---
name: related-infrastructure
type: instructions
description: Find infrastructure and content overlap between a known phishing indicator and other phishunt detections (shared IP, cert, nameservers, favicon, redirect, naming pattern).
---

# Find related infrastructure

## Purpose
Given a domain or URL already present in the phishunt feed, surface other detections
that share technical infrastructure or content signals with it - shared IP, TLS
certificate, nameservers, favicon/screenshot hash, redirect target, or naming
pattern. This is observed technical overlap, **not an attribution claim** about who
operates the sites - treat it as a lead pointing at a possible campaign or cluster.

## Endpoint
```
GET https://phishunt.io/api/v1/domains/<uuid>/related?limit=<n>&min_score=<n>
```

## Parameters
- `<uuid>` - the site's phishunt uuid (path parameter). Resolve it first via
  `lookup-brand`, `check-recent`, or `search-phishings`.
- `limit` - 1-50 (default 10).
- `min_score` - 0-100 (default 0); filter out low-confidence edges.

## Example
```bash
curl -sf 'https://phishunt.io/api/v1/domains/<uuid>/related?limit=10' | jq '.results[] | {url, company, evidence}'
```

## Errors
- HTTP 404 with `{"error": "Unknown uuid", ...}` if the uuid is not known across any dataset.
- 200 with `count: 0`, `results: []` if the uuid is known but has no live related edges (distinct from 404).
- HTTP 400 with `{"error": "..."}` for a non-numeric `limit`/`min_score`.