[PR #108] Add PhishStats API Enrichers for Phishing Intelligence #146

New Issue

GiteaMirror · 2026-04-11T08:43:38-05:00

GiteaMirror commented

2026-04-11 08:43:38 -05:00

📋 Pull Request Information

Original PR: https://github.com/reconurge/flowsint/pull/108
Author: @eschultze
Created: 1/19/2026
Status: 🔄 Open

Base: main ← Head: feature/add-phishstats-enrichers

📝 Commits (1)

c1a9647 feat: Add PhishStats API enrichers for phishing intelligence

📊 Changes

5 files changed (+1184 additions, -0 deletions)

View changed files

➕ flowsint-enrichers/src/flowsint_enrichers/domain/to_phishstats.py (+220 -0)
➕ flowsint-enrichers/src/flowsint_enrichers/ip/to_phishstats.py (+212 -0)
➕ flowsint-enrichers/src/flowsint_enrichers/phrase/to_phishstats.py (+268 -0)
➕ flowsint-enrichers/src/flowsint_enrichers/website/to_phishstats.py (+238 -0)
➕ flowsint-enrichers/src/tools/phishstats_client.py (+246 -0)

📄 Description

This PR integrates the PhishStats API into Flowsint, adding four new enrichers and a specialized API client to provide real-time phishing intelligence.

Key Changes:

New Enrichers:
- ip_to_phishstats / domain_to_phishstats / website_to_phishstats: Exact match lookups for high-precision intelligence.
- phrase_to_phishstats: A flexible search enricher that uses the Phrase type and LIKE operators to find matches in page titles and URLs.
Graph Intelligence:
- Findings are automatically mapped to standard Flowsint types: Website, Domain, Ip, ASN, and Organization.
- PhishStats-specific metadata (scores, safe browsing status, etc.) is stored as properties on the nodes.
Robust Client:
- Implements PhishStatsClient with automatic rate-limiting (20 req/min), timeouts (60s), and exponential backoff for retries.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/reconurge/flowsint/pull/108 **Author:** [@eschultze](https://github.com/eschultze) **Created:** 1/19/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `feature/add-phishstats-enrichers` --- ### 📝 Commits (1) - [`c1a9647`](https://github.com/reconurge/flowsint/commit/c1a964761aab66396889679f4c621f1a078486ce) feat: Add PhishStats API enrichers for phishing intelligence ### 📊 Changes **5 files changed** (+1184 additions, -0 deletions) <details> <summary>View changed files</summary> ➕ `flowsint-enrichers/src/flowsint_enrichers/domain/to_phishstats.py` (+220 -0) ➕ `flowsint-enrichers/src/flowsint_enrichers/ip/to_phishstats.py` (+212 -0) ➕ `flowsint-enrichers/src/flowsint_enrichers/phrase/to_phishstats.py` (+268 -0) ➕ `flowsint-enrichers/src/flowsint_enrichers/website/to_phishstats.py` (+238 -0) ➕ `flowsint-enrichers/src/tools/phishstats_client.py` (+246 -0) </details> ### 📄 Description This PR integrates the [PhishStats API](https://phishstats.info) into Flowsint, adding four new enrichers and a specialized API client to provide real-time phishing intelligence. ### Key Changes: * **New Enrichers:** * `ip_to_phishstats` / `domain_to_phishstats` / `website_to_phishstats`: Exact match lookups for high-precision intelligence. * `phrase_to_phishstats`: A flexible search enricher that uses the `Phrase` type and `LIKE` operators to find matches in page titles and URLs. * **Graph Intelligence:** * Findings are automatically mapped to standard Flowsint types: `Website`, `Domain`, `Ip`, `ASN`, and `Organization`. * PhishStats-specific metadata (scores, safe browsing status, etc.) is stored as properties on the nodes. * **Robust Client:** * Implements `PhishStatsClient` with automatic rate-limiting (20 req/min), timeouts (60s), and exponential backoff for retries. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-04-11 08:43:38 -05:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/flowsint#146