Phishing database and feed, since 2014

Phishing intelligence for defenders

Search verified phishing URLs, IPs, domains and threat scores. Real-time feed and REST API, free since 2014.

Search databaseAPI documentation
phishing URLs on record
6M+phishing URLs on record
between feed updates
90 minbetween feed updates
API requests served monthly
40M+API requests served monthly
research papers citing the data
30+research papers citing the data

Latest entries

Open the database
URLCCScore
hxxps://prezo[.]ai/public/btee-voice-page--bbc6e9c2-fc8b-473e-8024-3ab9d439acc2–
n/a
hxxps://skinsmonkey[.]com?referrer=pid%3D1%26af_tranid%3DMTY4NTk1NDg4NzQ4MDk1NzIxMzk%3D–
n/a
hxxps://yandex[.]ru/showcaptcha?cc=1&form-fb-hint=2[.]1[.]7f62d54a481cee3dfeeab3b9211e0b94839aa8cf94166c1dfe8acfd10589666d6aab5a93e75771e54c8229caf2a532fa7a04fbf2dac6f0adc9c1f836&mt=35B1775A630C32B1C4D03621F0B4D42F9F54DBBA5FCE7F1A1333F7B723AA7CC3AAFBFDDAAF0F22878CC4DB537868CE6B907D7B6A56151CC93F1656A15FC7784E57F833A0C8228D1ABED72E500815E35A0E75E3203F9D738006DC9AFB993CE9E8E144D35CD8D937C93A8AD2588B1A8B4DB702FC472466C459A4417B9A8E2EE56169BAEE64370A13EB444AB8BEED52996CA9C0C52AE6D2B249F879DD&retpath=aHR0cHM6Ly95YW5kZXgucnUvc2VhcmNoP3RleHQ9MjExNjg3MTc%2C_7b10da088091b864adaf1560824ca7aa&t=2%252F1794698704%252F56f7e3c3d02002047d0b5bc1b77129dd&u=9759726859415468499&s=eafe75788290d134b553e6141e7f3a46RU
n/a
hxxps://help[.]pactvow[.]com/vJCGbEbO/JP
n/a
hxxps://2fo1ul[.]share-eu1[.]hsforms[.]com/2LZye6exwTB-HdxF_vmKz2A–
n/a
hxxps://linqapp[.]com/eebtinternet–
n/a
hxxps://www[.]cdiscount[.]com?source_id=&sub1=dbseggu0fgns73ai4d30&adv1=&adv2=–
n/a
hxxp://49[.]51[.]43[.]12/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts[.]google[.]com&amp%3Bifkv=AWnogHe_pDujLaO-hl3d_3DQFjS6PW6JGM3LRrD13mxmiaQWTJuHz9b6nwmaSIh76M5SMOelnJex7g&amp%3Bpassive=1209600&continue=https%3A%2F%2Faccounts[.]google[.]com%2F&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AdVBgldbW3D8DNskVyZutv-RNCe07slrdqP5IaSrmIoK_LKcX7losJrmXafDGZunLXmvjRDpNYBVPA&dsh=S-1308124904%3A1794697136549876US
n/a
Sponsored bySOCRadar

Why organizations contribute to PhishStats

Security professionals, organizations, and academics rely on the PhishStats database and feed for threat intelligence, incident response, and phishing research.

Submit a URLReport false positive

Faster takedowns
URLs submitted to PhishStats reach hundreds of security teams and integrators who rely on our feed, helping speed up detection and takedown of phishing sites.
Community intelligence
Our feed includes unique URLs contributed by the infosec community, not just recycled open source lists.
Verified submissions
Submissions and false positive reports are scored with the PhishStats hybrid engine (rule based and ML). Enriched context is reviewed by our AI Cyber Defense agent for high accuracy.

Web interface

Search the phishing database

Investigate millions of verified phishing URLs through a search interface designed for SOC analysts, threat hunters and phishing research. Filter by URL, IP, country, ASN, date range, and more.

Filters
URL, title, IP, country, ASN, TLD, score and date range, combined with AND or OR.
Dashboard
Trend, top networks, domains and a hosting map for any filtered set.
Pivots
Jump from a record to everything sharing its IP, host, ASN or title.

Open search

PhishStats phishing feed listing verified URLs with their IP addresses and country codes

REST API

Phishing feed API

Plug PhishStats into your stack as a real-time phishing feed. Run complex queries against our phishing database and stream JSON-formatted threat intelligence straight into your SIEM, SOAR, or research pipeline.

Fresh
The feed is updated every 90 minutes.
Queryable
Filter on URL, title, country, ASN, score and more, then sort and page.
Plain JSON
Works with a SIEM, a SOAR playbook or a research notebook.

API documentationhttps://api.phishstats.info

Request

curl -H "X-API-Key: psk_..." \
  "https://api.phishstats.info/api/phishing?_where=(score,gt,5)~and(tld,eq,com)&_sort=-date&_size=2"

Response, abridged

[
  {
    "id": 9412075,
    "url": "hxxps://account-verify[.]example.com/signin",
    "ip": "198.51.100.17",
    "countrycode": "US",
    "asn": "AS64496",
    "tld": "com",
    "score": 7.1,
    "date": "2026-11-14T08:41:09.000Z"
  },
  ...
]

For registered users

Platform capabilities

These features are available now for registered users. Paid plans unlock higher API volume, submissions, and monitoring limits.

Compare plans

Frequently asked questions

All questions

Is PhishStats a free phishing database for research?

Yes. PhishStats is a free phishing database and real-time phishing feed used in cybersecurity research since 2014. Verified phishing URLs, IPs, domains, and threat scores are accessible through our web search interface and JSON REST API, with no signup required for read-only access.

How many API requests can I make?

Limits depend on your plan and whether you send an API key. Anonymous requests (no key) are capped at 50/day per IP. Free registered users: 150/day with a key. Premium: 1,000/day. Enterprise: 10,000/day. All daily quotas reset at UTC midnight. See our Pricing page for the full matrix.

How do I use an API key?

Sign in, then create a key at Settings → API keys. Send it on every request to api.phishstats.info as X-API-Key: psk_… or Authorization: Bearer psk_…. Paying for Premium or Enterprise does not raise the anonymous IP limit. You must include your key. See API docs for examples.

Where can I find API documentation?

You can find comprehensive API documentation with examples and parameters at our API Docs page. It includes detailed information about filtering, sorting, pagination, and various query examples.

How often is the data updated?

Our database is updated every 90 minutes with the latest phishing intelligence. We recommend checking for updates no more frequently than this interval to ensure optimal performance.

What is the phishscore and how is it calculated?

The phishscore is a confidence rating calculated using 22 different features and machine learning algorithms. It provides a numerical assessment of how likely a URL is to be a phishing site, helping you prioritize threats based on confidence levels.

How to get support for the product?

For any questions or support, please send an email to [email protected]. We'll be happy to assist you with any questions or concerns you may have.