# phishunt.io - full AI reference (llms-full.txt) > phishunt is a free, real-time phishing-domains threat feed run by Daniel Lopez (Cyber Threat Researcher, 10+ years). Every data output is CC0 1.0 (public domain). An hourly pipeline ingests Certificate Transparency logs, Google Safe Browsing, urlscan.io, OpenPhish, PhishTank and TweetFeed, then classifies, screenshots and republishes active suspicious phishing sites. ## At a glance - Updated: hourly (rolling 24h feed; 7d/30d windows via the API). - License: CC0 1.0 Universal (public domain) on all feeds and API output. - Access: no account, no API key, no rate limit on read endpoints. - Client compatibility: feeds, blocklists and /api/v1/* accept any User-Agent (they skip Cloudflare's Browser Integrity Check); HTML pages still return 403 to a bare Python-urllib or libwww-perl User-Agent. Set a descriptive User-Agent anyway. - Coverage: 100+ targeted brands, plus per-TLS-intermediate and per-ASN/IP/country breakdowns. - AI use: reading, inference, live citation and LLM training all welcome (Content-Signal: ai-train=yes). - Operator: Daniel Lopez. Contact: info@phishunt.io. Jurisdiction: Spain. ## What is phishunt? (definition) phishunt is a free phishing-domain feed and lookup service. It answers "is this domain a known phishing site?" and "what phishing is currently targeting brand X?" from a continuously updated, screenshot-enriched dataset of active suspicious sites, served as plaintext/JSON/CSV feeds, a REST API, and a Model Context Protocol (MCP) server for AI agents. ## How to use it (agents first) 1. MCP (best for agents): https://mcp.phishunt.io/ - JSON-RPC 2.0, 11 tools (listed below). 2. REST API: https://phishunt.io/api/v1/domains - paginated JSON; filter with ?contains=. Passive URL analysis: https://phishunt.io/api/v1/analyze (GET, JSON, never contacts the target URL). 3. Static feeds: https://phishunt.io/feed.txt (one domain/line), /feed.json, /feed.csv (rolling 24h). ## MCP tools - check_domain(domain): is a host (or a list of up to 20) in the active phishing feed? Exact match; misses are checked against the archive. - list_brand_phishings(brand, limit, asn?, org?, registrar?, cert?, country?, ip?): recent active detections targeting a brand; the optional pivots are exact-match and AND-combined. - get_recent_detections(since, limit, brand?, asn?, org?, registrar?, cert?, country?, ip?): delta-sync detections since a date; same optional exact-match pivots. - get_brand_metadata(brand): curated brand context plus active phishing count. - get_cert_metadata(cert): TLS intermediate-CA profile plus active count. - search_phishings(query, limit): free-text search over URL, domain and IP. - analyze_url(url): passive URL-shape analysis (brand match, typosquat, homograph) with a `why` score breakdown, plus stored verdict, feed-cache status and apex history, without contacting the URL. Full URL is transmitted and logged; pass a bare domain if it carries tokens. - analyze_url_deep(url): ACTIVE deep analysis - actively fetches the URL (HTTP, TLS cert, RDAP, nameservers, GeoIP via SOCKS5) and re-scores it with the full 5-layer engine. Slow (5-15s), shared daily budget (50/day), single-flight concurrency. Use only when analyze_url is inconclusive; never renders the page, so visual/DOM signals are always unevaluated. Full URL is transmitted, logged and actively fetched. - get_related_infrastructure(domain, limit): infrastructure/content overlap with a known indicator (shared IP, cert, nameservers, favicon, redirect, naming pattern). Not an attribution claim. - get_campaigns(limit, brand?, active_only?): list possible campaigns / suspected clusters sharing infrastructure or content signals. - get_campaign(campaign_id): full detail on one possible campaign - evidence breakdown plus every member indicator. Pass the stable campaign key from get_campaigns; it survives the daily rebuild, the numeric id does not. ## Detection signals (methodology) phishunt combines network signals (hosting/ASN/IP reputation, newly registered domains), content signals (credential-harvest and login-form markers, brand-keyword scoring), behavioral and redirect-chain analysis, TLS certificate intelligence, and multi-source corroboration (at least 2 of Google Safe Browsing / urlscan.io / TweetFeed) before treating a detection as high confidence. Reference mappings: OWASP, NIST, MITRE ATT&CK T1566. ## Common questions - Is phishunt free? Yes, entirely. No account, no key, no rate limit on reads. - What is the license? CC0 1.0 Universal. Use it in blocklists, SIEMs, research, or model training. Attribution to phishunt.io is appreciated but not required. - How fresh is the data? The pipeline runs hourly; active sites are re-checked in a loop and dropped when they go dead. - Can I train an LLM on it? Yes - the data is CC0 and ai-train=yes. - How do I check a single domain? Use the MCP check_domain tool, or GET https://phishunt.io/api/v1/domains?contains=. - How do I report a false positive or request a takedown correction? Open a GitHub issue with the false-positive template (https://github.com/0xDanielLopez/phishunt/issues/new?template=false-positive.yml); info@phishunt.io also works. ## Coverage and