Get WHOIS/RDAP and IP enrichment for a detection

Server-side WHOIS/RDAP and IP-geolocation lookup for a single stored detection, keyed by its uuid. Looks the uuid up across all three of phishunt's datasets (active, prior detections, new-registration), then fetches RDAP for the domain's apex and ipinfo.io for its IP. Cached 24h - the RDAP/ipinfo answer for a given domain/IP rarely changes within a day, and this keeps phishunt's own ipinfo token budget bounded. Powers the WHOIS/geolocation card on phishunt's URL detail pages; no MCP tool wraps it yet.

get/api/v1/enrich/{uuid}/

Request

  • Base URL: https://phishunt.io
  • URL: https://phishunt.io/api/v1/enrich/{uuid}/
  • Auth: none declared

Path parameters

uuidstring uuid required

UUID of the indicator to look up (see the uuid field on /api/v1/domains results).

Response

WHOIS/RDAP and IP enrichment for this uuid's domain and IP. Either sub-object may carry only error instead of its normal fields when the underlying lookup failed.

Changes

No recorded changes to this operation across all 1 revision of this API.