Guides

Domain Enrichment API

Suggest Edits

🚧

BETA release

The Domain Enrichment API is currently in beta. If you have any questions or feedback, please reach out to us.

.Get infrastructure and risk context for a domain or hostname in a single call — IPs, TLS certificates, JARM, open ports/protocols, HTTP artifacts, phishing sightings, and more

Endpoint

GET https://api.hunt.io/v1/enrich/domain/{domain}

Path params

  • domain — Required. Domain or hostname (e.g., framer.app).

Headers

  • token: <your-api-key>

Notes

  • All timestamps are ISO-8601 (UTC).
  • Arrays may be empty; fields may be omitted when unknown.

Quick start

cURL

curl --request GET   --url 'https://api.hunt.io/v1/enrich/domain/framer.app'   --header 'accept: application/json'   --header 'token: <your-api-key>'

Python (requests)

import requests

resp = requests.get(
    "https://api.hunt.io/v1/enrich/domain/framer.app",
    headers={"accept": "application/json", "token": "<your-api-key>"},
    timeout=60,
)
resp.raise_for_status()
print(resp.json())

JavaScript (fetch)

const resp = await fetch("https://api.hunt.io/v1/enrich/domain/framer.app", {
  headers: { accept: "application/json", token: "<your-api-key>" },
});
const data = await resp.json();
console.log(data);

Top-level response shape

{
  "ips": ["<ip>", "..."],
  "certificates": [{ /* certificate object */ }],
  "malware": [{ /* malware object */ }],
  "jarm": [{ /* jarm object */ }],
  "protocol": [{ /* protocol observation */ }],
  "http": [{ /* http observation */ }],
  "ssh": [{ /* ssh observation */ }],
  "opendir": [{ /* open directory sighting */ }],
  "honeypot": [{ /* honeypot interaction */ }],
  "phishing": [{ /* phishing page sighting */ }]
}

Field reference

ips (array of strings)

FieldDescription
ips[]Observed IPv4/IPv6 addresses associated with the input name (A/AAAA, service telemetry).

certificates (array of objects)

FieldDescription
HashHexedSha256, HashHexedSha1, HashHexedMd5Certificate byte hashes.
UUIDHexedInternal certificate identifier.
JA4XJA4X certificate fingerprint.
SeenFirst, SeenLastFirst/last time this cert was observed for related infra.
SerialCertificate serial number.
NotBefore, NotAfterValidity window.
SubjectCommonNameSubject CN (e.g., *.example.com).
SubjectCountry, SubjectOrganization, SubjectOrganizationalUnit, SubjectLocality, SubjectProvince, SubjectStreetAddress, SubjectPostalCode, SubjectSubjectSerialNumberSubject details (often empty for DV).
IssuerCommonName, IssuerCountry, IssuerOrganization, IssuerOrganizationalUnit, IssuerLocality, IssuerProvince, IssuerStreetAddress, IssuerPostalCode, IssuerSubjectSerialNumberIssuer details.
PolicyIdentifiersComma-delimited OIDs string (e.g., ,2.23.140.1.2.1,).
SignatureAlgorithme.g., ECDSA-SHA384.
PrivateKey_BitLength, PrivateKey_TypePublic key size and algorithm (e.g., 256, ECDSA).
KeyUsageKey usage as text.
ExtKeyUsageSerialized JSON array string (e.g., ["ServerAuth","ClientAuth"]).
DNSNames, EmailAddresses, IPAddresses, URIsSAN entries.
IssuingCertificateURLAIA issuing CA URL(s).
IsCA, MaxPathLen, MaxPathLenZeroCA attributes.
OCSPServerOCSP responder URL(s).
HostnamesComma-delimited hostnames captured with this cert (e.g., ,*.example.com,).

jarm (array of objects)

FieldDescription
ScanIPIP where the JARM was captured.
ScanPortPort used for the JARM handshake.
JARM62-char JARM fingerprint string.
SeenFirst, SeenLastFirst/last seen for that IP:port.

protocol (array of objects)

FieldDescription
IP, PortEndpoint observed.
Fingerprint[]Primary matched protocol label(s) (e.g., http, tls, unknown).
SeenFirst, SeenLastFirst/last time the protocol was observed.
AllFingerprints[]Full set of labels matched over time (e.g., ["unknown","tls","tcpwrapped"]).

http (array of objects)

FieldDescription
IP, PortHTTP endpoint.
SeenFirst, SeenLastFirst/last observation.
BodySHA256Hash of response body (content fingerprint).
HeaderRawRaw response headers (may be empty).

