Skip to main content
Every Aquila user gets an out-of-band endpoint: a wildcard hostname that records DNS lookups, HTTP and HTTPS requests, and SMTP mail. Point blind payloads at it, and Aquila tells you when something calls home.

​
Your endpoint

GET /api/oob/endpoint returns your hostname and identifier:
The endpoint lives under the bhunt.win domain. Aquila provisions it at sign-up. You never create one yourself.

​
How recording works

  • The hostname is a catch-all. Any subdomain under it resolves.
  • A hit on the bare hostname answers with a banner and is not recorded.
  • A hit on a labeled subdomain, such as poc1.q7x2m9.bhunt.win, is recorded. Put a label in every payload so each callback identifies itself.

​
Supported protocols

The endpoint records four protocols:
  • DNS — any query type (A, MX, TXT, and more) under your hostname.
  • HTTP — the full request: method, path, headers, and body.
  • HTTPS — the same requests over TLS.
  • SMTP — mail sent to your hostname: sender, recipient, and message.
Every hit records the protocol, the source IP, and the time.

​
Read interactions

GET /api/oob/interactions lists the recorded hits, newest first: HTTP hits carry the raw request and the response Aquila sent. Every hit carries the source IP and the time.

​
Clean up

  • DELETE /api/oob/interactions/{id} — delete one hit.
  • DELETE /api/oob/interactions?correlationId=... — delete a whole correlation group. Omit the parameter to delete all your hits.
The dashboard OOB page shows the same data with a live view.