API Reference

Real-time phishing intelligence as JSON, CSV, or TXT. Open, free, no auth required.

931 Active

No auth Open access

10 req/s Per IP

Hourly Refresh

Building an AI agent? See For AI Agents for the MCP server and Agent Skills wrappers.

Introduction

The detection pipeline identifies active suspicious phishing sites in real time by monitoring multiple threat intelligence sources and Certificate Transparency logs. Data is enriched with IP geolocation, TLS certificate information, and detection verdicts.

Detection sources:

Certificate Transparency - real-time monitoring of newly issued TLS certificates
Google Safe Browsing - batch lookup against Google's threat lists
OpenPhish - community phishing feed
PhishTank - verified phishing URLs
TweetFeed - IOCs shared on social media
urlscan.io - live URL scanning verdicts

Pipeline schedule

Process	Frequency	Description
Detection pipeline	Every hour	Scans Certificate Transparency logs and checks threat intel sources for new suspicious phishing domains
Active site re-check	Every 6 hours	Re-visits active sites, captures fresh screenshots, and updates detection verdicts
New registration scan	Daily (00:30 UTC)	Scans newly registered domains for suspicious keyword patterns
Data enrichment	On detection	IP geolocation, ASN, TLS certificate, and hosting organization via ipinfo.io

Endpoint URL

https://phishunt.io/api/v1/domains

Get domains

GET /api/v1/domains Try it

Returns active suspicious phishing domains with enrichment data: IP geolocation, TLS certificate issuer, hosting org, and detection verdicts from Google Safe Browsing, OpenPhish, PhishTank, TweetFeed, and urlscan.io.

Query parameters

Parameter	Type	Description
`limit`	integer	Number of results to return. Omit to get all current results; max 1000 when set.
`offset`	integer	Number of results to skip for pagination. Default 0, max 10000.
`format`	string	Response format: `json`, `csv`, or `txt`. Default json.
`company`	string	Filter by targeted brand (e.g. `amazon`, `paypal`). See targeted brands.
`since`	ISO 8601	Only entries after this date (e.g. `2026-03-01`).

Example request

curl "https://phishunt.io/api/v1/domains"

import requests

r = requests.get("https://phishunt.io/api/v1/domains", params={
    "limit": 50,
    "company": "amazon",
})

data = r.json()
print(f"Returned {data['count']} results")

for site in data["results"]:
    print(site["url"], site["company"], site["ip"])

const url = "https://phishunt.io/api/v1/domains?limit=50&company=amazon";
const res = await fetch(url);
const { count, results } = await res.json();

console.log(`Returned ${count} results`);
results.forEach(site => {
    console.log(site.url, site.company, site.ip);
});

Example response

{
  "count": 2,
  "offset": 0,
  "limit": null,
  "results": [
    {
      "url": "https://amazon.example-phish.com/signin",
      "domain": "amazon.example-phish.com",
      "company": "amazon",
      "date": "2026-03-27T14:30:00+00:00",
      "first_seen": "2026-03-25T09:12:00+00:00",
      "uuid": "54889cb5-146d-484f-8b94-7a0b7385bff7",
      "ip": "198.51.100.42",
      "country": "United States",
      "asn": "64496",
      "org": "Example Hosting Inc.",
      "cert": "Let's Encrypt R3",
      "malicious_google": false,
      "malicious_openphish": true,
      "malicious_phishtank": false,
      "malicious_tweetfeed": false,
      "malicious_urlscan": true
    }
  ]
}

Feeds

Download the complete active suspicious phishing feed. Updated every hour. Full dataset with no filtering - use the domains endpoint for query parameters.

JSON

CSV

TXT

OpenAPI

Feed files return all active entries as a download. The JSON feed is a flat array (no wrapper object). The TXT feed contains one URL per line. Import the OpenAPI spec into Postman or Insomnia.

Analyze URL

GET /api/v1/analyze Try it

Passive analysis of any URL: checks it against phishunt's stored detections (active feed, prior detections, new-registration feed) and runs live URL-shape heuristics (brand match, typosquat/homograph distance, TLD abuse, PaaS hosting, clone intent). The target URL is never contacted. Suspicious unknown domains are queued for full pipeline analysis.

Query parameters

Parameter	Type	Description
`url`	string	The URL to analyze. Required. http/https only, max 2048 characters.

Example request

curl "https://phishunt.io/api/v1/analyze?url=https://amazon-secure-login.example.com/signin"

Example response

{
  "query": { "url": "...", "host": "...", "normalized_host": "...", "apex": "..." },
  "known": {
    "in_active_feed": false,
    "previously_active": false,
    "in_new_registration_feed": false,
    "record": null
  },
  "live_analysis": {
    "allowlisted": false,
    "brand_match": "amazon",
    "kw_score": 85,
    "impersonation": false,
    "url_signals": { "kw_score_norm": 0.85, "idn_homograph": 0.0, "tld_abuse": 0.3, "clone_intent": 0.0, "paas_host": 0.0, "leet_brand": 0.0 },
    "path_signals": { "brand_off_host": 0.0, "suspicious_path": 1.0, "exec_page": 0.0 },
    "url_risk_score": 72,
    "url_risk": "high",
    "why": [
      { "signal": "kw_score_norm", "value": 0.85, "weight": 0.26, "points": 22.1, "kind": "weighted" },
      { "signal": "suspicious_path", "value": 1.0, "weight": 0.0, "points": 12.0, "kind": "path_boost" }
    ]
  },
  "history": { "apex_prior_detections": 0, "brands_targeted": [] },
  "external_feeds": { "openphish": false, "phishtank": false, "tweetfeed": false, "listed": false, "status": "ok", "feeds_ok": true },
  "action": { "queued_for_analysis": true, "reason": "high url_risk on unknown apex" },
  "meta": { "passive_only": true, "license": "CC0-1.0" }
}

external_feeds reports whether the apex domain is present in OpenPhish/PhishTank/TweetFeed (local cache cross-reference — the target is still never contacted), plus status/feeds_ok for the freshness of that local cache itself. live_analysis.why lists the top-5 score contributors (weighted signals, passive path/shape boosts, and a capped-row correction when one applies), consistent with url_risk_score. Full field reference in the OpenAPI spec (AnalyzeResponse schema).

