Free phishing feed

Formats and fields

The free phishing feed comes as JSON and RSS. Two kinds of domain, each confirmed by an independent second source: phishing domains from new TLS certificates in the certificate-transparency logs, and registered lookalikes of the brands we track. Each finding names its source and joins the feed 12 hours or more after we publish or flag it. This page describes every field.

JSON feed

GET https://domainspoof.org/feed.json

The response holds the findings published or flagged 12 to 36 hours ago, newest first; meta.window gives the span it covers. A source’s claim, its report page and a brand’s name join a finding once they have stood for 12 hours. It is open to any origin (CORS), and each request reads our current records. While the records update, the feed answers 503 with a Retry-After header.

meta

Field	Meaning
`generator`	"domainspoof.org"
`feed`	"phishing"
`description`	The feed in one sentence: its two kinds of domain, each confirmed by an independent second source.
`documentation`	This page.
`rss`	The RSS feed’s URL.
`delay_hours`	12. The least time between our first publication of a finding (a lookalike: its first independent flag) and its place in the feed. The free data files’ rules apply, so it can be longer (see the data files’ timing).
`window_hours`	24. The longest a finding stays in the feed: it leaves 36 hours after its first publication or flag.
`source`	"records": the records behind our free data files, delayed and checked as the files are. "snapshot": our hourly snapshot, a fallback we use for a while when the records cannot serve: findings first seen 12 to 24 hours ago, no first_published, and lookalikes only while their own object is current.
`note`	Present while the feed serves its snapshot fallback: what that means for the items.
`snapshot_at`	When we wrote the records this response comes from. Records more than six hours old are never served.
`generated_at`	When this response was built.
`window.from` `window.to`	The first-published times the items cover: the earliest item, and the time of the records the response uses (no later than the response) less delay_hours. window.from is null when the window is empty.
`count`	Items in this response.
`license`	The terms URL.
`credit`	The credit line to show with the data: "Data: BreachScout DomainSpoof (domainspoof.org)".
`credits`	The credit of each source the response’s findings cite, keyed by source or list id. Show it with that source’s findings.
`conditions.zone_file`	Present when an item comes from a registry zone file: where the zone-data conditions are. They travel with those items.
`real_time`	Where real-time findings appear on domainspoof.com.

items[]

Field	Meaning
`hostname`	The hostname the findings are about.
`first_observed`	When we first saw the hostname as a finding: the earliest of its findings (ISO 8601, UTC). For a lookalike, when it was first flagged.
`first_published`	When we first published a finding about the hostname (a lookalike: first flagged). Items are ordered by it, newest first. Absent while the snapshot fallback serves, which orders by first_observed.
`brands[]`	The brands the hostname names: id, name and url (the brand’s page on domainspoof.com). Empty when it names none of the brands we track.
`dns`	What our latest DNS check found, as the data files say it: "resolved" (an address), "no_address" (no address), "not_found" (the name does not exist, NXDOMAIN) or "unknown" (an inconclusive check, or none yet). For a lookalike alone, our lookalike sweep’s latest check. Reported hostnames publish on the report alone, so some show "no_address" or "not_found".
`dns_checked_at` `dns_since`	When the latest scheduled check ran. dns_since: resolving since (dns "resolved"), or not resolving since (the first of two answers without an address 20 hours or more apart), once that date is 12 hours old.
`resolved[]`	The addresses we hold for the hostname: the listed address an address finding rests on (an answer from the last 7 days), the answer at its latest DNS check, and listed addresses it resolved to earlier. It can hold addresses while dns reports a later check without one.
`resolved_at`	When the newest of those checks ran, where we hold its time.
`findings[]`	Every finding about the hostname, described below.
`url`	The hostname’s findings on domainspoof.com: its first brand’s page, else its row on /live.

items[].findings[]

