# phishunt.io - full AI reference (llms-full.txt)

> phishunt is a free, real-time phishing-domains threat feed run by Daniel Lopez (Cyber Threat Researcher, 10+ years). Every data output is CC0 1.0 (public domain). An hourly pipeline ingests Certificate Transparency logs, Google Safe Browsing, urlscan.io, OpenPhish, PhishTank and TweetFeed, then classifies, screenshots and republishes active suspicious phishing sites.

## At a glance
- Updated: hourly (rolling 24h feed; 7d/30d windows via the API).
- License: CC0 1.0 Universal (public domain) on all feeds and API output.
- Access: no account, no API key, no rate limit on read endpoints.
- Coverage: 60+ targeted brands, plus per-TLS-intermediate and per-ASN/IP/country breakdowns.
- AI use: reading, inference, live citation and LLM training all welcome (Content-Signal: ai-train=yes).
- Operator: Daniel Lopez. Contact: info@phishunt.io. Jurisdiction: Spain.

## What is phishunt? (definition)
phishunt is a free phishing-domain feed and lookup service. It answers "is this domain a known phishing site?" and "what phishing is currently targeting brand X?" from a continuously updated, screenshot-enriched dataset of active suspicious sites, served as plaintext/JSON/CSV feeds, a REST API, and a Model Context Protocol (MCP) server for AI agents.

## How to use it (agents first)
1. MCP (best for agents): https://mcp.phishunt.io/ - JSON-RPC 2.0, 7 tools (listed below).
2. REST API: https://phishunt.io/api/v1/domains - paginated JSON; filter with ?contains=<substring>. Passive URL analysis: https://phishunt.io/api/v1/analyze (GET, JSON, never contacts the target URL).
3. Static feeds: https://phishunt.io/feed.txt (one domain/line), /feed.json, /feed.csv (rolling 24h).

## MCP tools
- check_domain(domain): is a domain or URL substring in the active phishing feed?
- list_brand_phishings(brand, limit): recent active detections targeting a brand.
- get_recent_detections(since, limit, brand?): delta-sync detections since a date.
- get_brand_metadata(brand): curated brand context plus active phishing count.
- get_cert_metadata(cert): TLS intermediate-CA profile plus active count.
- search_phishings(query, limit): free-text search over URL, domain and IP.
- analyze_url(url): passive URL-shape analysis (brand match, typosquat, homograph, entropy) plus stored verdict and apex history, without contacting the URL.

## Detection signals (methodology)
phishunt combines network signals (hosting/ASN/IP reputation, newly registered domains), content signals (credential-harvest and login-form markers, brand-keyword scoring), behavioral and redirect-chain analysis, TLS certificate intelligence, and multi-source corroboration (at least 2 of Google Safe Browsing / urlscan.io / TweetFeed) before treating a detection as high confidence. Reference mappings: OWASP, NIST, MITRE ATT&CK T1566.

## Common questions
- Is phishunt free? Yes, entirely. No account, no key, no rate limit on reads.
- What is the license? CC0 1.0 Universal. Use it in blocklists, SIEMs, research, or model training. Attribution to phishunt.io is appreciated but not required.
- How fresh is the data? The pipeline runs hourly; active sites are re-checked in a loop and dropped when they go dead.
- Can I train an LLM on it? Yes - the data is CC0 and ai-train=yes.
- How do I check a single domain? Use the MCP check_domain tool, or GET https://phishunt.io/api/v1/domains?contains=<substring>.
- How do I report a false positive or request a takedown correction? Open a GitHub issue with the false-positive template (https://github.com/0xDanielLopez/phishunt/issues/new?template=false-positive.yml); info@phishunt.io also works.

## Coverage and reference
- Brands: https://phishunt.io/suspicious/
- TLS certificates: https://phishunt.io/cert/
- Hosting (ASN/IP/org/country): https://phishunt.io/statistics/
- Docs (kit anatomy, signals, OWASP/NIST/MITRE, MFA, evasion, glossary): https://phishunt.io/docs/
- API docs: https://phishunt.io/api/ - OpenAPI: https://phishunt.io/openapi.yaml
- About / methodology: https://phishunt.io/about/
- Terms (CC0, GDPR controller, Spain): https://phishunt.io/tos/
- Agent guide: https://phishunt.io/agents/ - llms.txt: https://phishunt.io/llms.txt
- Discovery: Agent Skills index (v0.2.0): https://phishunt.io/.well-known/agent-skills/index.json - API catalog (RFC 9727): https://phishunt.io/.well-known/api-catalog

## Attribution
Cite as: phishunt.io (https://phishunt.io), CC0 1.0. Live citation and inference are welcome.