Campaigns

Groups of indicators that share infrastructure or content signals (same TLS certificate, IP, hosting, page content, etc.), computed by the same daily correlation job as related infrastructure. This is a shared-infrastructure grouping of public detections, not an attribution claim - clusters are labeled "possible campaign" or "suspected cluster" only, never an actor or group. Low-confidence ("weak") clusters are never surfaced through these endpoints or the /campaigns/ pages.

key is the stable identifier - use it for permalinks and caching. The numeric id is ephemeral: it changes on every daily rebuild, so a bookmarked /api/v1/campaigns/41 link still resolves (the sidecar remembers the mapping for 180 days), but only key is guaranteed to keep naming the same campaign tomorrow.

GET /api/v1/campaigns Try it

List possible campaigns / suspected clusters.

Query parameters

Parameter	Type	Description
`limit`	integer	Number of results to return. Default 50, max 200.
`offset`	integer	Number of results to skip for pagination. Default 0, max 10000.
`brand`	string	Filter to clusters with at least one member targeting this brand slug.
`status`	string	`active` (at least one currently-active member) or `all`. Default all.
`min_size`	integer	Only return clusters with at least this many members. Default 0.

Example request

curl "https://phishunt.io/api/v1/campaigns?status=active&limit=10"

Example response

{
  "count": 1,
  "offset": 0,
  "limit": 50,
  "algorithm_version": "corr-1.2.0",
  "generated_at": "2026-07-18T06:10:00Z",
  "results": [
    {
      "id": 41,
      "key": "0c1b79ab9b24",
      "size": 9,
      "active_count": 6,
      "brands": ["coinbase", "kraken"],
      "confidence": "suspected cluster",
      "first_seen": "2026-07-10T08:00:00Z",
      "last_activity": "2026-07-17T10:00:00Z",
      "top_evidence": { "type": "cert_fingerprint_exact", "coverage": "7/9 members" },
      "url": "https://phishunt.io/campaigns/0c1b79ab9b24/"
    }
  ]
}

GET /api/v1/campaigns/{key} Try it

Full campaign object: the list summary fields plus an evidence breakdown and every member indicator.

{key} accepts the stable key (preferred) or the legacy numeric id, resolved for the last 180 days. 404 with {"error": "Unknown campaign id", "list_url": "..."} for an unknown, dissolved-and-pruned, or "weak" campaign.

GET /api/v1/campaigns/{key}/export Try it

Same data as the endpoint above, served as a downloadable attachment.

Parameter	Type	Description
`format`	string	`json`, `csv`, or `txt`. Default json.

CSV columns: uuid,domain,url,company,status,first_seen,relationship_score,evidence_types (semicolon-joined signal ids). TXT is one member URL per line. Content-Disposition filenames use only the resolved campaign key, never a domain and never the raw identifier supplied by the caller. Full field reference (evidence summary, history, members) in the OpenAPI spec (Campaign schema).

Response fields

Each object in the results array (or feed entries) contains these fields, grouped by purpose.

Identity

Field	Type	Description
`url`	string	Full URL of the suspicious site
`domain`	string	Domain name including subdomains
`company`	string	Targeted brand slug (e.g. `amazon`, `paypal`)
`uuid`	string	Unique identifier for this entry (UUID v4)

Time

Field	Type	Description
`first_seen`	datetime	When the site was first detected (ISO 8601)
`date`	datetime	Last check timestamp (ISO 8601)

Hosting

Field	Type	Description
`ip`	string	Resolved IPv4 address
`country`	string	Hosting country name
`asn`	string	Autonomous System Number (e.g. `13335`)
`org`	string	Hosting organization
`cert`	string	TLS certificate issuer

Detection sources

Field	Type	Description
`malicious_google`	boolean	`true` if flagged by Google Safe Browsing
`malicious_openphish`	boolean	`true` if present in OpenPhish feed
`malicious_phishtank`	boolean	`true` if present in PhishTank
`malicious_tweetfeed`	boolean	`true` if present in TweetFeed
`malicious_urlscan`	boolean	`true` if flagged by urlscan.io

Pagination

Use offset and limit to paginate through results. The response includes both values so you can compute the next page.

# Page 1
curl "https://phishunt.io/api/v1/domains?limit=100&offset=0"

# Page 2
curl "https://phishunt.io/api/v1/domains?limit=100&offset=100"

# Page 3
curl "https://phishunt.io/api/v1/domains?limit=100&offset=200"

When count is less than limit, you've reached the last page.

Status codes

Code	Description
200	Success. Response body contains the requested data.
400	Bad request. Invalid parameter value (e.g. malformed `since` date).
429	Rate limited. Back off and retry.

Notes

CORS - All API responses include Access-Control-Allow-Origin: *, so you can call the API from browser applications.

Terms - Data is provided on a best-effort basis. False positives may occur. See Terms of Service.