Free phishing feed

Terms and attribution

The free phishing feed is free for non-commercial use with credit. Commercial redistribution needs our agreement.

Licence

• You may copy, use and share the feed for non-commercial purposes.
• Credit BreachScout DomainSpoof (domainspoof.org) wherever you show or share the data.
• Commercial redistribution, including in a paid product or service, needs a written agreement with us.

This licence covers our findings and the fields we add. Material from each source stays under that source’s own terms, listed below.

For commercial use or real-time access, contact us.

Credit line

Data: BreachScout DomainSpoof (domainspoof.org)

Show each source’s own credit with the findings it reported or listed.

Where the hostnames come from

Certificate findings come from TLS certificates in the public certificate-transparency logs. Registered lookalikes come from our DNS checks of lookalike spellings and from registry zone files.

Independent sources and their credit lines

We publish a hostname when one of these sources flags it. Each finding names the source.

Lookalikes from registry zone files

Some registered lookalikes in the feed come from registry zone files we receive through ICANN’s Centralized Zone Data Service (CZDS). Each one shows a domain we matched to a brand, flagged by an independent source. Their findings say found_by: "zone_file".

You may use these items lawfully, for defensive security, research and journalism. You may not use them, or allow, enable or support anyone else’s use of them, for:

• any marketing purpose, including marketing, advertising or solicitations in any medium (email, phone, fax, post, SMS, wireless alerts) and building marketing or prospect lists;
• high-volume automated processes that send queries or data to the systems of a registry operator or an ICANN-accredited registrar;
• harassing, annoying, interrupting, disrupting or interfering with a registrant or a registrant’s normal business operations;
• collecting or extracting a substantial portion of these items.

These conditions carry over the registry operators’ zone file terms. If you pass these items on, pass these conditions on with them.

Using the data

Each report or listing is its source’s claim about a hostname. We match the hostname to the brands it names. Check a finding before you block a domain or contact anyone about it.

Corrections

Suggest a correction on domainspoof.com. We review every request and date each change.

Website terms

The domainspoof.com terms and privacy notice cover the website.