Docs
Open Lodol
DocumentationIntegrationsAPI

PhishStats

App · 5 actions

Check URLs, domains and IP addresses against PhishStats, a free feed of millions of phishing pages reported since 2014, each scored for risk and enriched with where it was hosted. Search the feed for pages impersonating your brand, and pull the newest reports into alerts. No account needed; a free API key raises the daily limit.

Actions

ActionWhat it does
Check a domainFind out whether pages on a domain, or its subdomains, have been reported as phishing: whether it is in the PhishStats feed, its highest risk, which hosts were reported, and the reports, newest first.
Check a URLFind out whether a web address has been reported as phishing.
Check an IP addressFind out whether phishing pages have been reported on a server's IP address: whether it is in the PhishStats feed, its highest risk, the host names reported on it, and the reports, newest first.
Get recent phishing reportsGet the newest phishing pages added to the PhishStats feed, newest first, optionally only those added after a given moment, in one country, or above a minimum risk.
Search phishing reportsFind phishing pages whose title or URL contains a word, such as your brand's name, to spot sites impersonating you.

Check a domain

Find out whether pages on a domain, or its subdomains, have been reported as phishing: whether it is in the PhishStats feed, its highest risk, which hosts were reported, and the reports, newest first. Use it to watch your own domains or vet a sender's.

Inputs

DomaindomaintextRequired
The domain to check, such as example.com. A full URL or a defanged name such as example[.]com is fine; a leading www. is ignored.
Include subdomainsinclude_subdomainstrue/false
Also count pages on subdomains, such as login.example.com for example.com.Default: true.
Number of reportslimitnumber
The most matching reports to return, newest first, from 1 to 100.From 1 to 100. Default: 20.

Outputs

domaintext
The domain checked.
first_reported_attext
When the oldest report returned was recorded (UTC).
foundtrue/false
Whether PhishStats has any report matching it.
highest_scorenumber
The highest phish score among the reports, if any is scored.
hostslist
The host names the reports were on.
include_subdomainstrue/false
last_reported_attext
When the newest report returned was recorded (UTC).
more_reportstrue/false
True when there may be more reports than were returned.
report_countnumber
How many reports were returned.
reportslist
risk_labeltext
The risk in words, e.g. Not in the PhishStats feed or Phishing.
risk_leveltext
The risk of the highest-scored report: not_listed, unscored, low, suspicious, likely_phishing or phishing.
Example output
{
  "domain": "codehub-amber.vercel.app",
  "first_reported_at": "2026-08-31T19:11:10Z",
  "found": true,
  "highest_score": 7.4,
  "hosts": [
    "codehub-amber.vercel.app"
  ],
  "include_subdomains": true,
  "last_reported_at": "2026-08-31T19:11:10Z",
  "more_reports": false,
  "report_count": 1,
  "reports": [
    {
      "abuse_contacts": [
        "abuse@vercel.com"
      ],
      "asn": "AS16509",
      "city": "Miami",
      "country_code": "US",
      "country_name": "United States",
      "details_url": "https://phishstats.info/search/957ac754a8dced72bd0891a3b962d9391aceeabfb735c4cfe17d8212abc25267",
      "domain": "vercel.app",
      "domain_age_days": null,
      "host": "codehub-amber.vercel.app",
      "http_server": "Vercel",
      "http_status": 200,
      "id": 11901347,
      "ip": "64.29.17.195",
      "isp": "AMAZON-02 - Amazon.com, Inc.",
      "open_ports": [
        80,
        443
      ],
      "redirect_url": "http://www.codehub-amber.vercel.app/",
      "region": "Florida",
      "reported_at": "2026-08-31T19:11:10Z",
      "risk_label": "Phishing",
      "risk_level": "phishing",
      "score": 7.4,
      "screenshot_url": null,
      "ssl_issuer": "CN=WR1,O=Google Trust Services,C=US",
      "tags": [],
      "technologies": [
        "Vercel"
      ],
      "times_seen_domain": 398,
      "times_seen_host": 398,
      "times_seen_ip": 412,
      "title": "PayPal",
      "updated_at": "2026-08-31T19:16:40Z",
      "url": "https://codehub-amber.vercel.app/"
    }
  ],
  "risk_label": "Phishing",
  "risk_level": "phishing"
}

Check a URL

Find out whether a web address has been reported as phishing. Says whether it is in the PhishStats feed, how risky PhishStats rates it, and lists the reports with where the page was hosted. The http and https versions, and the address with or without a final /, count as the same page. To check the whole site, use Check a domain.

Inputs

URLurltextRequired
The full address to check, such as https://example.com/login. A defanged address such as hxxps://example[.]com works too.
Number of reportslimitnumber
The most matching reports to return, newest first, from 1 to 100.From 1 to 100. Default: 20.

