---
title: "Get Suspicious Clusters"
method: GET
path: "/v1/intelligence/clusters/suspicious"
tags: ["intelligence"]
---

# Get Suspicious Clusters

`GET /v1/intelligence/clusters/suspicious`

## Request

- Base URL: `https://api.bitpoort.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.bitpoort.com/v1/intelligence/clusters/suspicious`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Find clusters with suspicious behavioral patterns.

Cross-joins entity_clusters + intent_detections + whale_txs. A cluster
qualifies on actually-suspicious signals: wash-trading or
distribution-prep intents (7d window), or cluster risk_score >= 50.
Accumulation counts are returned as context but do not qualify a
cluster on their own. Ranked by suspicion (wash weighted over
distribution-prep), then risk score; member exit-volume to CEXes is
evidence/tiebreaker, not the ranking.

Definitional bound (documented, not a silent filter): clusters whose
own labels match known exchanges (Binance/Coinbase/... — see
queries.EXCHANGE_LABEL_RE) are excluded. An exchange's cluster always
trips member-intent heuristics by sheer size; it isn't "suspicious"
for being itself. Pre-fix this surface ranked Binance 15 and
Coinbase 44 (risk_score 0) as the top suspicious clusters.

## Query parameters

- `min_nodes` integer
- `limit` integer

## Response `200`

Successful Response

- object

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/bitpoort/apis/bitpoort-api.md) · [All operations](https://skmtc.dev/bitpoort/apis/bitpoort-api/llms.txt) · [OpenAPI document](https://skmtc.dev/bitpoort/apis/bitpoort-api/revisions/1a51d8566777?raw)