Feeds

Data feeds

Machine-readable views of what the site shows, under the same publication rules: every row is a dated fact with its source named, never a verdict. Responses are JSON with Cache-Control: public, max-age=300 and open CORS.

Listed names

Hostnames whose resolved address was on an IP list approved for display, with the first and latest time the address was found there. Each row is a dated fact about an address, not a verdict about the name: listed addresses are mostly shared or compromised hosting, and a name on one may be unrelated, legitimate or registered defensively.

Endpoint

GET https://domainspoof.org/api/v1/feeds/listed-names (JSON; add ?format=ndjson for one row per line)

What a row is

One hostname × one address × one list: the name resolved to the address, and the address was on the named list between firstMatchedAt and lastMatchedAt. expiredAt is set (and the row kept) when the address left the list or the DNS observation aged past 14 days. Each row carries a statement sentence saying exactly this.

Three kinds of row

Generated spelling: a spelling DomainSpoof generated for an organization (typo, keyboard slip, look-alike character, other top-level domain) that resolves to a listed address. Certificate name: the registrable domain of a name in a public certificate-transparency log that carries an organization's brand token, resolving to a listed address; addresses shared by more than 25 such domains (parking, shared hosting) are left out, and certificate gives the matched token and the first and latest log times. Feed host: a host reported by an approved phishing feed with a published finding, resolving to a listed address; the row names the reporting sources with their attribution. All carry the organization (slug, name, link), the DNS status and check time of the name, and the mail records of its registrable domain when checked.

Lists

By default the feed covers “Confirmed phishing host address (DomainSpoof, 48 hours)” (list=domainspoof_phish_hosts, our own 48-hour list of confirmed phishing host addresses). list=all covers every list approved for display (named on the sources page); any other value selects one list by id. Lists appear only as membership facts with attribution and are never redistributed.

Ordering and paging

Rows are ordered by their latest change (expiry, else last match), newest first. Follow nextCursor (JSON) or the X-Next-Cursor / Link: rel="next" headers (NDJSON) until they are absent. limit is 100 by default, 500 at most.

Incremental pulls

since=<ISO 8601> returns only rows changed at or after that time: new matches, re-confirmed matches (every run re-stamps the rows still listed) and expiries. Keep the newest updatedAt you have seen and pass it back as since.

Filters

kind=generated_spelling|certificate_name|feed_host, state=active|expired.

How it is built

Our resolver answers A / AAAA for every tracked spelling every 20 minutes, for feed hosts every 5 minutes, and daily for certificate-log domains first seen in the last 7 days. After every list refresh (every 6 hours) and after the daily recompute of our own list, the collector tests every address observed in the last 14 days against each list’s latest validated snapshot and updates the log. Latest spelling run 2026-10-19 18:27 UTC (6 h ago): 110,465 resolving spellings, 40,653 addresses, 6,580 active rows.

Attribution

When you republish rows, name DomainSpoof (domainspoof.org) and the list each row cites; feed-host rows also carry their reporting source’s attribution text in feedHost.sources. Our own list is derived from PhishTank verified records and PhishDestroy Primary; the other lists’ publishers and licences are on the sources page.

Reading the rows

• A row means: this name resolved to this address, and the address was on the named list at the stated times. Nothing more.
• An IP listing alone cannot establish who controls the hostname or whether it hosts phishing; many listed addresses carry dozens of unrelated names.
• Generated spellings are names DomainSpoof looks for, not reports: a spelling that exists may be unrelated, legitimate or a defensive registration by the brand.
• Certificate names are registrable domains whose certificate in a public certificate-transparency log carries a brand token; a certificate is not a report, and the name may be unrelated or legitimate. Addresses shared by more than 25 such domains (parking, shared hosting) are left out.
• Feed hosts carry the attribution of the approved source that reported them; the report is the source's claim, dated separately.
• An expired row is history: the address left the list, or the DNS observation aged out of the 48-hour window. Expiry is not resolution.
• Lists are shown as membership facts with attribution; the lists themselves are never redistributed.

Example

curl 'https://domainspoof.org/api/v1/feeds/listed-names?since=2026-10-19T00:00:00Z&limit=2'

{
  "meta": "…",
  "query": {
    "list": "domainspoof_phish_hosts",
    "since": null,
    "limit": 10,
    "kind": "all",
    "state": "active"
  },
  "rows": [
    {
      "kind": "generated_spelling",
      "statement": "abmamro.nl (a generated spelling) resolved to 54.38.220.85, an address that was on \"Confirmed phishing host address (DomainSpoof, 48 hours)\" from 2026-10-19T16:18:18.404Z to 2026-10-19T18:26:37.519Z and was still on it at the latest check. This is a fact about the address, not a verdict about the name.",
      "hostname": "abmamro.nl",
      "organization": {
        "slug": "abn-amro",
        "displayName": "ABN AMRO"
      },
      "address": "54.38.220.85",
      "list": {
        "id": "domainspoof_phish_hosts",
        "name": "Confirmed phishing host address (DomainSpoof, 48 hours)",
        "category": "phishing_hosting"
      },
      "firstMatchedAt": "2026-10-19T16:18:18.404Z",
      "lastMatchedAt": "2026-10-19T18:26:37.519Z",
      "expiredAt": null,
      "expired": false,
      "updatedAt": "2026-10-19T18:26:37.519Z",
      "dns": {
        "status": "ok",
        "checkedAt": "2026-10-19T10:46:18.979Z"
      },
      "mail": {
        "hasMx": false,
        "provider": null
      },
      "spelling": {
        "kind": "adjacent_key",
        "generatedFrom": "abnamro.nl"
      },
      "feedHost": null
    },
    "…"
  ],
  "nextCursor": "…"
}

Certificate matches

Names identified in certificate logs that match a company or brand in our directory. A brand match does not indicate bad intent or malicious activity.

Endpoints

GET https://domainspoof.org/api/v1/certificates (JSON, cursor-paginated) and https://domainspoof.org/certificates/feed.xml (RSS). The certificates page describes the filters.

Per-organization API

Findings, generated spellings, official domains and mail facts per organization are under /api/v1/orgs/<slug>; every response’s meta links back here. See About for terms.