HUhudsonrock
Threat Feeds

PhaaS Host Feed

Changed on

Cursor-paginated feed of Phishing-as-a-Service host rows. Requires phaas_threat_feed.

post/threat-feeds/phaas

Request

Request body

datestring

A single UTC day (YYYY-MM-DD). Ignored if a range is given.

dateFromstring

Inclusive range start on dayUtc.

dateTostring

Inclusive range end on dayUtc.

hoststring

Exact host match (lower-cased, trimmed).

familystring

Phishing-kit name membership (lower-cased).

countrystring

ISO-2 country, exact (upper-cased).

feedTypestring
asninteger

Autonomous system number.

sort'date' | 'seen' | 'host'
dir'asc' | 'desc'
cursorstring

Opaque keyset cursor from a previous response's pageInfo.nextCursor.

limitinteger
withTotalboolean

Example request

{
  "date": "2026-01-31"
}

Response

Successful operation

Example response

{
  "data": [
    {
      "host": "phish-kit.example.com",
      "dayUtc": "2026-01-31",
      "compromised_data": {
        "domain": "acme.com",
        "compromised_employees": 42,
        "last_employee_compromised": "2026-06-11T00:00:00.000Z",
        "compromised_users": 1380,
        "last_user_compromised": "2026-07-02T00:00:00.000Z"
      }
    }
  ]
}

Changes