Skip to content
Install MCP

Threat feed

Phishing Database: Domains

Last fetched

Phishing · refreshed hourly · last verified

Phishing Database: Domains is a Phishing threat-intelligence feed, refreshed hourly, indexed by WhisperGraph.

Live data for this page is temporarily unavailable.

The graph returned an error for this lookup. Refresh in a moment to retry — fresh data is fetched on the next visit.

What is Phishing Database: Domains

Phishing Database: Domains is the domain-level export of the Phishing.Database project (originally started by Mitchell Krogza and now community-maintained), one of the most frequently updated open phishing-domain aggregators on GitHub, combining and de-duplicating data from OpenPhish, PhishTank, and other public phishing-tracking sources multiple times per day. The project's publish-everything approach — separate exports for active-only versus active-plus-inactive domains, and companion IP and URL variants also indexed here — makes it a popular base layer for other downstream blocklist projects to build on. It is indexed here as one of the most widely re-used open phishing-domain aggregators.

Source
https://github.com/mitchellkrogza/Phishing.Database
Refresh cadence
hourly

Indicators currently listed

Related pages

Pivot from Phishing Database: Domains into the indicators it lists.

Queries

Resolves the feed's categories.


MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categories
Run yourself →

The indicator-kind rollup and sample listed above.


MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESC
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.