ssh (array of objects; when present)

FieldDescription
IP, PortSSH endpoint.
SeenFirst, SeenLastFirst/last observation.
KeysComma-separated SSH public key hashes (when available).

opendir (array of objects; when present)

FieldDescription
IPIP where an open directory was observed.
HostnameURL including scheme and port.
SeenFirst, SeenLastFirst/last sighting.

honeypot (array of objects; when present)

FieldDescription
Ports[]Ports involved in honeypot activity.
Tags[]Activity tags (e.g., crawler, scanner, exploit).
ActorLinked threat actor ID (if any).
SeenFirst, SeenLastFirst/last sighting.

phishing (array of objects)

FieldDescription
URLPhishing page URL associated with related infra.
SeenFirst, SeenLastFirst/last sighting time.
StatusHTTP status code at crawl time.
TitlePage title captured.
MatchedSignatures[]Matched Hunt signatures/heuristics (e.g., inline-navigator-regex, default-framer-title).

Example response (trimmed)

Example generated for the framer.app domain

{
  "ips": ["52.223.52.2"],
  "certificates": [
    {
      "HashHexedSha256": "39E1FF225B37B29CB2D1179AEE6FB580007D18D58A4AD2BD68A2B425B5A4C1F4",
      "UUIDHexed": "0DA34546B05715F874500B3670A3799F197B3E3ED1F35789B995D4F19B216E74",
      "HashHexedSha1": "D6D544217DEA810B6F8162DA38B47202988E1F43",
      "HashHexedMd5": "736227C1E684D8226D0FCE02357B2418",
      "JA4X": "a373a9f83c6b_7022c563de38_2e3757343cb0",
      "SeenFirst": "2025-06-11T23:45:32",
      "SeenLast": "2025-08-10T23:03:18",
      "Serial": "481689352709894488851110697852654079886406",
      "NotBefore": "2025-06-11T22:03:53",
      "NotAfter": "2025-09-09T22:03:52",
      "SubjectCommonName": "*.framer.app",
      "IssuerCommonName": "E6",
      "IssuerCountry": ["US"],
      "IssuerOrganization": ["Let's Encrypt"],
      "DNSNames": ["*.framer.app"]
    }
  ],
  "jarm": [
    {
      "ScanIP": "52.223.52.2",
      "ScanPort": 443,
      "JARM": "00000000000000000000000000000000000000000000000000000000000000",
      "SeenFirst": "2023-09-30T05:40:49",
      "SeenLast": "2025-08-28T02:03:30"
    }
  ],
  "protocol": [
    { "IP": "52.223.52.2", "Port": 443, "Fingerprint": ["tls"],  "SeenFirst": "2023-09-12T04:08:28", "SeenLast": "2025-08-24T09:32:34", "AllFingerprints": ["unknown","tls","tcpwrapped"] },
    { "IP": "52.223.52.2", "Port": 80,  "Fingerprint": ["http"], "SeenFirst": "2023-09-12T08:16:44", "SeenLast": "2025-08-24T06:31:52", "AllFingerprints": ["unknown","http","tcpwrapped"] }
  ],
  "http": [
    {
      "IP": "52.223.52.2",
      "Port": 443,
      "SeenFirst": "2024-05-09T17:05:49",
      "SeenLast": "2025-08-27T10:23:33",
      "BodySHA256": "7A1FABF227903297428F36DA3B3547D91E308A992063271E8FE1A4F1E1E6CD26",
      "HeaderRaw": ""
    }
  ],
  "phishing": [
    {
      "URL": "https://violet-track-966474.framer.app/page",
      "SeenFirst": "2025-05-15T21:18:20",
      "SeenLast": "2025-05-15T21:18:20",
      "Status": 200,
      "Title": "My Framer Site",
      "MatchedSignatures": ["inline-navigator-regex", "default-framer-title"]
    }
  ],
  "malware": [],
  "ssh": [],
  "opendir": [],
  "honeypot": []
}

Status codes

CodeMeaning
200Success — JSON payload returned.
400Bad request (e.g., malformed domain).
401Unauthorized (missing/invalid token).
404No enrichment found for the domain/host.
429Rate limited — back off and retry later.
500Server error.

Best practices

  • Filter by recency: Use SeenLast to prioritize active infrastructure.
  • Pivot consistently: The component shapes mirror IP Enrichment, so you can pivot by IP → Domain or Domain → IP with identical handling.
  • Handle large arrays: protocol and phishing may be large; paginate or filter client-side by date/port/signature.

Updated 7 days ago