reference - Brands: https://phishunt.io/suspicious/ - TLS certificates: https://phishunt.io/cert/ - Hosting (ASN/IP/org/country): https://phishunt.io/statistics/ - Possible campaigns (shared-infrastructure grouping of public detections, not attribution): https://phishunt.io/campaigns/ - Docs (kit anatomy, signals, OWASP/NIST/MITRE, MFA, evasion, glossary): https://phishunt.io/docs/ - API docs: https://phishunt.io/api/ - OpenAPI: https://phishunt.io/openapi.yaml - About / methodology: https://phishunt.io/about/ - Terms (CC0, GDPR controller, Spain): https://phishunt.io/tos/ - Agent guide: https://phishunt.io/agents/ - llms.txt: https://phishunt.io/llms.txt - Discovery: Agent Skills index (v0.2.0): https://phishunt.io/.well-known/agent-skills/index.json - API catalog (RFC 9727): https://phishunt.io/.well-known/api-catalog ## Attribution Cite as: phishunt.io (https://phishunt.io), CC0 1.0. Live citation and inference are welcome. ## Complete link index ### Feeds - [Last 24h plaintext feed](https://phishunt.io/feed.txt): one phishing domain per line. - [Structured JSON feed](https://phishunt.io/feed.json): full record per domain. - [CSV feed](https://phishunt.io/feed.csv): same as JSON, spreadsheet-friendly. - [HTML feed index](https://phishunt.io/feed/): browseable summary with stats. ### API - [API documentation](https://phishunt.io/api/): endpoints, examples, rate limits. - [OpenAPI 3.1 spec](https://phishunt.io/openapi.yaml): machine-readable schema (YAML). - [OpenAPI 3.1 spec](https://phishunt.io/.well-known/openapi.json): same schema as JSON, served under the RFC discovery path. - [/api/v1/domains](https://phishunt.io/api/v1/domains): paginated phishing domains. JSON. - [/api/v1/analyze](https://phishunt.io/api/v1/analyze): passive per-URL phishing-signal analysis (GET). Never contacts the target URL. JSON. ### MCP integration (for AI agents) - [/agent-setup/prompt.md](https://phishunt.io/agent-setup/prompt.md): fetch this and follow it - self-contained setup instructions an agent can run without human help (register the MCP server, verify it, fall back to skills/REST if there's no MCP support). - [mcp.phishunt.io](https://mcp.phishunt.io/): Model Context Protocol server. JSON-RPC 2.0. Tools: `check_domain`, `list_brand_phishings`, `get_recent_detections`, `get_brand_metadata`, `get_cert_metadata`, `search_phishings`, `analyze_url`, `analyze_url_deep`, `get_related_infrastructure`, `get_campaigns`, `get_campaign`. - [/agents/](https://phishunt.io/agents/): human-readable integration guide with config snippets. - [Agent Skills index](https://phishunt.io/.well-known/agent-skills/index.json): RFC v0.2.0 skill manifests for fetch-feed, lookup-brand, check-recent, brand-metadata, cert-metadata, search-phishings, analyze-url, related-infrastructure, list-campaigns, campaign-detail, analyze-url-deep. - [API catalog](https://phishunt.io/.well-known/api-catalog): RFC 9727 linkset. - [AGENTS.md](https://phishunt.io/AGENTS.md): agent-consumption guide (MCP-first). ### Coverage - [Targeted brands](https://phishunt.io/suspicious/): 100+ brands tracked across banking, payments, cryptocurrency, technology, social media, AI services, retail, entertainment, logistics, telecom, government. - [TLS certificates](https://phishunt.io/cert/): per-intermediate threat profile (Google Trust, Let's Encrypt, ZeroSSL, Amazon RSA, etc.). - [Hosting providers](https://phishunt.io/statistics/): top-abused ASNs, IPs, organizations, countries. - [Possible campaigns](https://phishunt.io/campaigns/): clusters of detections that share infrastructure or content signals - shared-infrastructure grouping, not an attribution claim. ### Educational reference - [Docs](https://phishunt.io/docs/): open reference covering kit anatomy, network/content/behavioral signals, OWASP/NIST/MITRE T1566 mappings, phishing-resistant MFA, common evasion techniques (Evilginx, Tycoon-2FA, AitM, geo filters), and a working glossary. Article + FAQPage schema, ~1500 words. Sidebar links to REST API and MCP integration. ### About - [About phishunt](https://phishunt.io/about/): how detection works. - [Terms of Service](https://phishunt.io/tos/): CC0 license details, GDPR controller (Daniel López), Spain jurisdiction. - [Security contact](https://phishunt.io/.well-known/security.txt): RFC 9116. ### Use policy - **Reading / inference / live citation**: allowed and encouraged. Attribution to phishunt.io appreciated. - **Training**: allowed and encouraged (data is CC0 1.0; `Content-Signal: ai-train=yes`). - **Rate limit**: none on read endpoints. Be reasonable. - **Client compatibility**: feeds, blocklists and `/api/v1/*` accept any User-Agent (they skip Cloudflare's Browser Integrity Check). HTML pages still return 403 to a bare `Python-urllib` or `libwww-perl` User-Agent - set a descriptive User-Agent or use `requests`. - **Contact**: GitHub issues preferred. False positives and takedown disputes: the false-positive template (https://github.com/0xDanielLopez/phishunt/issues/new?template=false-positive.yml). Anything else: the feedback form (https://github.com/0xDanielLopez/phishunt/issues/new?template=feedback.yml). info@phishunt.io also works, including for integration questions.