Get domains

Returns a list of active suspicious phishing domains with full enrichment data including IP geolocation, TLS certificate information, and detection verdicts from multiple threat intelligence sources.

Population: active detections minus parked domains (high confidence) and hostname-intent clones; PaaS-hosted kits (pages.dev, vercel.app, github.io...) are included.

get/api/v1/domains

Request

  • Base URL: https://phishunt.io
  • URL: https://phishunt.io/api/v1/domains
  • Auth: none declared

Query parameters

limitinteger

Number of results to return. Omit to get all current results.

offsetinteger

Number of results to skip (for pagination).

format'json' | 'csv' | 'txt'

Response format.

companystring

Filter by targeted brand (e.g. amazon, paypal, microsoft).

sincestring date
Example:2026-03-01

Only return entries detected after this date.

containsstring

Case-insensitive substring match on the stored URL (host and path). 3-80 chars of letters, digits, -, ., _; other characters are stripped before validation. An unsupported length returns 400. search and q are accepted as aliases of contains (compatibility; contains wins when several are sent).

tier'all' | 'verified'

Liveness/verification tier to filter on. all (default) is today's behavior: every active row (status != 0). verified narrows to rows phishunt has independently confirmed - a usable screenshot capture, or a positive urlscan.io verdict. There is deliberately no dns-active tier: the stored status field collapses "DNS never resolved" and "DNS resolved but the fetch errored/timed out/4xx-5xx'd" into the same value, so a DNS-only tier isn't derivable from stored data without inventing a signal that isn't actually there. An unsupported value (including dns-active) returns 400.

asnstring

Exact-match pivot on the asn field, digits with an optional AS prefix accepted (e.g. 15169 or AS15169). Combines with AND with the other filters.

orgstring

Exact-match pivot on the org field, value as returned by this endpoint. Combines with AND with the other filters.

registrarstring

Exact-match pivot on the registrar field, value as returned by this endpoint. Combines with AND with the other filters.

certstring

Exact-match pivot on the cert field (certificate issuer string, as returned by this endpoint). Combines with AND with the other filters.

countrystring

Exact-match pivot on the country field, full country name as returned by this endpoint (e.g. Germany). Combines with AND with the other filters.

ipstring

Exact-match pivot on the ip field, IPv4 string, exactly as returned by this endpoint. Combines with AND with the other filters.

Response

List of suspicious phishing domains.

countinteger

Number of results returned.

totalinteger

Total number of rows matching the applied filters, before limit/offset are applied. count is the size of this page and is always <= total.

offsetinteger

Current offset (for pagination).

limitinteger

Current limit (for pagination).

Example response

{
  "results": [
    {
      "service_range": {
        "best": {
          "prefix": "3.104.0.0/14",
          "source": "aws",
          "provider": "AWS",
          "service": "EC2",
          "region": "ap-southeast-2",
          "direction": "both",
          "kind_label": "rentable cloud hosting"
        },
        "also": [
          {
            "prefix": "3.104.0.0/14",
            "source": "aws",
            "provider": "AWS",
            "service": "EC2",
            "region": "ap-southeast-2",
            "direction": "both",
            "kind_label": "rentable cloud hosting"
          }
        ],
        "note": "Official provider IP range of this IP. Context only, not a verdict."
      }
    }
  ]
}

Changes

No recorded changes to this operation across all 1 revision of this API.