Threat-intelligence feed
PhishingLast verified Page fetched
OpenPhish Feed is a phishing threat-intelligence feed tracked by WhisperGraph as a FEED_SOURCE node. The Whisper Internet Directory publishes this page so security analysts and LLM agents can link to it as a stable record for OpenPhish Feed.
OpenPhish Feed is the public-tier phishing-URL feed from OpenPhish, a long-running automated phishing-detection service. It enumerates URLs (and the underlying domains/hosts) currently confirmed to be hosting active credential-harvest pages. The free public feed is rate-limited and lags the commercial premium tier, but is sufficient for SOC enrichment, browser-extension allow-list work, and research. Detection is automated using a combination of URL clustering, brand-similarity matching against legitimate origins, and active-page content inspection; verified-phish entries pass through a confidence threshold before publication. It is indexed here because OpenPhish is one of the most cited phishing feeds in academic measurement work.
FEED_SOURCE node not currently in WhisperGraph. The editorial entry for OpenPhish Feedis committed to the directory but the corresponding graph node is missing — typically a transient state during the threat-feed import pipeline's between-runs window. The page will reconcile on the next revalidation.
Indicators: Computing — check back later. The precompute pipeline is building this feed's indicator sample from the host corpus and will populate the count and representative addresses on an upcoming run.
Look up which threat feeds list a given IP — the indicator-anchored query that powers the threat card:
MATCH (ip:IPV4 {name: $ip})-[:LISTED_IN]->(f:FEED_SOURCE)
WHERE f.name = "OpenPhish Feed"
WITH f
MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.name AS feed, c.name AS categoryVerify the feed's graph-side identity directly:
MATCH (f:FEED_SOURCE {name: "OpenPhish Feed"})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.id AS id, f.name AS name, c.name AS categoryOr query Whisper from your own LLM workflow via the Whisper MCP server.
Pivot from OpenPhish Feed into adjacent entities.