Name

Purpose

check_domain

Is this domain/URL substring in the active phishunt feed?

list_brand_phishings

List active phishings targeting a brand (e.g. microsoft).

get_recent_detections

Delta sync: detections since an ISO date.

get_brand_metadata

Curated brand metadata (display name, category, AI characterisation, active count).

get_cert_metadata

Factual metadata for an abused TLS intermediate CA (operator, root, key type, siblings).

search_phishings

Free-text search across active phishing URLs/domains/IPs (min 3 chars).

analyze_url

Passive phishing-signal analysis of any URL/domain (URL-shape heuristics, stored score/verdict if known, historical detections). Unknown suspicious domains are auto-queued for full analysis.

get_related_infrastructure

Find infrastructure/content overlap for a known indicator (shared IP, cert, nameservers, favicon, etc.); surfaces the possible campaign / suspected cluster it belongs to.

get_campaigns

List possible campaigns / suspected clusters (shared-infrastructure groupings), optionally filtered by brand or active-only.

get_campaign

Full detail for one possible campaign / suspected cluster: evidence breakdown, every member indicator, export links.