Outputs

first_reported_attext
When the oldest report returned was recorded (UTC).
foundtrue/false
Whether PhishStats has any report matching it.
highest_scorenumber
The highest phish score among the reports, if any is scored.
last_reported_attext
When the newest report returned was recorded (UTC).
more_reportstrue/false
True when there may be more reports than were returned.
report_countnumber
How many reports were returned.
reportslist
risk_labeltext
The risk in words, e.g. Not in the PhishStats feed or Phishing.
risk_leveltext
The risk of the highest-scored report: not_listed, unscored, low, suspicious, likely_phishing or phishing.
urltext
The URL checked.
Example output
{
  "first_reported_at": "2026-08-31T19:11:10Z",
  "found": true,
  "highest_score": 7.4,
  "last_reported_at": "2026-08-31T19:11:10Z",
  "more_reports": false,
  "report_count": 1,
  "reports": [
    {
      "abuse_contacts": [
        "abuse@vercel.com"
      ],
      "asn": "AS16509",
      "city": "Miami",
      "country_code": "US",
      "country_name": "United States",
      "details_url": "https://phishstats.info/search/957ac754a8dced72bd0891a3b962d9391aceeabfb735c4cfe17d8212abc25267",
      "domain": "vercel.app",
      "domain_age_days": null,
      "host": "codehub-amber.vercel.app",
      "http_server": "Vercel",
      "http_status": 200,
      "id": 11901347,
      "ip": "64.29.17.195",
      "isp": "AMAZON-02 - Amazon.com, Inc.",
      "open_ports": [
        80,
        443
      ],
      "redirect_url": "http://www.codehub-amber.vercel.app/",
      "region": "Florida",
      "reported_at": "2026-08-31T19:11:10Z",
      "risk_label": "Phishing",
      "risk_level": "phishing",
      "score": 7.4,
      "screenshot_url": null,
      "ssl_issuer": "CN=WR1,O=Google Trust Services,C=US",
      "tags": [],
      "technologies": [
        "Vercel"
      ],
      "times_seen_domain": 398,
      "times_seen_host": 398,
      "times_seen_ip": 412,
      "title": "PayPal",
      "updated_at": "2026-08-31T19:16:40Z",
      "url": "https://codehub-amber.vercel.app/"
    }
  ],
  "risk_label": "Phishing",
  "risk_level": "phishing",
  "url": "https://codehub-amber.vercel.app/"
}

Check an IP address

Find out whether phishing pages have been reported on a server's IP address: whether it is in the PhishStats feed, its highest risk, the host names reported on it, and the reports, newest first.

Inputs

IP addressiptextRequired
The IPv4 or IPv6 address to check, such as 203.0.113.7. A defanged address such as 203.0.113[.]7 works too.
Number of reportslimitnumber
The most matching reports to return, newest first, from 1 to 100.From 1 to 100. Default: 20.

Outputs

first_reported_attext
When the oldest report returned was recorded (UTC).
foundtrue/false
Whether PhishStats has any report matching it.
highest_scorenumber
The highest phish score among the reports, if any is scored.
hostslist
The host names the reports were on.
iptext
The address checked.
last_reported_attext
When the newest report returned was recorded (UTC).
more_reportstrue/false
True when there may be more reports than were returned.
report_countnumber
How many reports were returned.
reportslist
risk_labeltext
The risk in words, e.g. Not in the PhishStats feed or Phishing.
risk_leveltext
The risk of the highest-scored report: not_listed, unscored, low, suspicious, likely_phishing or phishing.
Example output
{
  "first_reported_at": "2026-10-15T14:02:17Z",
  "found": true,
  "highest_score": 6.2,
  "hosts": [
    "49.51.43.12"
  ],
  "ip": "49.51.43.12",
  "last_reported_at": "2026-10-15T14:02:17Z",
  "more_reports": false,
  "report_count": 1,
  "reports": [
    {
      "abuse_contacts": [
        "abuse@tencent.com"
      ],
      "asn": "AS132203",
      "city": "Santa Clara",
      "country_code": "US",
      "country_name": "United States",
      "details_url": "https://phishstats.info/search/2296d1a4531d552964c91950100f1cee0183eaeb9abe4ee28b0660c21cc8c09b",
      "domain": null,
      "domain_age_days": null,
      "host": "49.51.43.12",
      "http_server": "openresty",
      "http_status": 200,
      "id": 11917960,
      "ip": "49.51.43.12",
      "isp": "TENCENT-NET-AP-CN - Tencent Building, Kejizhongyi Avenue",
      "open_ports": [
        80,
        443
      ],
      "redirect_url": null,
      "region": "California",
      "reported_at": "2026-10-15T14:02:17Z",
      "risk_label": "Phishing",
      "risk_level": "phishing",
      "score": 6.2,
      "screenshot_url": null,
      "ssl_issuer": null,
      "tags": [],
      "technologies": [],
      "times_seen_domain": 398,
      "times_seen_host": 398,
      "times_seen_ip": 412,
      "title": "Sign in - Google Accounts",
      "updated_at": "2026-10-15T14:07:02Z",
      "url": "http://49.51.43.12/v3/signin/identifier"
    }
  ],
  "risk_label": "Phishing",
  "risk_level": "phishing"
}

Get recent phishing reports

Get the newest phishing pages added to the PhishStats feed, newest first, optionally only those added after a given moment, in one country, or above a minimum risk. PhishStats adds new reports every 90 minutes, so checking more often finds nothing new.

