# PhishStats

> Check URLs, domains and IP addresses against PhishStats, a free feed of millions of phishing pages reported since 2014, each scored for risk and enriched with where it was hosted. Search the feed for pages impersonating your brand, and pull the newest reports into alerts. No account needed; a free API key raises the daily limit.

App · 5 actions. Web page: https://docs.lodol.com/docs/integrations/phishstats

## Actions

### Check a domain

Find out whether pages on a domain, or its subdomains, have been reported as phishing: whether it is in the PhishStats feed, its highest risk, which hosts were reported, and the reports, newest first. Use it to watch your own domains or vet a sender's.

**Inputs**

- Domain (`domain`, text, required): The domain to check, such as example.com. A full URL or a defanged name such as example[.]com is fine; a leading www. is ignored.
- Include subdomains (`include_subdomains`, true/false): Also count pages on subdomains, such as login.example.com for example.com. Default: `true`.
- Number of reports (`limit`, number): The most matching reports to return, newest first, from 1 to 100. From 1 to 100. Default: `20`.

**Outputs**

- `domain` (text): The domain checked.
- `first_reported_at` (text): When the oldest report returned was recorded (UTC).
- `found` (true/false): Whether PhishStats has any report matching it.
- `highest_score` (number): The highest phish score among the reports, if any is scored.
- `hosts` (list): The host names the reports were on.
- `include_subdomains` (true/false)
- `last_reported_at` (text): When the newest report returned was recorded (UTC).
- `more_reports` (true/false): True when there may be more reports than were returned.
- `report_count` (number): How many reports were returned.
- `reports` (list)
- `risk_label` (text): The risk in words, e.g. Not in the PhishStats feed or Phishing.
- `risk_level` (text): The risk of the highest-scored report: not_listed, unscored, low, suspicious, likely_phishing or phishing.

**Example output**

```json
{
  "domain": "codehub-amber.vercel.app",
  "first_reported_at": "2026-08-31T19:11:10Z",
  "found": true,
  "highest_score": 7.4,
  "hosts": [
    "codehub-amber.vercel.app"
  ],
  "include_subdomains": true,
  "last_reported_at": "2026-08-31T19:11:10Z",
  "more_reports": false,
  "report_count": 1,
  "reports": [
    {
      "abuse_contacts": [
        "abuse@vercel.com"
      ],
      "asn": "AS16509",
      "city": "Miami",
      "country_code": "US",
      "country_name": "United States",
      "details_url": "https://phishstats.info/search/957ac754a8dced72bd0891a3b962d9391aceeabfb735c4cfe17d8212abc25267",
      "domain": "vercel.app",
      "domain_age_days": null,
      "host": "codehub-amber.vercel.app",
      "http_server": "Vercel",
      "http_status": 200,
      "id": 11901347,
      "ip": "64.29.17.195",
      "isp": "AMAZON-02 - Amazon.com, Inc.",
      "open_ports": [
        80,
        443
      ],
      "redirect_url": "http://www.codehub-amber.vercel.app/",
      "region": "Florida",
      "reported_at": "2026-08-31T19:11:10Z",
      "risk_label": "Phishing",
      "risk_level": "phishing",
      "score": 7.4,
      "screenshot_url": null,
      "ssl_issuer": "CN=WR1,O=Google Trust Services,C=US",
      "tags": [],
      "technologies": [
        "Vercel"
      ],
      "times_seen_domain": 398,
      "times_seen_host": 398,
      "times_seen_ip": 412,
      "title": "PayPal",
      "updated_at": "2026-08-31T19:16:40Z",
      "url": "https://codehub-amber.vercel.app/"
    }
  ],
  "risk_label": "Phishing",
  "risk_level": "phishing"
}
```

### Check a URL

Find out whether a web address has been reported as phishing. Says whether it is in the PhishStats feed, how risky PhishStats rates it, and lists the reports with where the page was hosted. The http and https versions, and the address with or without a final /, count as the same page. To check the whole site, use Check a domain.

**Inputs**

- URL (`url`, text, required): The full address to check, such as https://example.com/login. A defanged address such as hxxps://example[.]com works too.
- Number of reports (`limit`, number): The most matching reports to return, newest first, from 1 to 100. From 1 to 100. Default: `20`.

**Outputs**

- `first_reported_at` (text): When the oldest report returned was recorded (UTC).
- `found` (true/false): Whether PhishStats has any report matching it.
- `highest_score` (number): The highest phish score among the reports, if any is scored.
- `last_reported_at` (text): When the newest report returned was recorded (UTC).
- `more_reports` (true/false): True when there may be more reports than were returned.
- `report_count` (number): How many reports were returned.
- `reports` (list)
- `risk_label` (text): The risk in words, e.g. Not in the PhishStats feed or Phishing.
- `risk_level` (text): The risk of the highest-scored report: not_listed, unscored, low, suspicious, likely_phishing or phishing.
- `url` (text): The URL checked.

