Phishing.Database publishes continuously tested feeds of phishing domains, links, and IPs so defenders and authorized security teams can block threats without paying for proprietary intelligence.
| Tool | Phishing-Database/Phishing.Database — regularly updated open-source feeds of phishing domains, links, and IPs with validity status |
| Category | threat intelligence / blocklist data repository |
| Primary Use | Feeding ALL-phishing-domains.lst, phishing-links-ACTIVE-NOW.txt, and phishing-IPs-ACTIVE.txt into DNS filtering, proxies, SIEMs, and research pipelines during authorized defensive operations |
| Safe Use | Blocking and analysis on networks you are authorized to defend; lab research; takedown and awareness work by defensive teams |
| Telemetry Note | This is a defender-side resource; the project itself publishes integrity md5/sha512 checksums for every artifact, and detections surface indirectly via its VirusTotal vendor integration |
Phishing-Database is not a scanner, framework, or exploit kit — it is something rarer and arguably more operationally useful: a free, continuously refreshed corpus of phishing indicators that you can drop directly into existing defensive infrastructure. The repository, sitting at roughly 1,600 stars under an MIT license, positions itself explicitly against the paywalled threat-intelligence model, stating that data on phishing, malware, and ransomware criminal activity 'should always remain free and open-source.' For blue teams with no budget for commercial feeds, that framing alone makes it worth a close look.
The project's core methodology, referenced in its own description, relies on PyFunceble — a domain and IP availability testing tool — to continuously re-check every recorded indicator and sort it by current status. That is the key architectural detail separating this from a naive scraped list. Rather than accumulating stale entries forever, the data is partitioned into ACTIVE, INACTIVE, and INVALID buckets, so a consumer can choose between maximum coverage (everything ever captured) and precision (only what resolves right now). At the time of the README snapshot, the corpus contained 497,247 captured phishing domains and 784,405 phishing links, with the latest version string reading V.2026-10-02.17 — evidence of near-daily regeneration.
The headline artifact set is straightforward plain text. ALL-phishing-domains.lst and ALL-phishing-links.lst carry the full historical corpus, while phishing-domains-ACTIVE.txt, phishing-domains-INACTIVE.txt, and phishing-domains-INVALID.txt provide status-filtered views. There is also an IP dimension via phishing-IPs-ACTIVE.txt, phishing-IPs-INACTIVE.txt, and phishing-IPs-INVALID.txt, which matters for teams running egress filtering or wanting to correlate hosting infrastructure across campaigns. For freshness-critical use, the dashboard-style counters highlight phishing-links-ACTIVE-NOW.txt — reportedly holding tens of thousands of live links at a given snapshot — alongside phishing-links-ACTIVE-today.txt and phishing-links-NEW-today.txt for same-day triage.
Getting the data is intentionally boring. The canonical files are mirrored at the project's own distribution host, phish[.]co[.]za, with the bulk archives also available as ALL-phishing-domains.tar.gz (about 4.4 MB) and ALL-phishing-links.tar.gz (about 14 MB) — small enough to pull on a schedule with curl or wget inside any automation pipeline. A minimal integration looks like curl -O https://phish.co.za/latest/phishing-domains-ACTIVE.txt followed by whatever normalization your sink expects. Because everything is newline-delimited plain text, no parser, SDK, or API key is required; a simple while read loop or a few lines of Python is sufficient to transform it into RPZ zones, proxy ACLs, or SIEM lookup tables.
Supply-chain integrity is handled better than in most community feeds. Every artifact has matching md5, sha1, sha256, and sha512 checksums published in a dedicated companion repository, Phishing-Database/checksums. Any team ingesting this into production filtering should verify those digests before each deploy — the README makes this trivially easy, and treating an external blocklist as untrusted input is good hygiene regardless of source. The separation of checksums into their own repo also means you can pin specific verified snapshots rather than blindly following the latest path.
The project's credibility is reinforced by an integration most feeds never achieve: it is an official data vendor for VirusTotal. Practically, this means detections attributed to this project already appear in VT's vendor column, which has a downstream consequence the README addresses directly — false positives discovered on VirusTotal should be reported back through the repository's issue tracker. The maintainers track false-positive-report, phishing-report, and bug labeled issues via visible badges, which signals an active remediation loop rather than a fire-and-forget dump.
That correction loop matters because status-based blocklists are inherently noisy. A domain that hosted a phishing kit last month may have been re-registered, cleaned, or parked; conversely, INACTIVE entries frequently reactivate under new infrastructure. The tri-state ACTIVE/INACTIVE/INVALID model gives operators the knobs to manage this: security-conscious mail gateways might block on ACTIVE only, while hunting and retrospective investigations benefit from the full ALL- corpora. Understanding which bucket you are consuming — and at what snapshot date — is the single most important operational decision when integrating this feed.
For defensive engineers, the natural consumption patterns are well trodden. Convert phishing-domains-ACTIVE.txt into a DNS Response Policy Zone or firewall alias for network-level blocking; load the link lists into a proxy or secure email gateway as URL categorization input; or match egress and web-server logs against phishing-IPs-ACTIVE.txt to detect users already touching phishing infrastructure. Researchers and tool developers are explicitly invited to build on top of the data — the README solicits adopter showcases, and the MIT license imposes no restriction on derivative tooling, provided attribution norms are respected.
Consumers should keep a few caveats in mind. The data is delivered as raw indicator lists without per-entry context such as targeted brands, first-seen timestamps, or campaign clustering, so enrichment is on you. Defanged and plain-text URLs inside the corpora are themselves hostile — treat the lists strictly as data to match against, never content to fetch, and never open entries from phishing-links-ACTIVE-NOW.txt in a browser. Finally, because the feed updates multiple times daily, pin your ingestion cadence and checksum verification together so rollback and audit remain possible.
In a landscape where phishing intelligence is routinely locked behind subscriptions, Phishing.Database delivers a genuinely community-grade alternative: tested, status-classified, checksummed, and updated daily. It is the kind of unglamorous infrastructure project that quietly raises the floor for everyone — SOC analysts correlating alerts, researchers measuring phishing ecosystems, and developers shipping awareness tooling — and its VirusTotal vendor status confirms the data holds up under third-party scrutiny. For authorized defensive work, it belongs on the shortlist of feeds worth automating around.
Phishing-Database/Phishing.Database.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.