Feed (JSON)

Download the complete active suspicious phishing feed in JSON format. Updated every hour.

get/feed.json

Request

  • Base URL: https://phishunt.io
  • URL: https://phishunt.io/feed.json
  • Auth: none declared

Response

JSON array of all active suspicious phishing sites.

urlstring

Full URL of the suspicious site.

domainstring

Domain name including subdomains.

companystring

Targeted brand identifier.

datestring date-time

Last check timestamp (ISO 8601).

first_seenstring date-time

When the site was first detected (ISO 8601).

uuidstring uuid

Unique identifier for this entry (UUID v4).

ipstring

Resolved IPv4 address.

countrystring

Hosting country name.

asnstring

Autonomous System Number.

orgstring

Hosting organization.

certstring

TLS certificate issuer.

malicious_googleboolean

true if flagged by Google Safe Browsing. false is not a clean verdict: the source did not flag it when checked, or was never asked.

malicious_openphishboolean

true if present in OpenPhish feed. false is not a clean verdict: the source did not flag it when checked, or was never asked.

malicious_phishtankboolean

true if present in PhishTank feed. false is not a clean verdict: the source did not flag it when checked, or was never asked.

malicious_tweetfeedboolean

true if present in TweetFeed. false is not a clean verdict: the source did not flag it when checked, or was never asked.

malicious_urlscanboolean

true if flagged by urlscan.io. false is not a clean verdict: the source did not flag it when checked, or was never asked.

scoreinteger

phishunt's own 0-100 detection score from its explainable 5-layer scoring engine (same number known.record.phishunt_score exposes on /api/v1/analyze). Same disclaimer as that endpoint's risk_score: "risk_score is a heuristic risk score, not a calibrated probability" - this field is that same heuristic score, not a probability of phishing.

verdict'critical' | 'high' | 'medium' | 'low' | 'noise'

Calibrated verdict tier score falls into (backend analysis/scoring/weights.py VERDICT_THRESHOLDS). Falls back to noise for rows scored before the verdict field existed.

sans_scoreinteger nullable

SANS ISC DShield heuristic score (0..N) for the apex domain at insertion time. Sourced from the SANS recent-domains feed (passive-DNS first-seen). Null when the apex was not in the SANS feed of the day of insertion. Data consumed under CC BY-NC-SA 4.0 with attribution to SANS Internet Storm Center / DShield.

sans_scorereasonstring nullable

Textual reason string from SANS explaining the score, e.g. "Excessive hyphens: 5 (+4)|High entropy: 3.87 (+1.85)|Contains suspicious keyword: deal (+20)". Pipe-separated signals.

Changes

No recorded changes to this operation across all 1 revision of this API.