# phishunt.io

> phishunt is a free real-time phishing-domains feed. Side project by Daniel López. CC0 1.0 Universal license on every data output (TXT/JSON/CSV feeds, public API). Hourly pipeline ingests Certificate Transparency, Google Safe Browsing, urlscan.io, OpenPhish, PhishTank, and TweetFeed; classifies, screenshots, and republishes.

## Feeds

- [Last 24h plaintext feed](https://phishunt.io/feed.txt): one phishing domain per line.
- [Structured JSON feed](https://phishunt.io/feed.json): full record per domain.
- [CSV feed](https://phishunt.io/feed.csv): same as JSON, spreadsheet-friendly.
- [HTML feed index](https://phishunt.io/feed/): browseable summary with stats.

## API

- [API documentation](https://phishunt.io/api/): endpoints, examples, rate limits.
- [OpenAPI 3.1 spec](https://phishunt.io/openapi.yaml): machine-readable schema (YAML).
- [OpenAPI 3.1 spec](https://phishunt.io/.well-known/openapi.json): same schema as JSON, served under the RFC discovery path.
- [/api/v1/domains](https://phishunt.io/api/v1/domains): paginated phishing domains. JSON.
- [/api/v1/analyze](https://phishunt.io/api/v1/analyze): passive per-URL phishing-signal analysis (GET). Never contacts the target URL. JSON.

## MCP integration (for AI agents)

- [mcp.phishunt.io](https://mcp.phishunt.io/): Model Context Protocol server. JSON-RPC 2.0. Tools: `check_domain`, `list_brand_phishings`, `get_recent_detections`, `get_brand_metadata`, `get_cert_metadata`, `search_phishings`, `analyze_url`.
- [/agents/](https://phishunt.io/agents/): human-readable integration guide with config snippets.
- [Agent Skills index](https://phishunt.io/.well-known/agent-skills/index.json): RFC v0.2.0 skill manifests for fetch-feed, lookup-brand, check-recent, brand-metadata, cert-metadata, search-phishings, analyze-url.
- [API catalog](https://phishunt.io/.well-known/api-catalog): RFC 9727 linkset.
- [AGENTS.md](https://phishunt.io/AGENTS.md): agent-consumption guide (MCP-first).
- [llms-full.txt](https://phishunt.io/llms-full.txt): expanded, self-contained AI reference.

## Coverage

- [Targeted brands](https://phishunt.io/suspicious/): 60+ brands tracked across tech, finance, crypto, payments, retail.
- [TLS certificates](https://phishunt.io/cert/): per-intermediate threat profile (Google Trust, Let's Encrypt, ZeroSSL, Amazon RSA, etc.).
- [Hosting providers](https://phishunt.io/statistics/): top-abused ASNs, IPs, organizations, countries.

## Educational reference

- [Docs](https://phishunt.io/docs/): open reference covering kit anatomy, network/content/behavioral signals, OWASP/NIST/MITRE T1566 mappings, phishing-resistant MFA, common evasion techniques (Evilginx, Tycoon-2FA, AitM, geo filters), and a working glossary. Article + FAQPage schema, ~1500 words. Sidebar links to REST API and MCP integration.

## About

- [About phishunt](https://phishunt.io/about/): how detection works.
- [Terms of Service](https://phishunt.io/tos/): CC0 license details, GDPR controller (Daniel López), Spain jurisdiction.
- [Security contact](https://phishunt.io/.well-known/security.txt): RFC 9116.

## Use policy

- **Reading / inference / live citation**: allowed and encouraged. Attribution to phishunt.io appreciated.
- **Training**: allowed and encouraged (data is CC0 1.0; `Content-Signal: ai-train=yes`).
- **Rate limit**: none on read endpoints. Be reasonable.
- **Contact**: GitHub issues (https://github.com/0xDanielLopez/phishunt/issues/new/choose) preferred for takedown disputes and false-positive reports - use the false-positive template (https://github.com/0xDanielLopez/phishunt/issues/new?template=false-positive.yml). info@phishunt.io also works, including for integration questions.