---
title: "Feed (JSON)"
method: GET
path: "/feed.json"
---

# Feed (JSON)

`GET /feed.json`

## Request

- Base URL: `https://phishunt.io`
- URL: `https://phishunt.io/feed.json`
- Auth: none declared

Download the complete active suspicious phishing feed in JSON format. Updated every hour.

## Response `200`

JSON array of all active suspicious phishing sites.

- Site[]
  - `url` string: Full URL of the suspicious site.
  - `domain` string: Domain name including subdomains.
  - `company` string: Targeted brand identifier.
  - `date` string, date-time: Last check timestamp (ISO 8601).
  - `first_seen` string, date-time: When the site was first detected (ISO 8601).
  - `uuid` string, uuid: Unique identifier for this entry (UUID v4).
  - `ip` string: Resolved IPv4 address.
  - `country` string: Hosting country name.
  - `asn` string: Autonomous System Number.
  - `org` string: Hosting organization.
  - `cert` string: TLS certificate issuer.
  - `malicious_google` boolean: true if flagged by Google Safe Browsing. false is not a clean verdict: the source did not flag it when checked, or was never asked.
  - `malicious_openphish` boolean: true if present in OpenPhish feed. false is not a clean verdict: the source did not flag it when checked, or was never asked.
  - `malicious_phishtank` boolean: true if present in PhishTank feed. false is not a clean verdict: the source did not flag it when checked, or was never asked.
  - `malicious_tweetfeed` boolean: true if present in TweetFeed. false is not a clean verdict: the source did not flag it when checked, or was never asked.
  - `malicious_urlscan` boolean: true if flagged by urlscan.io. false is not a clean verdict: the source did not flag it when checked, or was never asked.
  - `score` integer: phishunt's own 0-100 detection score from its explainable 5-layer scoring engine (same number `known.record.phishunt_score` exposes on /api/v1/analyze). Same disclaimer as that endpoint's `risk_score`: "risk_score is a heuristic risk score, not a calibrated probability" - this field is that same heuristic score, not a probability of phishing.
  - `verdict` 'critical' | 'high' | 'medium' | 'low' | 'noise': Calibrated verdict tier `score` falls into (backend `analysis/scoring/weights.py` VERDICT_THRESHOLDS). Falls back to `noise` for rows scored before the verdict field existed.
  - `top_signals` object[]: Up to 5 highest-weighted signals behind `score`, sorted by points contributed (descending). Empty when the row predates the detector version that records per-signal point breakdowns, or when stored signal data is missing/malformed - never omitted, never a source of a 500.
    - `signal` string: Stable feature identifier, e.g. `kw_score_norm`, `combosquat`.
    - `label` string: Human-readable label for `signal`.
    - `points` number: Points this signal contributed to `score`.
  - `sans_score` integer, nullable: SANS ISC DShield heuristic score (0..N) for the apex domain at insertion time. Sourced from the SANS recent-domains feed (passive-DNS first-seen). Null when the apex was not in the SANS feed of the day of insertion. Data consumed under CC BY-NC-SA 4.0 with attribution to SANS Internet Storm Center / DShield.
  - `sans_scorereason` string, nullable: Textual reason string from SANS explaining the score, e.g. "Excessive hyphens: 5 (+4)|High entropy: 3.87 (+1.85)|Contains suspicious keyword: deal (+20)". Pipe-separated signals.

---

[API](https://skmtc.dev/phishunt/apis/phishunt-api.md) · [All operations](https://skmtc.dev/phishunt/apis/phishunt-api/llms.txt) · [OpenAPI document](https://skmtc.dev/phishunt/apis/phishunt-api/revisions/0e07c255f282?raw)