---
title: "Get domains"
method: GET
path: "/api/v1/domains"
---

# Get domains

`GET /api/v1/domains`

## Request

- Base URL: `https://phishunt.io`
- URL: `https://phishunt.io/api/v1/domains`
- Auth: none declared

Returns a list of active suspicious phishing domains with full enrichment data including IP geolocation, TLS certificate information, and detection verdicts from multiple threat intelligence sources.

Population: active detections minus parked domains (high confidence) and hostname-intent clones; PaaS-hosted kits (pages.dev, vercel.app, github.io...) are included.

## Query parameters

- `limit` integer
- `offset` integer
- `format` 'json' | 'csv' | 'txt'
- `company` string
- `since` string, date
- `contains` string
- `tier` 'all' | 'verified'
- `asn` string
- `org` string
- `registrar` string
- `cert` string
- `country` string
- `ip` string

## Response `200`

List of suspicious phishing domains.

- DomainsResponse
  - `count` integer: Number of results returned.
  - `total` integer: Total number of rows matching the applied filters, before `limit`/`offset` are applied. `count` is the size of this page and is always <= `total`.
  - `offset` integer: Current offset (for pagination).
  - `limit` integer: Current limit (for pagination).
  - `results` SiteWithServiceRange[]
    - `url` string: Full URL of the suspicious site.
    - `domain` string: Domain name including subdomains.
    - `company` string: Targeted brand identifier.
    - `date` string, date-time: Last check timestamp (ISO 8601).
    - `first_seen` string, date-time: When the site was first detected (ISO 8601).
    - `uuid` string, uuid: Unique identifier for this entry (UUID v4).
    - `ip` string: Resolved IPv4 address.
    - `country` string: Hosting country name.
    - `asn` string: Autonomous System Number.
    - `org` string: Hosting organization.
    - `cert` string: TLS certificate issuer.
    - `malicious_google` boolean: true if flagged by Google Safe Browsing. false is not a clean verdict: the source did not flag it when checked, or was never asked.
    - `malicious_openphish` boolean: true if present in OpenPhish feed. false is not a clean verdict: the source did not flag it when checked, or was never asked.
    - `malicious_phishtank` boolean: true if present in PhishTank feed. false is not a clean verdict: the source did not flag it when checked, or was never asked.
    - `malicious_tweetfeed` boolean: true if present in TweetFeed. false is not a clean verdict: the source did not flag it when checked, or was never asked.
    - `malicious_urlscan` boolean: true if flagged by urlscan.io. false is not a clean verdict: the source did not flag it when checked, or was never asked.
    - `score` integer: phishunt's own 0-100 detection score from its explainable 5-layer scoring engine (same number `known.record.phishunt_score` exposes on /api/v1/analyze). Same disclaimer as that endpoint's `risk_score`: "risk_score is a heuristic risk score, not a calibrated probability" - this field is that same heuristic score, not a probability of phishing.
    - `verdict` 'critical' | 'high' | 'medium' | 'low' | 'noise': Calibrated verdict tier `score` falls into (backend `analysis/scoring/weights.py` VERDICT_THRESHOLDS). Falls back to `noise` for rows scored before the verdict field existed.
    - `top_signals` object[]: Up to 5 highest-weighted signals behind `score`, sorted by points contributed (descending). Empty when the row predates the detector version that records per-signal point breakdowns, or when stored signal data is missing/malformed - never omitted, never a source of a 500.
      - `signal` string: Stable feature identifier, e.g. `kw_score_norm`, `combosquat`.
      - `label` string: Human-readable label for `signal`.
      - `points` number: Points this signal contributed to `score`.
    - `sans_score` integer, nullable: SANS ISC DShield heuristic score (0..N) for the apex domain at insertion time. Sourced from the SANS recent-domains feed (passive-DNS first-seen). Null when the apex was not in the SANS feed of the day of insertion. Data consumed under CC BY-NC-SA 4.0 with attribution to SANS Internet Storm Center / DShield.
    - `sans_scorereason` string, nullable: Textual reason string from SANS explaining the score, e.g. "Excessive hyphens: 5 (+4)|High entropy: 3.87 (+1.85)|Contains suspicious keyword: deal (+20)". Pipe-separated signals.
    - `service_range` ServiceRange: An IP address that sits inside an official IP range published by a provider (cloud, platform, mail sender, crawler). Context only, not a verdict: a hit says whose network the IP belongs to. It does not say that the indicator is safe or unsafe.
      - `best` ServiceRangeRecord
        - `prefix` string
        - `source` string
        - `provider` string
        - `service` string
        - `region` string
        - `kind` 'bot' | 'user_fetcher' | 'mail' | 'service' | 'platform' | 'hosting'
        - `direction` string
        - `kind_label` string
      - `also` ServiceRangeRecord[]: Up to 3 more ranges from other sources that contain the same IP.
        - `prefix` string
        - `source` string
        - `provider` string
        - `service` string
        - `region` string
        - `kind` 'bot' | 'user_fetcher' | 'mail' | 'service' | 'platform' | 'hosting'
        - `direction` string
        - `kind_label` string
      - `note` string

## Other responses

- `400`: Bad request — invalid parameter value.
- `429`: Rate limited (more than 20 requests in 10 seconds from one IP). Retry after 10 seconds.

---

[API](https://skmtc.dev/phishunt/apis/phishunt-api.md) · [All operations](https://skmtc.dev/phishunt/apis/phishunt-api/llms.txt) · [OpenAPI document](https://skmtc.dev/phishunt/apis/phishunt-api/revisions/0e07c255f282?raw)