**Example output**

```json
{
  "first_reported_at": "2026-08-31T19:11:10Z",
  "found": true,
  "highest_score": 7.4,
  "last_reported_at": "2026-08-31T19:11:10Z",
  "more_reports": false,
  "report_count": 1,
  "reports": [
    {
      "abuse_contacts": [
        "abuse@vercel.com"
      ],
      "asn": "AS16509",
      "city": "Miami",
      "country_code": "US",
      "country_name": "United States",
      "details_url": "https://phishstats.info/search/957ac754a8dced72bd0891a3b962d9391aceeabfb735c4cfe17d8212abc25267",
      "domain": "vercel.app",
      "domain_age_days": null,
      "host": "codehub-amber.vercel.app",
      "http_server": "Vercel",
      "http_status": 200,
      "id": 11901347,
      "ip": "64.29.17.195",
      "isp": "AMAZON-02 - Amazon.com, Inc.",
      "open_ports": [
        80,
        443
      ],
      "redirect_url": "http://www.codehub-amber.vercel.app/",
      "region": "Florida",
      "reported_at": "2026-08-31T19:11:10Z",
      "risk_label": "Phishing",
      "risk_level": "phishing",
      "score": 7.4,
      "screenshot_url": null,
      "ssl_issuer": "CN=WR1,O=Google Trust Services,C=US",
      "tags": [],
      "technologies": [
        "Vercel"
      ],
      "times_seen_domain": 398,
      "times_seen_host": 398,
      "times_seen_ip": 412,
      "title": "PayPal",
      "updated_at": "2026-08-31T19:16:40Z",
      "url": "https://codehub-amber.vercel.app/"
    }
  ],
  "risk_label": "Phishing",
  "risk_level": "phishing",
  "url": "https://codehub-amber.vercel.app/"
}
```

### Check an IP address

Find out whether phishing pages have been reported on a server's IP address: whether it is in the PhishStats feed, its highest risk, the host names reported on it, and the reports, newest first.

**Inputs**

- IP address (`ip`, text, required): The IPv4 or IPv6 address to check, such as 203.0.113.7. A defanged address such as 203.0.113[.]7 works too.
- Number of reports (`limit`, number): The most matching reports to return, newest first, from 1 to 100. From 1 to 100. Default: `20`.

**Outputs**

- `first_reported_at` (text): When the oldest report returned was recorded (UTC).
- `found` (true/false): Whether PhishStats has any report matching it.
- `highest_score` (number): The highest phish score among the reports, if any is scored.
- `hosts` (list): The host names the reports were on.
- `ip` (text): The address checked.
- `last_reported_at` (text): When the newest report returned was recorded (UTC).
- `more_reports` (true/false): True when there may be more reports than were returned.
- `report_count` (number): How many reports were returned.
- `reports` (list)
- `risk_label` (text): The risk in words, e.g. Not in the PhishStats feed or Phishing.
- `risk_level` (text): The risk of the highest-scored report: not_listed, unscored, low, suspicious, likely_phishing or phishing.

**Example output**

```json
{
  "first_reported_at": "2026-10-15T14:02:17Z",
  "found": true,
  "highest_score": 6.2,
  "hosts": [
    "49.51.43.12"
  ],
  "ip": "49.51.43.12",
  "last_reported_at": "2026-10-15T14:02:17Z",
  "more_reports": false,
  "report_count": 1,
  "reports": [
    {
      "abuse_contacts": [
        "abuse@tencent.com"
      ],
      "asn": "AS132203",
      "city": "Santa Clara",
      "country_code": "US",
      "country_name": "United States",
      "details_url": "https://phishstats.info/search/2296d1a4531d552964c91950100f1cee0183eaeb9abe4ee28b0660c21cc8c09b",
      "domain": null,
      "domain_age_days": null,
      "host": "49.51.43.12",
      "http_server": "openresty",
      "http_status": 200,
      "id": 11917960,
      "ip": "49.51.43.12",
      "isp": "TENCENT-NET-AP-CN - Tencent Building, Kejizhongyi Avenue",
      "open_ports": [
        80,
        443
      ],
      "redirect_url": null,
      "region": "California",
      "reported_at": "2026-10-15T14:02:17Z",
      "risk_label": "Phishing",
      "risk_level": "phishing",
      "score": 6.2,
      "screenshot_url": null,
      "ssl_issuer": null,
      "tags": [],
      "technologies": [],
      "times_seen_domain": 398,
      "times_seen_host": 398,
      "times_seen_ip": 412,
      "title": "Sign in - Google Accounts",
      "updated_at": "2026-10-15T14:07:02Z",
      "url": "http://49.51.43.12/v3/signin/identifier"
    }
  ],
  "risk_label": "Phishing",
  "risk_level": "phishing"
}
```

### Get recent phishing reports

Get the newest phishing pages added to the PhishStats feed, newest first, optionally only those added after a given moment, in one country, or above a minimum risk. PhishStats adds new reports every 90 minutes, so checking more often finds nothing new.

