fields: Comma-separated list of fields to return (separate from search fields)
  • Default return fields: Same as search fields when not specified

💡 Search matches are highlighted with yellow background in table view.

Examples:

# Basic search
webamon search example.com

# Search in specific fields
webamon search example.com domain.name,resolved_url

# Custom return fields  
webamon search example.com --fields page_title,domain.name

# Both custom search and return fields
webamon search example.com tag --fields page_title,domain.name

# Different output formats
webamon search example.com --format json
webamon search example.com --format csv

# Export results
webamon search example.com --export results.json
webamon search example.com --format csv --export analysis.csv

Pagination (Pro Users Only):

# Limit results with default fields
webamon search example.com --size 25

# Use offset for pagination with default fields
webamon search example.com --from 25 --size 25

# Use offset with custom fields
webamon search example.com domain.name,resolved_url --from 25 --size 25

# Skip first 100 results with default fields
webamon search example.com --from 100 --size 50

# Navigate large result sets
webamon search "*.bank.com" --from 0 --size 100

Lucene Search:

# Advanced Lucene queries
webamon search --lucene 'domain.name:"bank*" AND scan_status:success' --index scans

# Specify fields to return
webamon search --lucene 'domain.name:"example.com"' --index scans --fields domain.name,page_title

Scan

Initiate website scans:

# Scan a domain
webamon scan example.com

# Scan and automatically fetch the report
webamon scan example.com --fetch-report

# Scan a full URL
webamon scan https://example.com/login

# JSON output with automatic report fetch
webamon scan example.com --format json --fetch-report

Report

Get a specific scan report by ID:

# Get report details (JSON format by default)
webamon report bf18c02d-ff0e-46a9-9a59-5b7b94fb27fb

# Table format for readable summary
webamon report bf18c02d-ff0e-46a9-9a59-5b7b94fb27fb --format table

Infostealers

Search for compromised credentials by domain:

# Search for compromised credentials
webamon infostealers example.com

# Search domain with hyphens (automatically quoted)
webamon infostealers bank-site.com

# Get more results (Pro users)
webamon infostealers example.com --size 50

# Specify fields to return
webamon infostealers example.com --fields domain,username,password

# JSON output
webamon infostealers example.com --format json

# CSV output (auto-exports to file)
webamon infostealers example.com --format csv

# Export to custom file
webamon infostealers example.com --export compromised_creds
webamon infostealers example.com --format csv --export creds.csv

Screenshot

Retrieve scan screenshots:

# Get screenshot info
webamon screenshot bf18c02d-ff0e-46a9-9a59-5b7b94fb27fb

# Save screenshot to file
webamon screenshot bf18c02d-ff0e-46a9-9a59-5b7b94fb27fb --save screenshot.png

Status

Check API connectivity:

webamon status

Fields

Discover available scan fields:

# Show all available fields
webamon fields

# Search for specific fields
webamon fields --search domain

# Show fields by category
webamon fields --category certificate

# Get fields as a simple list
webamon fields --search ip --format list

Campaigns

Campaign intelligence — tracked phishing and malware-delivery estates, their domain inventories, change history and analyst tags.

🔑 Requires a Pro API key on a Research Lab or SOC plan. On the Researcher tier, campaigns are available through the web console at intel.webamon.com.

# List tracked campaigns
webamon campaigns list
webamon campaigns list --search clickfix        # free-text filter
webamon campaigns list --tag phishing           # filter by analyst tag
webamon campaigns list --size 50 --from 50      # paginate

# Full detail for one campaign (by id or exact name)
webamon campaigns show 337271a6...
webamon campaigns show "ClickFix Fake-Cloudflare"

# Domain inventory for a campaign
webamon campaigns domains 337271a6...
webamon campaigns domains 337271a6... --online true        # live domains only
webamon campaigns domains 337271a6... --q login            # substring filter
webamon campaigns domains 337271a6... --sort last_seen --order desc
webamon campaigns domains 337271a6... --since 2026-07-01   # date window

# Change history
webamon campaigns changes 337271a6...                      # one campaign
webamon campaigns changes                                  # all campaigns (stream)
webamon campaigns changes --dim domains --since 2026-07-01 # only new domains
webamon campaigns changes 337271a6... --exclude-baseline

# Analyst tags in use, with campaign counts
webamon campaigns tags
webamon campaigns tags --q click

# Estate statistics
webamon campaigns stats                 # global: domains, liveness, top TLDs
webamon campaigns stats 337271a6...     # scoped to one campaign

Subcommand	What it does
list	Tracked campaigns, newest activity first
show	One campaign in full — seed query, totals, samples
domains	Paginated domain inventory with liveness and date filters
changes	Change history for a campaign, or the estate-wide stream
tags	Every analyst tag with the number of campaigns carrying it
stats	Domain counts, online/offline split, TLD breakdown

All list-style subcommands support --format table|json and --export FILE (.json, .csv, or .md depending on format).