Inputs

Reported afterreported_afterdate and time
Only reports recorded after this moment, such as the last time the workflow ran. Leave empty for the newest.
Countrycountrytext
Only pages hosted in this country, as PhishStats located their server. Leave empty for every country.One of: AF (Afghanistan), AX (Åland Islands), AL (Albania), DZ (Algeria), AD (Andorra), AO (Angola), AI (Anguilla), AQ (Antarctica), AG (Antigua & Barbuda), AR (Argentina), and 239 more.
Minimum riskminimum_risktext
Only reports PhishStats scored at least this risky. New reports are scored within a few hours, so any choice but Any leaves out the newest ones until then.One of: any (Any, including reports not scored yet), suspicious (Suspicious or worse (score 2 and up)), likely_phishing (Likely phishing or worse (score 4 and up)), phishing (Phishing (score 6 and up)). Default: any.
Number of reportslimitnumber
The most reports to return, from 1 to 100.From 1 to 100. Default: 25.
Pagepagenumber
Which page of results to return, starting at 1, when there are more reports than the number asked for.From 1 to 1000. Default: 1.

Outputs

more_reportstrue/false
True when there may be more reports than were returned.
pagenumber
The page returned, starting at 1.
report_countnumber
How many reports were returned.
reportslist
Example output
{
  "more_reports": true,
  "page": 1,
  "report_count": 2,
  "reports": [
    {
      "abuse_contacts": [
        "abuse@vercel.com"
      ],
      "asn": "AS16509",
      "city": "Miami",
      "country_code": "US",
      "country_name": "United States",
      "details_url": "https://phishstats.info/search/957ac754a8dced72bd0891a3b962d9391aceeabfb735c4cfe17d8212abc25267",
      "domain": "vercel.app",
      "domain_age_days": null,
      "host": "codehub-amber.vercel.app",
      "http_server": "Vercel",
      "http_status": 200,
      "id": 11901347,
      "ip": "64.29.17.195",
      "isp": "AMAZON-02 - Amazon.com, Inc.",
      "open_ports": [
        80,
        443
      ],
      "redirect_url": "http://www.codehub-amber.vercel.app/",
      "region": "Florida",
      "reported_at": "2026-08-31T19:11:10Z",
      "risk_label": "Phishing",
      "risk_level": "phishing",
      "score": 7.4,
      "screenshot_url": null,
      "ssl_issuer": "CN=WR1,O=Google Trust Services,C=US",
      "tags": [],
      "technologies": [
        "Vercel"
      ],
      "times_seen_domain": 398,
      "times_seen_host": 398,
      "times_seen_ip": 412,
      "title": "PayPal",
      "updated_at": "2026-08-31T19:16:40Z",
      "url": "https://codehub-amber.vercel.app/"
    },
    {
      "abuse_contacts": [
        "abuse@tencent.com"
      ],
      "asn": "AS132203",
      "city": "Santa Clara",
      "country_code": "US",
      "country_name": "United States",
      "details_url": "https://phishstats.info/search/2296d1a4531d552964c91950100f1cee0183eaeb9abe4ee28b0660c21cc8c09b",
      "domain": null,
      "domain_age_days": null,
      "host": "49.51.43.12",
      "http_server": "openresty",
      "http_status": 200,
      "id": 11917960,
      "ip": "49.51.43.12",
      "isp": "TENCENT-NET-AP-CN - Tencent Building, Kejizhongyi Avenue",
      "open_ports": [
        80,
        443
      ],
      "redirect_url": null,
      "region": "California",
      "reported_at": "2026-10-15T14:02:17Z",
      "risk_label": "Phishing",
      "risk_level": "phishing",
      "score": 6.2,
      "screenshot_url": null,
      "ssl_issuer": null,
      "tags": [],
      "technologies": [],
      "times_seen_domain": 398,
      "times_seen_host": 398,
      "times_seen_ip": 412,
      "title": "Sign in - Google Accounts",
      "updated_at": "2026-10-15T14:07:02Z",
      "url": "http://49.51.43.12/v3/signin/identifier"
    }
  ]
}

Search phishing reports

Find phishing pages whose title or URL contains a word, such as your brand's name, to spot sites impersonating you. Narrow it to a country, a minimum risk or a start date.

