Enterprise Dark Web APIs - FullHunt API Documentation

These routes require an Enterprise account with the Dark Web Monitoring module. They are limited to 60 requests per minute.

Endpoints

Dataset	Endpoint	Filter
Compromised credentials	`GET /enterprise/darkweb/compromised-credentials`	`query`, `page`
Discovered emails	`GET /enterprise/darkweb/discovered-emails`	`q`, `page`
Potential phishing	`GET /enterprise/darkweb/potential-phishing`	`q`, `page`, `from`, `to`
Typosquatting	`GET /enterprise/darkweb/typosquatting`	`q`, `page`, `from`, `to`

Date filters use DD/MM/YYYY. Potential phishing and typosquatting use q, not query.

Potential phishing

curl --get "https://fullhunt.io/api/v1/enterprise/darkweb/potential-phishing" \
  -H "X-API-KEY: $FULLHUNT_API_KEY" \
  --data-urlencode "q=example.com" \
  --data-urlencode "page=1"

Compromised credentials

curl --get "https://fullhunt.io/api/v1/enterprise/darkweb/compromised-credentials" \
  -H "X-API-KEY: $FULLHUNT_API_KEY" \
  --data-urlencode "query=@example.com" \
  --data-urlencode "page=1"

Response handling

Potential phishing pages can contain up to 1,000 records.
Typosquatting pages contain 10 records.
Preserve record IDs, source, first-seen, and last-seen values.
Treat domains as review candidates, not confirmed phishing.
Redact passwords and unrelated personal data before logging or ticketing.
Do not use exposed credentials to access another system.

See Monitor Brand Impersonation for domain candidates and Credential Response for privacy-reduced credential handling.