Phishing Database
The Phishing Database is a community-maintained collection of confirmed phishing domains and URLs, maintained by Mitchell Krog. It aggregates data from multiple phishing intelligence feeds with automated verification, providing a regularly updated resource for identifying active phishing infrastructure.
Source:Phishing Database
What is the Phishing Database?
Phishing attacks remain one of the most common vectors for credential theft, financial fraud, and initial access in targeted intrusions. The Phishing Database project addresses this by collecting, verifying, and publishing lists of domains and URLs actively used in phishing campaigns.
The database draws from multiple upstream phishing feeds and community reports. Each reported domain goes through an automated verification pipeline that checks whether the phishing content is still live, validates the report against multiple indicators, and categorizes the entry. This verification step is important because phishing domains are often short-lived: attackers register a domain, deploy a phishing page, harvest credentials for hours or days, and then abandon the domain. A database that does not verify entries quickly accumulates stale data.
The project publishes its data in several formats: domain-only lists for DNS-based blocking, full URL lists for web proxy filtering, and status-categorized files that distinguish between active, inactive, and invalid entries. This makes the data usable across different security tools and filtering architectures.
Phishing domains in the database typically impersonate banks, email providers, cloud services, social media platforms, cryptocurrency exchanges, and government agencies. Common techniques include typosquatting (registering misspellings of legitimate domains), use of legitimate-sounding subdomains on throwaway base domains, and exploitation of free hosting and URL shortening services.
How We Use This Data
We integrate the Phishing Database into our domain reputation checks. When you look up a domain on robtex.com or rbls.org, we check it against this database and flag any matches. A domain listed here has been identified as hosting phishing content, which is a direct indicator of malicious intent.
This is particularly valuable for email security analysis. When investigating a suspicious link from an email, checking the domain against the Phishing Database can quickly confirm whether it is part of a known phishing campaign. The database's focus on verification helps ensure that flagged domains represent genuine threats rather than false positives.