Clusters

Emerging clusters — auto-detected fingerprint groupings the detector has spotted that are not yet tracked campaigns. New, 50–10k domains, boilerplate filtered. These are your promotion candidates.

🔑 Same access requirement as campaigns.

# The live radar (bare command lists them)
webamon clusters
webamon clusters list

# Triage by severity
webamon clusters list --severity critical
webamon clusters list --severity high --sort recent_7d

# Filter by fingerprint type and size band
webamon clusters list --type links --min-domains 1000
webamon clusters list --type ssl --max-domains 500

# Date windows
webamon clusters list --since 2026-07-19 --date-field first_seen
webamon clusters list --sort detected_at --include-stale

# Enumerate the entire live feed in one call (max page size)
webamon clusters list --size 1000 --format json --export radar

# Radar totals by severity and fingerprint type
webamon clusters summary

# One cluster in full - by cluster_id, fingerprint, or prefix
webamon clusters show ssl:abc123def456
webamon clusters show abc123

# Just the Lucene seed, ready to promote
webamon clusters show abc123 --seed-only

Filters — --severity (critical/high/watch), --type (links/ssl/dom/asn/scripts/tech/domains), --min-domains, --max-domains, --since/--until with --date-field (first_seen/last_seen/detected_at), --sort (unique_domains, delta_24h, recent_7d, first_seen, last_seen, detected_at, severity), --order, --size (default 50, max 1000), --from, --include-stale.

The table view shows severity, fingerprint type, domain count, 24h and 7d growth, first seen, the sample lure, and the fingerprint — with a severity breakdown underneath. Use clusters show for the full object including sample domains, top TLDs and the growth series.

Global Options

• --api-key: Override API key
• --config-file: Use specific config file
• --verbose, -v: Enable verbose output

Example Workflows

Security Research

# Search for subdomains
webamon search "*.example.com"

# Scan suspicious domains
webamon scan suspicious-domain.com

# Get screenshots of flagged sites
webamon screenshot <report-id> --save evidence.png

Domain Intelligence

# Basic domain lookup
webamon search example.com domain.name,resolved_url,page_title

# Advanced search with Lucene
webamon search --lucene 'domain.name:"example.com" AND scan_status:success' --index scans

# Bulk domain analysis
for domain in $(cat domains.txt); do
  webamon search $domain >> results.json
done

Campaign Triage (Pro)

# What moved across the estate in the last day?
webamon campaigns changes --since 2026-07-28

# Which campaign is growing fastest? Then dig in.
webamon campaigns list --size 20
webamon campaigns show 337271a6...
webamon campaigns stats 337271a6...

# Pull the live domains for blocking
webamon campaigns domains 337271a6... --online true --size 1000 \
  --format json --export blocklist

Promoting an Emerging Cluster (Pro)

# 1. Check the radar, worst first
webamon clusters summary
webamon clusters list --severity critical --sort recent_7d

# 2. Inspect a candidate - sample domains, TLDs, growth curve
webamon clusters show ssl:abc123def456

# 3. Grab its seed query to promote it to a tracked campaign
webamon clusters show abc123 --seed-only
# -> fingerprint.ssl:"abc123def456"

# 4. Snapshot the whole radar for reporting
webamon clusters list --size 1000 --format json --export radar-$(date +%F)

Quotas and Pricing

Free Tier

• 20 daily API calls
• 10 results per response
• Basic search functionality
• Limited infostealer data access

Pro Plans

When you hit the daily quota, the CLI will suggest upgrading to Pro for expanded access:

• Founding Analyst: 1,000+ daily calls, up to 100 results per response
• Enterprise: 10,000+ daily calls, up to 500 results per response
• All plans: Complete infostealer data access, pagination, priority support

For current pricing and features, visit: https://webamon.com/pricing

If you exceed your quota, you'll see a helpful error message with upgrade information.

Configuration File Format

{
  "api_key": "your-api-key-here",
  "verbose": false
}

Development

Setup Development Environment

# Clone and install
git clone https://github.com/webamon-org/webamon-cli.git
cd webamon-cli
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate
pip install -e .

Building

python -m build

Uninstall

Global Installation (pipx)

pipx uninstall webamon-cli

PyPI Installation

pip uninstall webamon-cli

Development Installation

# If installed with pip install -e .
pip uninstall webamon-cli

# Remove the repository
rm -rf webamon-cli

License

Apache License 2.0

Copyright 2025 Webamon

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Contributing

We welcome contributions! Please see CONTRIBUTING.md for detailed guidelines on:

• Setting up your development environment
• Code style and testing requirements
• Submitting bug reports and feature requests
• Pull request process and code review

Quick start: Fork → Branch → Code → Test → Pull Request

Security

Security is important to us. Please see SECURITY.md for:

• Reporting security vulnerabilities
• Security best practices for users
• API key and data protection guidelines
• Incident response procedures