Field	Meaning
`id`	The finding’s stable id: one per kind and hostname, the same id our public records use. Lookalikes have none.
`kind`	reported_domain, spamhaus_drop, phishing_infrastructure or lookalike (below).
`summary`	The finding in one line, naming its independent source.
`first_observed`	When we first saw this finding (ISO 8601, UTC).
`first_published`	When we first published it (a lookalike: first flagged). Its 12 hours count from here. Absent while the snapshot fallback serves.
`source` `source_name`	reported_domain: the source that reports or lists the hostname (ids below).
`under`	reported_domain: the listed domain the hostname sits under, when the source lists a parent domain.
`claim.brand` `claim.category`	reported_domain: the source’s own words, the brand it says is imitated and its category for the listing.
`source_url`	reported_domain: PhishTank’s or PhishDestroy’s own page for the report.
`address` `list` `list_name`	spamhaus_drop and phishing_infrastructure: the listed address the hostname resolved to in the last 7 days, and its list.
`of` `spelling`	lookalike: the official domain it spells, and how (homoglyph, idn, repetition, transposition, hyphen, omission, adjacent_key, insertion, replacement, tld or combo).
`found_by`	lookalike: dns_sweep (our DNS checks of lookalike spellings and of the brand name under other endings) or zone_file (the daily new registrations in registry zone files).
`listings[]`	lookalike: each independent source that flags it, with flagged_at, when we first saw that listing; each listing appears once its own delay has passed. kind "reported": a phishing report or list (source, source_name, host, under, claim). kind "address": it resolved to an address on a list (address, source, list_name).
`conditions`	lookalike found in a registry zone file: the URL of the zone-data conditions that come with it.

Kinds

kind	Meaning
`reported_domain`	A phishing report or list names the hostname, or a domain it sits under. PhishTank reports count once PhishTank has verified them.
`spamhaus_drop`	The hostname names a brand we track and resolved to an address on Spamhaus DROP.
`phishing_infrastructure`	The hostname names a brand we track and resolved to an address where reported phishing was found in the 48 hours before.
`lookalike`	A registered lookalike of a brand’s domain that an independent source flags: a phishing report or list names it or a name under it, or it resolved to an address on Spamhaus DROP or one where reported phishing was found.

Source ids

source	sourceName	The source
`phishtank`	PhishTank	Reports phishing
`phishdestroy`	PhishDestroy	Reports phishing
`cert_polska`	CERT Polska	Lists phishing or fraud sites
`metamask`	MetaMask	Lists phishing or fraud sites
`usom`	USOM	Lists phishing or fraud sites
`moda`	MODA	Lists phishing or fraud sites
`npa`	NPA 165	Lists phishing or fraud sites
`jpcert`	JPCERT/CC	Lists phishing or fraud sites
`amf`	AMF	Lists phishing or fraud sites
`fsma`	FSMA	Lists phishing or fraud sites
`bafin`	BaFin	Lists phishing or fraud sites

Example item

{
  "hostname": "paypal-secure-login.example",
  "first_observed": "2026-11-01T02:14:09.000Z",
  "brands": [
    {
      "id": "paypal",
      "name": "PayPal",
      "url": "https://domainspoof.com/brands/paypal"
    }
  ],
  "dns": "resolved",
  "resolved": [
    "198.51.100.7"
  ],
  "resolved_at": "2026-11-01T03:40:51.000Z",
  "findings": [
    {
      "id": "<finding id>",
      "kind": "reported_domain",
      "summary": "Listed by JPCERT/CC as imitating PayPal",
      "first_observed": "2026-11-01T02:14:09.000Z",
      "source": "jpcert",
      "source_name": "JPCERT/CC",
      "claim": {
        "brand": "PayPal"
      }
    },
    {
      "id": "<finding id>",
      "kind": "phishing_infrastructure",
      "summary": "Resolved to 198.51.100.7, where reported phishing was found in the 48 hours before",
      "first_observed": "2026-11-01T03:40:51.000Z",
      "address": "198.51.100.7",
      "list": "domainspoof_phish_hosts",
      "list_name": "DomainSpoof confirmed phishing hosts"
    }
  ],
  "url": "https://domainspoof.com/brands/paypal"
}

Corrections

Anyone can ask us to correct or remove an item through the corrections form. We review each request, and an accepted correction reaches the feed within minutes.

RSS feed

GET https://domainspoof.org/feed.xml

RSS 2.0 with the newest 500 findings in the window, one item per hostname.

title: the hostname, then the brands it names.
link: the hostname’s findings on domainspoof.com.
guid: the hostname and its first-seen time.
pubDate: when we first saw the hostname as a finding.
category: one per brand it names.
description: each finding’s summary, what our DNS check found, the zone-data conditions for a lookalike from a registry zone file, then the first-seen time.