---
name: list-campaigns
type: instructions
description: List possible campaigns / suspected clusters of phishing indicators that share infrastructure or content signals.
---

# List possible campaigns

## Purpose
Retrieve groups of phishing indicators that share infrastructure or content signals
(same TLS certificate, IP, hosting, page content, etc.), computed by a daily
correlation job. This is shared-infrastructure grouping of public detections, **not
an attribution claim** - clusters are labeled "possible campaign" or "suspected
cluster" only, never an actor or group name.

## Endpoint
```
GET https://phishunt.io/api/v1/campaigns?limit=<n>&offset=<n>&brand=<slug>&status=active|all&min_size=<n>
```

## Parameters
- `limit` - 1-200 (default 50).
- `offset` - 0-10000 (default 0).
- `brand` - optional brand slug filter (member companies).
- `status` - `active` (at least one currently-active member) or `all` (default `all`).
- `min_size` - minimum cluster size (default 0).

## Example
```bash
curl -sf 'https://phishunt.io/api/v1/campaigns?status=active&limit=10' | jq '.results[] | {key, size, brands, confidence}'
```

## Related
- Full detail on one campaign: use `campaign-detail` with the `key` from a result row.
- Human-readable index: `https://phishunt.io/campaigns/`