Phishing Hosting Domains
Hostnames currently hosting live phishing pages, detected because they serve phishing URLs that are online right now. It complements the T1566 - Phishing URL feed for controls that block at domain level, such as DNS filtering and web proxies. It may include legitimate sites that were hacked to host a phishing kit; exclude compromised hostnames if you want only attacker-owned domains for strict blocking.
- Author
- davidgil
- Created
- 2026-11-03 14:26:49
- Last updated
- 2026-11-03 14:27:05
- Downloads
- 40
- Hostname indicators
- 97893
Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.