Inputs

Brand or keywordquerytextRequired
The text to look for, such as a brand name. Upper and lower case are matched alike.
Search insearch_intext
Where the text has to appear.One of: title_or_url (Page title or URL), title (Page title only), url (URL only). Default: title_or_url.
Countrycountrytext
Only pages hosted in this country, as PhishStats located their server. Leave empty for every country.One of: AF (Afghanistan), AX (Åland Islands), AL (Albania), DZ (Algeria), AD (Andorra), AO (Angola), AI (Anguilla), AQ (Antarctica), AG (Antigua & Barbuda), AR (Argentina), and 239 more.
Minimum riskminimum_risktext
Only reports PhishStats scored at least this risky. New reports are scored within a few hours, so any choice but Any leaves out the newest ones until then.One of: any (Any, including reports not scored yet), suspicious (Suspicious or worse (score 2 and up)), likely_phishing (Likely phishing or worse (score 4 and up)), phishing (Phishing (score 6 and up)). Default: any.
Reported sincereported_sincedate
Only reports recorded on or after this day (UTC). Leave empty for all of them.
Sort bysorttext
The order the reports come in.One of: newest (Newest first), oldest (Oldest first), highest_score (Highest score first). Default: newest.
Number of reportslimitnumber
The most reports to return, from 1 to 100.From 1 to 100. Default: 25.
Pagepagenumber
Which page of results to return, starting at 1, when there are more reports than the number asked for.From 1 to 1000. Default: 1.

Outputs

more_reportstrue/false
True when there may be more reports than were returned.
pagenumber
The page returned, starting at 1.
querytext
The text searched for.
report_countnumber
How many reports were returned.
reportslist
Example output
{
  "more_reports": true,
  "page": 1,
  "query": "paypal",
  "report_count": 2,
  "reports": [
    {
      "abuse_contacts": [
        "abuse@vercel.com"
      ],
      "asn": "AS16509",
      "city": "Miami",
      "country_code": "US",
      "country_name": "United States",
      "details_url": "https://phishstats.info/search/957ac754a8dced72bd0891a3b962d9391aceeabfb735c4cfe17d8212abc25267",
      "domain": "vercel.app",
      "domain_age_days": null,
      "host": "codehub-amber.vercel.app",
      "http_server": "Vercel",
      "http_status": 200,
      "id": 11901347,
      "ip": "64.29.17.195",
      "isp": "AMAZON-02 - Amazon.com, Inc.",
      "open_ports": [
        80,
        443
      ],
      "redirect_url": "http://www.codehub-amber.vercel.app/",
      "region": "Florida",
      "reported_at": "2026-08-31T19:11:10Z",
      "risk_label": "Phishing",
      "risk_level": "phishing",
      "score": 7.4,
      "screenshot_url": null,
      "ssl_issuer": "CN=WR1,O=Google Trust Services,C=US",
      "tags": [],
      "technologies": [
        "Vercel"
      ],
      "times_seen_domain": 398,
      "times_seen_host": 398,
      "times_seen_ip": 412,
      "title": "PayPal",
      "updated_at": "2026-08-31T19:16:40Z",
      "url": "https://codehub-amber.vercel.app/"
    },
    {
      "abuse_contacts": [
        "abuse@tencent.com"
      ],
      "asn": "AS132203",
      "city": "Santa Clara",
      "country_code": "US",
      "country_name": "United States",
      "details_url": "https://phishstats.info/search/2296d1a4531d552964c91950100f1cee0183eaeb9abe4ee28b0660c21cc8c09b",
      "domain": null,
      "domain_age_days": null,
      "host": "49.51.43.12",
      "http_server": "openresty",
      "http_status": 200,
      "id": 11917960,
      "ip": "49.51.43.12",
      "isp": "TENCENT-NET-AP-CN - Tencent Building, Kejizhongyi Avenue",
      "open_ports": [
        80,
        443
      ],
      "redirect_url": null,
      "region": "California",
      "reported_at": "2026-10-15T14:02:17Z",
      "risk_label": "Phishing",
      "risk_level": "phishing",
      "score": 6.2,
      "screenshot_url": null,
      "ssl_issuer": null,
      "tags": [],
      "technologies": [],
      "times_seen_domain": 398,
      "times_seen_host": 398,
      "times_seen_ip": 412,
      "title": "Sign in - Google Accounts",
      "updated_at": "2026-10-15T14:07:02Z",
      "url": "http://49.51.43.12/v3/signin/identifier"
    }
  ]
}

PhantomBuster

Previous Page

PHP-Noise

Next Page

On this page

ActionsCheck a domainCheck a URLCheck an IP addressGet recent phishing reportsSearch phishing reports