Sources
Sources and coverage
Each finding names its source. We publish the fields each source permits, with the attribution it asks for.
PhishDestroy Primary (content-verified)
Curated phishing domains; a listed domain covers the names under it.
- Publisher
- PhishDestroy
- License
- MIT
- Attribution
- Curated phishing domains from PhishDestroy (phishdestroy.io), content-verified subset, MIT licensed. Copyright (c) PhishDestroy.
PhishTank verified online phishes
Verified phishing hostnames; the reported URLs stay with PhishTank.
- Publisher
- PhishTank (Cisco Talos / OpenDNS)
- License
- PhishTank terms (commercial API use permitted)
- Attribution
- Phishing report data from PhishTank (phishtank.org).
CERT Polska warning list
Phishing and fraud domains CERT Polska warns about; a listed domain covers the names under it.
- Publisher
- CERT Polska (NASK, Poland)
- License
- CERT Polska warning list policy
- Attribution
- Lista ostrzeżeń przed niebezpiecznymi stronami, CERT Polska (cert.pl). Credit is optional and implies no partnership.
MetaMask phishing list
Crypto-wallet phishing domains; a listed domain covers the names under it.
- Publisher
- MetaMask (Consensys)
- License
- DBAD Public License v1.2
- Attribution
- eth-phishing-detect, MetaMask.
USOM malicious links
Phishing domains reported in Türkiye; a listed domain covers the names under it.
- Publisher
- USOM, Türkiye Cybersecurity Directorate
- License
- Published list
- Attribution
- USOM zararlı bağlantılar listesi, Siber Güvenlik Başkanlığı.
Taiwan MODA suspension list
Fraud domains whose DNS resolution Taiwan asked TWNIC to stop; a listed domain covers the names under it.
- Publisher
- Ministry of Digital Affairs, Administration for Digital Industries (Taiwan)
- License
- Open Government Data License v1.0
- Attribution
- 「數位發展部數位產業署聲請詐騙網域名稱停止解析網址清單」, Administration for Digital Industries, Ministry of Digital Affairs (data.gov.tw 165027), Open Government Data License v1.0.
Taiwan NPA 165 list
Fraud hostnames suspended under Taiwan’s Fraud Crime Hazard Prevention Act, with NPA’s site category; each listed host matches on its own.
- Publisher
- National Police Agency, 165 Anti-Fraud Hotline (Taiwan)
- License
- Open Government Data License v1.0
- Attribution
- 「165反詐騙諮詢專線_遭停止解析涉詐網站」, National Police Agency, Ministry of the Interior (data.gov.tw 176455), Open Government Data License v1.0.
JPCERT/CC phishing URL list
Phishing sites JPCERT/CC confirmed, each with the brand it imitates; each listed host matches on its own.
- Publisher
- JPCERT Coordination Center (Japan)
- License
- JPCERT/CC site policy
- Attribution
- JPCERT/CC phishurl-list (github.com/JPCERTCC/phishurl-list).
AMF blacklists
Websites the AMF lists for impersonating authorised firms or the AMF itself, with the AMF’s category; a listed website covers the names under it.
- Publisher
- Autorité des marchés financiers (France)
- License
- Licence Ouverte 2.0
- Attribution
- Autorité des marchés financiers (AMF), « Listes noires des entités non autorisées à proposer des produits ou services financiers en France », data.gouv.fr, latest daily update.
FSMA warnings
Websites named in the FSMA’s warnings about companies operating unlawfully in Belgium, with the warning’s fraud type; a listed website covers the names under it.
- Publisher
- Financial Services and Markets Authority (Belgium)
- License
- CC BY 4.0
- Attribution
- Financial Services and Markets Authority (FSMA), “Companies operating unlawfully in Belgium”, fsma.be. The FSMA publishes these warnings free of charge on its website.
BaFin warnings
Websites named in BaFin’s warnings about unauthorised financial business, with the firm whose identity BaFin says is misused; a listed domain covers the names under it.
- Publisher
- Bundesanstalt für Finanzdienstleistungsaufsicht (Germany)
- License
- BaFin terms of use
- Attribution
- © Bundesanstalt für Finanzdienstleistungsaufsicht / www.bafin.de
PhishDestroy Community
A combined list of public phishing blocklists. We show it beside our own brand-name matches.
- Publisher
- PhishDestroy
- License
- PhishDestroy community dataset
- Attribution
- PhishDestroy community blocklist (github.com/phishdestroy/destroylist).
Spamhaus DROP
Address ranges for brand lookalikes on hijacked or criminal networks.
- Publisher
- The Spamhaus Project
- License
- Spamhaus DROP terms
- Attribution
- Spamhaus DROP (Don’t Route Or Peer) list, The Spamhaus Project.
Confirmed phishing hosts
Addresses that hosted a PhishTank-verified or PhishDestroy phishing site in the last 48 hours, built every hour. Shared hosting, content networks and parking services are set aside.
- Publisher
- DomainSpoof
- License
- DomainSpoof
Certificate-transparency logs
Every new certificate and the hostnames it names.
- Publisher
- Public CT log operators
- License
- Public logs (RFC 6962)
IP to ASN
The country flag, AS number and operator shown for each address.
- Publisher
- iptoasn.com
- License
- Public Domain (PDDL 1.0)
- Attribution
- IP to ASN data from https://iptoasn.com/
Domain registration
Registration date and registrar for each finding’s domain.
- Publisher
- Registries via RDAP
- License
- Registry RDAP terms
ICANN CZDS zone files
Newly registered domains: we compare each day’s zone file with the day before and match the new domains to the brands we track. Lookalike listings show the matched domains and the day a zone file first listed them.
- Publisher
- Registry operators, through ICANN’s Centralized Zone Data Service
- License
- Registry zone file terms (CZDS)
- Conditions
- Lawful use only. Any marketing use, high-volume registry or registrar queries, harassing registrants and bulk extraction are barred; see our Terms.
Brand coverage: the 1,000 most-impersonated brands, ranked from published threat reports and phishing-feed telemetry. Browse the brands.