**Inputs**

- Reported after (`reported_after`, date and time): Only reports recorded after this moment, such as the last time the workflow ran. Leave empty for the newest.
- Country (`country`, text): Only pages hosted in this country, as PhishStats located their server. Leave empty for every country. One of: `AF` (Afghanistan), `AX` (Åland Islands), `AL` (Albania), `DZ` (Algeria), `AD` (Andorra), `AO` (Angola), `AI` (Anguilla), `AQ` (Antarctica), `AG` (Antigua & Barbuda), `AR` (Argentina), and 239 more.
- Minimum risk (`minimum_risk`, text): Only reports PhishStats scored at least this risky. New reports are scored within a few hours, so any choice but Any leaves out the newest ones until then. One of: `any` (Any, including reports not scored yet), `suspicious` (Suspicious or worse (score 2 and up)), `likely_phishing` (Likely phishing or worse (score 4 and up)), `phishing` (Phishing (score 6 and up)). Default: `any`.
- Number of reports (`limit`, number): The most reports to return, from 1 to 100. From 1 to 100. Default: `25`.
- Page (`page`, number): Which page of results to return, starting at 1, when there are more reports than the number asked for. From 1 to 1000. Default: `1`.

**Outputs**

- `more_reports` (true/false): True when there may be more reports than were returned.
- `page` (number): The page returned, starting at 1.
- `report_count` (number): How many reports were returned.
- `reports` (list)

**Example output**

```json
{
  "more_reports": true,
  "page": 1,
  "report_count": 2,
  "reports": [
    {
      "abuse_contacts": [
        "abuse@vercel.com"
      ],
      "asn": "AS16509",
      "city": "Miami",
      "country_code": "US",
      "country_name": "United States",
      "details_url": "https://phishstats.info/search/957ac754a8dced72bd0891a3b962d9391aceeabfb735c4cfe17d8212abc25267",
      "domain": "vercel.app",
      "domain_age_days": null,
      "host": "codehub-amber.vercel.app",
      "http_server": "Vercel",
      "http_status": 200,
      "id": 11901347,
      "ip": "64.29.17.195",
      "isp": "AMAZON-02 - Amazon.com, Inc.",
      "open_ports": [
        80,
        443
      ],
      "redirect_url": "http://www.codehub-amber.vercel.app/",
      "region": "Florida",
      "reported_at": "2026-08-31T19:11:10Z",
      "risk_label": "Phishing",
      "risk_level": "phishing",
      "score": 7.4,
      "screenshot_url": null,
      "ssl_issuer": "CN=WR1,O=Google Trust Services,C=US",
      "tags": [],
      "technologies": [
        "Vercel"
      ],
      "times_seen_domain": 398,
      "times_seen_host": 398,
      "times_seen_ip": 412,
      "title": "PayPal",
      "updated_at": "2026-08-31T19:16:40Z",
      "url": "https://codehub-amber.vercel.app/"
    },
    {
      "abuse_contacts": [
        "abuse@tencent.com"
      ],
      "asn": "AS132203",
      "city": "Santa Clara",
      "country_code": "US",
      "country_name": "United States",
      "details_url": "https://phishstats.info/search/2296d1a4531d552964c91950100f1cee0183eaeb9abe4ee28b0660c21cc8c09b",
      "domain": null,
      "domain_age_days": null,
      "host": "49.51.43.12",
      "http_server": "openresty",
      "http_status": 200,
      "id": 11917960,
      "ip": "49.51.43.12",
      "isp": "TENCENT-NET-AP-CN - Tencent Building, Kejizhongyi Avenue",
      "open_ports": [
        80,
        443
      ],
      "redirect_url": null,
      "region": "California",
      "reported_at": "2026-10-15T14:02:17Z",
      "risk_label": "Phishing",
      "risk_level": "phishing",
      "score": 6.2,
      "screenshot_url": null,
      "ssl_issuer": null,
      "tags": [],
      "technologies": [],
      "times_seen_domain": 398,
      "times_seen_host": 398,
      "times_seen_ip": 412,
      "title": "Sign in - Google Accounts",
      "updated_at": "2026-10-15T14:07:02Z",
      "url": "http://49.51.43.12/v3/signin/identifier"
    }
  ]
}
```

### Search phishing reports

Find phishing pages whose title or URL contains a word, such as your brand's name, to spot sites impersonating you. Narrow it to a country, a minimum risk or a start date.

