Skip to content
Install MCP

Threat feed

Phishing Army

Last fetched

Phishing · refreshed daily · last verified

Phishing Army is a Phishing threat-intelligence feed, refreshed daily, indexed by WhisperGraph.

Live data for this page is temporarily unavailable.

The graph returned an error for this lookup. Refresh in a moment to retry — fresh data is fetched on the next visit.

What is Phishing Army

Phishing Army is a DNS-blocklist-formatted phishing-domain feed aggregating data from multiple upstream phishing-tracking sources (including OpenPhish and PhishTank) into a single hosts-file-compatible list, published in both a standard and an "extended" tier. Its DNS-blocklist-first distribution format, rather than an API or raw indicator export, targets the Pi-hole and AdGuard Home deployment audience specifically rather than SIEM or enterprise firewall integration. As with other aggregator-style phishing feeds, it inherits the combined coverage and combined false-positive characteristics of its upstream sources. It is indexed here as a DNS-blocklist-oriented phishing aggregator.

Source
https://phishing.army/
Refresh cadence
daily

Indicators currently listed

Related pages

Pivot from Phishing Army into the indicators it lists.

Queries

Resolves the feed's categories.


MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categories
Run yourself →

The indicator-kind rollup and sample listed above.


MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESC
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.