This PR integrates the PhishStats API into Flowsint, adding four new enrichers and a specialized API client to provide real-time phishing intelligence.
Key Changes:
New Enrichers:
ip_to_phishstats / domain_to_phishstats / website_to_phishstats: Exact match lookups for high-precision intelligence.
phrase_to_phishstats: A flexible search enricher that uses the Phrase type and LIKE operators to find matches in page titles and URLs.
Graph Intelligence:
Findings are automatically mapped to standard Flowsint types: Website, Domain, Ip, ASN, and Organization.
PhishStats-specific metadata (scores, safe browsing status, etc.) is stored as properties on the nodes.
Robust Client:
Implements PhishStatsClient with automatic rate-limiting (20 req/min), timeouts (60s), and exponential backoff for retries.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/reconurge/flowsint/pull/108
**Author:** [@eschultze](https://github.com/eschultze)
**Created:** 1/19/2026
**Status:** 🔄 Open
**Base:** `main` ← **Head:** `feature/add-phishstats-enrichers`
---
### 📝 Commits (1)
- [`c1a9647`](https://github.com/reconurge/flowsint/commit/c1a964761aab66396889679f4c621f1a078486ce) feat: Add PhishStats API enrichers for phishing intelligence
### 📊 Changes
**5 files changed** (+1184 additions, -0 deletions)
<details>
<summary>View changed files</summary>
➕ `flowsint-enrichers/src/flowsint_enrichers/domain/to_phishstats.py` (+220 -0)
➕ `flowsint-enrichers/src/flowsint_enrichers/ip/to_phishstats.py` (+212 -0)
➕ `flowsint-enrichers/src/flowsint_enrichers/phrase/to_phishstats.py` (+268 -0)
➕ `flowsint-enrichers/src/flowsint_enrichers/website/to_phishstats.py` (+238 -0)
➕ `flowsint-enrichers/src/tools/phishstats_client.py` (+246 -0)
</details>
### 📄 Description
This PR integrates the [PhishStats API](https://phishstats.info) into Flowsint, adding four new enrichers and a specialized API client to provide real-time phishing intelligence.
### Key Changes:
* **New Enrichers:**
* `ip_to_phishstats` / `domain_to_phishstats` / `website_to_phishstats`: Exact match lookups for high-precision intelligence.
* `phrase_to_phishstats`: A flexible search enricher that uses the `Phrase` type and `LIKE` operators to find matches in page titles and URLs.
* **Graph Intelligence:**
* Findings are automatically mapped to standard Flowsint types: `Website`, `Domain`, `Ip`, `ASN`, and `Organization`.
* PhishStats-specific metadata (scores, safe browsing status, etc.) is stored as properties on the nodes.
* **Robust Client:**
* Implements `PhishStatsClient` with automatic rate-limiting (20 req/min), timeouts (60s), and exponential backoff for retries.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/reconurge/flowsint/pull/108
Author: @eschultze
Created: 1/19/2026
Status: 🔄 Open
Base:
main← Head:feature/add-phishstats-enrichers📝 Commits (1)
c1a9647feat: Add PhishStats API enrichers for phishing intelligence📊 Changes
5 files changed (+1184 additions, -0 deletions)
View changed files
➕
flowsint-enrichers/src/flowsint_enrichers/domain/to_phishstats.py(+220 -0)➕
flowsint-enrichers/src/flowsint_enrichers/ip/to_phishstats.py(+212 -0)➕
flowsint-enrichers/src/flowsint_enrichers/phrase/to_phishstats.py(+268 -0)➕
flowsint-enrichers/src/flowsint_enrichers/website/to_phishstats.py(+238 -0)➕
flowsint-enrichers/src/tools/phishstats_client.py(+246 -0)📄 Description
This PR integrates the PhishStats API into Flowsint, adding four new enrichers and a specialized API client to provide real-time phishing intelligence.
Key Changes:
ip_to_phishstats/domain_to_phishstats/website_to_phishstats: Exact match lookups for high-precision intelligence.phrase_to_phishstats: A flexible search enricher that uses thePhrasetype andLIKEoperators to find matches in page titles and URLs.Website,Domain,Ip,ASN, andOrganization.PhishStatsClientwith automatic rate-limiting (20 req/min), timeouts (60s), and exponential backoff for retries.🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.