Skip to content
Install MCP

Threat feed

OpenPhish Feed

Last fetched

Phishing · refreshed hourly · last verified

OpenPhish Feed is a Phishing threat-intelligence feed, refreshed hourly, indexed by WhisperGraph.

Live data for this page is temporarily unavailable.

The graph returned an error for this lookup. Refresh in a moment to retry — fresh data is fetched on the next visit.

What is OpenPhish Feed

OpenPhish Feed is the public-tier phishing-URL feed from OpenPhish, a long-running automated phishing-detection service. It enumerates URLs (and the underlying domains/hosts) currently confirmed to be hosting active credential-harvest pages. The free public feed is rate-limited and lags the commercial premium tier, but is sufficient for SOC enrichment, browser-extension allow-list work, and research. Detection is automated using a combination of URL clustering, brand-similarity matching against legitimate origins, and active-page content inspection; verified-phish entries pass through a confidence threshold before publication. It is indexed here because OpenPhish is one of the most cited phishing feeds in academic measurement work.

Source
https://openphish.com/
Refresh cadence
hourly

Indicators currently listed

Related pages

Pivot from OpenPhish Feed into the indicators it lists.

Queries

Resolves the feed's categories.


MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categories
Run yourself →

The indicator-kind rollup and sample listed above.


MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESC
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.