---
title: "Get related infrastructure for a domain"
method: GET
path: "/api/v1/domains/{uuid}/related"
---

# Get related infrastructure for a domain

`GET /api/v1/domains/{uuid}/related`

## Request

- Base URL: `https://phishunt.io`
- URL: `https://phishunt.io/api/v1/domains/{uuid}/related`
- Auth: none declared

Returns other indicators that share infrastructure or content signals with
the given uuid (same TLS certificate, same IP, same nameservers, similar
page content, etc.), computed by a daily correlation job. This surfaces
**related infrastructure**, not attribution: results describe observed
technical overlap between publicly detected phishing sites, never a claim
about who operates them.

`algorithm_version` is a correlation algorithm identifier; scores are not
comparable across versions. `cluster` is present (non-null) when the
indicator belongs to a possible campaign / suspected cluster of two or
more related indicators; null when unclustered.

Only high and medium confidence links are published. Low-confidence
links are kept internal and are never returned, not even with
`min_score=0`.

## Path parameters

- `uuid` string, uuid, required

## Query parameters

- `limit` integer
- `min_score` integer

## Response `200`

Related infrastructure for this uuid. `results` is an empty array (not a 404) when the uuid is known but has no published related indicators.

- RelatedResponse: Related-infrastructure lookup result for a single uuid. Describes observed technical overlap between publicly detected phishing sites; not an attribution claim.
  - `uuid` string, uuid
  - `domain` string
  - `algorithm_version` string, nullable: Correlation algorithm identifier; scores are not comparable across versions.
  - `generated_at` string, date-time, nullable: When the correlation sidecar was last rebuilt (daily job).
  - `cluster` object, nullable: Present when this indicator belongs to a possible campaign / suspected cluster. Null when unclustered. No numeric `id` here (unlike CampaignSummary/Campaign) - this object was never a permalink target in its own right, so there is no back-compat reason to carry the ephemeral per-rebuild cluster id at all; `key` is the only identifier.
    - `key` string: Stable campaign identifier; use this for permalinks.
    - `size` integer: Number of distinct registrable domains (Public Suffix List, private section included) in this cluster. Sibling subdomains of one domain count once; each platform tenant counts once.
    - `host_count` integer: Number of hostnames (members.length).
    - `url` string: Link to the /campaigns/{key}/ page for this cluster. Only present when the cluster is live and not the low-confidence "weak" tier (weak clusters have no public campaign page - see GET /api/v1/campaigns).
  - `count` integer: Number of items in `results` (published high/medium confidence links only, after `min_score` and `limit`).
  - `limit` integer
  - `results` RelatedIndicator[]
    - `uuid` string, uuid
    - `domain` string
    - `url` string, nullable: Null when the indicator has been pruned from the live dataset (retention, or an FP takedown) - it is still listed for completeness (see `status`).
    - `company` string: Targeted brand slug.
    - `status` 'active' | 'offline' | 'no longer tracked': 'active'/'offline' reflect a live Site row's own status; 'no longer tracked' means the uuid this edge points at no longer has a live Site row at all (retention, or an FP takedown) - distinct from 'offline', which still has one.
    - `first_seen` string, date-time, nullable: Null under the same condition as `url`.
    - `relationship_score` integer
    - `evidence` Evidence[]
      - `type` string: Stable evidence-signal identifier, e.g. `same_ip`, `cert_fingerprint_exact`, `same_registrar`.
      - `value` string, nullable: Display value for this signal (e.g. the shared IP, cert fingerprint, or registrar name).
      - `contributed` integer: Points this signal contributed toward `relationship_score`. Entries sum to the total.
    - `detail_url` string, nullable: Null under the same condition as `url`.
    - `service_range` ServiceRange: An IP address that sits inside an official IP range published by a provider (cloud, platform, mail sender, crawler). Context only, not a verdict: a hit says whose network the IP belongs to. It does not say that the indicator is safe or unsafe.
      - `best` ServiceRangeRecord
        - `prefix` string
        - `source` string
        - `provider` string
        - `service` string
        - `region` string
        - `kind` 'bot' | 'user_fetcher' | 'mail' | 'service' | 'platform' | 'hosting'
        - `direction` string
        - `kind_label` string
      - `also` ServiceRangeRecord[]: Up to 3 more ranges from other sources that contain the same IP.
        - `prefix` string
        - `source` string
        - `provider` string
        - `service` string
        - `region` string
        - `kind` 'bot' | 'user_fetcher' | 'mail' | 'service' | 'platform' | 'hosting'
        - `direction` string
        - `kind_label` string
      - `note` string

## Other responses

- `400`: Bad request - invalid `limit` or `min_score` (must be integers).
- `404`: Unknown uuid - not found in any of phishunt's datasets.
- `429`: Rate limited (more than 20 requests in 10 seconds from one IP). Retry after 10 seconds.

---

[API](https://skmtc.dev/phishunt/apis/phishunt-api.md) · [All operations](https://skmtc.dev/phishunt/apis/phishunt-api/llms.txt) · [OpenAPI document](https://skmtc.dev/phishunt/apis/phishunt-api/revisions/0e07c255f282?raw)