List possible campaigns / suspected clusters

Lists live correlation clusters - groups of indicators that share infrastructure or content signals (same TLS certificate, IP, hosting, page content, etc.), computed by the same daily correlation job as /api/v1/domains/{uuid}/related. This is a shared-infrastructure grouping of public detections, not an attribution claim - clusters are labeled "possible campaign" or "suspected cluster" only, never an actor or group.

Low-confidence ("weak") clusters are never surfaced through this endpoint or the /campaigns/ pages.

total (distinct from count) is the number of clusters matching the filters BEFORE limit/offset - page through all of them by incrementing offset until offset + count >= total.

get/api/v1/campaigns

Request

  • Base URL: https://phishunt.io
  • URL: https://phishunt.io/api/v1/campaigns
  • Auth: none declared

Query parameters

limitinteger

Number of results to return.

offsetinteger

Number of results to skip (for pagination).

brandstring

Filter to clusters with at least one member targeting this brand slug.

status'active' | 'all'

active returns only clusters with at least one currently-active member.

min_sizeinteger

Only return clusters with at least this many distinct registrable domains.

Response

List of possible campaigns / suspected clusters.

countinteger

Number of results returned (after limit/offset/filters).

totalinteger

Total number of clusters matching brand/status/min_size, before limit/offset are applied - i.e. how many results paging through with offset would eventually return. count is always <= total.

offsetinteger
limitinteger
algorithm_versionstring nullable

Correlation algorithm identifier; scores/clusters are not comparable across versions.

generated_atstring date-time nullable

When the correlation sidecar was last rebuilt (daily job).

data_status'ok' | 'stale' | 'missing'

Freshness of the correlation sidecar backing this response. 'ok' is the normal case; 'stale' means the last reload fell back to a cached snapshot, or the snapshot is older than the daily rebuild's expected cadence; 'missing' means no snapshot has ever loaded. Lets a client distinguish "genuinely zero live campaigns" from "the nightly rebuild didn't run" - an empty results array alone cannot.

Changes

No recorded changes to this operation across all 1 revision of this API.