**Inputs**

- Brand or keyword (`query`, text, required): The text to look for, such as a brand name. Upper and lower case are matched alike.
- Search in (`search_in`, text): Where the text has to appear. One of: `title_or_url` (Page title or URL), `title` (Page title only), `url` (URL only). Default: `title_or_url`.
- Country (`country`, text): Only pages hosted in this country, as PhishStats located their server. Leave empty for every country. One of: `AF` (Afghanistan), `AX` (Åland Islands), `AL` (Albania), `DZ` (Algeria), `AD` (Andorra), `AO` (Angola), `AI` (Anguilla), `AQ` (Antarctica), `AG` (Antigua & Barbuda), `AR` (Argentina), and 239 more.
- Minimum risk (`minimum_risk`, text): Only reports PhishStats scored at least this risky. New reports are scored within a few hours, so any choice but Any leaves out the newest ones until then. One of: `any` (Any, including reports not scored yet), `suspicious` (Suspicious or worse (score 2 and up)), `likely_phishing` (Likely phishing or worse (score 4 and up)), `phishing` (Phishing (score 6 and up)). Default: `any`.
- Reported since (`reported_since`, date): Only reports recorded on or after this day (UTC). Leave empty for all of them.
- Sort by (`sort`, text): The order the reports come in. One of: `newest` (Newest first), `oldest` (Oldest first), `highest_score` (Highest score first). Default: `newest`.
- Number of reports (`limit`, number): The most reports to return, from 1 to 100. From 1 to 100. Default: `25`.
- Page (`page`, number): Which page of results to return, starting at 1, when there are more reports than the number asked for. From 1 to 1000. Default: `1`.

**Outputs**

- `more_reports` (true/false): True when there may be more reports than were returned.
- `page` (number): The page returned, starting at 1.
- `query` (text): The text searched for.
- `report_count` (number): How many reports were returned.
- `reports` (list)

**Example output**

```json
{
  "more_reports": true,
  "page": 1,
  "query": "paypal",
  "report_count": 2,
  "reports": [
    {
      "abuse_contacts": [
        "abuse@vercel.com"
      ],
      "asn": "AS16509",
      "city": "Miami",
      "country_code": "US",
      "country_name": "United States",
      "details_url": "https://phishstats.info/search/957ac754a8dced72bd0891a3b962d9391aceeabfb735c4cfe17d8212abc25267",
      "domain": "vercel.app",
      "domain_age_days": null,
      "host": "codehub-amber.vercel.app",
      "http_server": "Vercel",
      "http_status": 200,
      "id": 11901347,
      "ip": "64.29.17.195",
      "isp": "AMAZON-02 - Amazon.com, Inc.",
      "open_ports": [
        80,
        443
      ],
      "redirect_url": "http://www.codehub-amber.vercel.app/",
      "region": "Florida",
      "reported_at": "2026-08-31T19:11:10Z",
      "risk_label": "Phishing",
      "risk_level": "phishing",
      "score": 7.4,
      "screenshot_url": null,
      "ssl_issuer": "CN=WR1,O=Google Trust Services,C=US",
      "tags": [],
      "technologies": [
        "Vercel"
      ],
      "times_seen_domain": 398,
      "times_seen_host": 398,
      "times_seen_ip": 412,
      "title": "PayPal",
      "updated_at": "2026-08-31T19:16:40Z",
      "url": "https://codehub-amber.vercel.app/"
    },
    {
      "abuse_contacts": [
        "abuse@tencent.com"
      ],
      "asn": "AS132203",
      "city": "Santa Clara",
      "country_code": "US",
      "country_name": "United States",
      "details_url": "https://phishstats.info/search/2296d1a4531d552964c91950100f1cee0183eaeb9abe4ee28b0660c21cc8c09b",
      "domain": null,
      "domain_age_days": null,
      "host": "49.51.43.12",
      "http_server": "openresty",
      "http_status": 200,
      "id": 11917960,
      "ip": "49.51.43.12",
      "isp": "TENCENT-NET-AP-CN - Tencent Building, Kejizhongyi Avenue",
      "open_ports": [
        80,
        443
      ],
      "redirect_url": null,
      "region": "California",
      "reported_at": "2026-10-15T14:02:17Z",
      "risk_label": "Phishing",
      "risk_level": "phishing",
      "score": 6.2,
      "screenshot_url": null,
      "ssl_issuer": null,
      "tags": [],
      "technologies": [],
      "times_seen_domain": 398,
      "times_seen_host": 398,
      "times_seen_ip": 412,
      "title": "Sign in - Google Accounts",
      "updated_at": "2026-10-15T14:07:02Z",
      "url": "http://49.51.43.12/v3/signin/identifier"
    }
  ]
}
```