Get related infrastructure for a domain

Returns other indicators that share infrastructure or content signals with the given uuid (same TLS certificate, same IP, same nameservers, similar page content, etc.), computed by a daily correlation job. This surfaces related infrastructure, not attribution: results describe observed technical overlap between publicly detected phishing sites, never a claim about who operates them.

algorithm_version is a correlation algorithm identifier; scores are not comparable across versions. cluster is present (non-null) when the indicator belongs to a possible campaign / suspected cluster of two or more related indicators; null when unclustered.

Only high and medium confidence links are published. Low-confidence links are kept internal and are never returned, not even with min_score=0.

get/api/v1/domains/{uuid}/related

Request

  • Base URL: https://phishunt.io
  • URL: https://phishunt.io/api/v1/domains/{uuid}/related
  • Auth: none declared

Path parameters

uuidstring uuid required

UUID of the indicator to look up (see the uuid field on /api/v1/domains results).

Query parameters

limitinteger

Maximum number of related indicators to return.

min_scoreinteger

Only return indicators with a relationship score at or above this value. Applied on top of the published links (high and medium confidence only), so 0 does not return low-confidence links.

Response

Related infrastructure for this uuid. results is an empty array (not a 404) when the uuid is known but has no published related indicators.

uuidstring uuid
domainstring
algorithm_versionstring nullable

Correlation algorithm identifier; scores are not comparable across versions.

generated_atstring date-time nullable

When the correlation sidecar was last rebuilt (daily job).

countinteger

Number of items in results (published high/medium confidence links only, after min_score and limit).

limitinteger

Example response

{
  "results": [
    {
      "service_range": {
        "best": {
          "prefix": "3.104.0.0/14",
          "source": "aws",
          "provider": "AWS",
          "service": "EC2",
          "region": "ap-southeast-2",
          "direction": "both",
          "kind_label": "rentable cloud hosting"
        },
        "also": [
          {
            "prefix": "3.104.0.0/14",
            "source": "aws",
            "provider": "AWS",
            "service": "EC2",
            "region": "ap-southeast-2",
            "direction": "both",
            "kind_label": "rentable cloud hosting"
          }
        ],
        "note": "Official provider IP range of this IP. Context only, not a verdict."
      }
    }
  ]
}

Changes

No recorded changes to this operation across all 1 revision of this API.