Sources
Sources and coverage
We show only fields each source permits. Counts cover the latest validated snapshot. Unapproved sources have collection details withheld.
PhishDestroy Primary (content-verified) Display permitted
- Publisher
- PhishDestroy
- Record type
- Domains only
- License
- MIT
- Attribution
- Curated phishing domains from PhishDestroy (phishdestroy.io), content-verified subset, MIT licensed. Copyright (c) PhishDestroy.
- Poll interval
- every 120 minutes
- Last validated snapshot
- 2026-10-19 00:07 UTC (19 min ago)
- Latest collector state
- validated
- Records in latest snapshot
- 78,857 (78,857 present after normalization)
PhishTank verified online phishes Display permitted
- Publisher
- PhishTank (Cisco Talos / OpenDNS)
- Record type
- Exact URLs (with target labels)
- License
- PhishTank terms (commercial API use permitted)
- Attribution
- Phishing report data from PhishTank (phishtank.org). Keyless access, 25 requests per rolling 3 days.
- Poll interval
- every 120 minutes
- Last validated snapshot
- 2026-10-18 23:32 UTC (54 min ago)
- Latest collector state
- validated
- Records in latest snapshot
- 60,849 (60,849 present after normalization)
- Keyless request budget
- Request budget unavailable (no recent successful fetch reported it)
Other sources reviewed
- CINS Army and Emerging Threats compromised IPs: collected for IP checks; public use awaits permission review.
- Phishunt: CC0 aggregate feed, usable as leads. Entries require independent confirmation.
- OpenPhish, URLhaus, PhishStats, Phishing.Database: deferred or excluded because of licensing or scope.
What the dates mean
- Source reported: source-supplied time, such as PhishTank submission or verification.
- Observed in feed: our last successful snapshot containing the record, used when no source date exists.
- First observed by DomainSpoof: our first collection of the record; the incident and registration dates remain unknown.
- Absent from latest snapshot: missing from that file. Removal does not confirm resolution or safety.