OpenPhish Community Feed API
Free OpenPhish community feed with no key: a live plain-text list of active phishing URLs, refreshed continuously. One URL per line, ready for blocklists and enrichment.
Endpoint tested and returned HTTP 200 on 2026-08-21
What is the OpenPhish Community Feed API?
The OpenPhish community feed is a free, key-free plain-text list of currently active phishing URLs, one per line. It is a sampled subset of OpenPhish's commercial feed, refreshed on a regular schedule and intended for non-commercial anti-phishing use.
This is about as simple as a threat feed gets: fetch a URL, get newline-delimited phishing URLs. No JSON, no authentication, no query parameters. That simplicity is why it appears in so many DNS sinkholes, mail filters and enrichment pipelines — a two-line script keeps a local blocklist current. The URLs are full paths rather than bare domains, which matters because a great deal of modern phishing lives on compromised legitimate sites and shared hosting where blocking the domain would take down innocent content.
The sample is instructive about how phishing actually works now. Rather than obscure attacker-registered domains, most entries sit on free platforms and cloud storage — `webflow.io`, `weebly.com`, `pages.dev`, `vercel.app`, `github.io`, S3-compatible buckets — because those give attackers free hosting, a valid certificate and a reputable parent domain. Two operational notes: the community feed is a subset of the paid product with a delay, and its terms restrict commercial redistribution, so read the licence before building it into a product. The canonical URL also redirects to a GitHub-hosted copy, so follow redirects.
Quick facts
- Base URL
https://openphish.com- Authentication
- No API key or account. The community feed is free for non-commercial use under OpenPhish's terms; commercial use and redistribution require a paid subscription. Read the terms before embedding it in a product.
- Rate limit
- No published limit, but the feed regenerates on a fixed schedule — OpenPhish asks that you fetch it no more than a few times an hour.
- Pricing
- Free for non-commercial use. Commercial feeds with full coverage and faster updates are paid.
- CORS
- Enabled — callable directly from browser JavaScript
- Official docs
- Read the docs
How to use the OpenPhish Community Feed API
Every request below was executed against the live API on 2026-08-21, and the response shown is the real body it returned — not an illustration.
1. Fetch the current community phishing URL feed
GET https://raw.githubusercontent.com/openphish/public_feed/refs/heads/main/feed.txt
curl 'https://raw.githubusercontent.com/openphish/public_feed/refs/heads/main/feed.txt'const res = await fetch("https://raw.githubusercontent.com/openphish/public_feed/refs/heads/main/feed.txt");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);import requests
res = requests.get("https://raw.githubusercontent.com/openphish/public_feed/refs/heads/main/feed.txt", timeout=20)
res.raise_for_status()
print(res.json())http://swisborrgloginmain.webflow.io/
http://verifysecurenow.weebly.com/
https://s4w.in/www-roblox-com-users-365698823823-profile
https://www.roblox.com.ml/users/365698823824/profile
https://movie875.shop/buy/register.php?ref=
https://steamncomnnunity.ru/id/7656119798487731
https://asdbanorte.cfd/mx
https://sp22ct-zorvi-biz-maku-nelo-6ub.pages.dev/
https://telcgram.us.cc/h5/
https://telcgram.us.cc/
http://www.0365nn.com/
https://usc1.contabostorage.com/4d55fb8ca3ab4f4bb6795606a458b59a:authe/web-secure_evc.html
https://admin.tiktokshopvip.com/
https://picker770.github.io/amazon-clone-project/
https://vinis0usa.github.io/instagram_login/
https://phantomwalletsupport.github.io/Phantom-Wallet-Official/
https://adhieswari13-cmyk.github.io/UI-UX-Design./
https://cvqgs3140lk-wtrkbpli-3jl80d-cvq63c.pages.dev/send_appeal_request
http://metamask-docs-l8lvh00ol-consensys-ddffed67.vercel.app/sdk/multichain/connect/guides/send-transactions/
http://allegrolokalnie.167v922n4212.lol/oferta/id-lrzkuhrzay-playstation-5-pro-2-pady-i-duzo-gier/
http://winsbonuss.netlify.app/
https://loginservice.cloud/E.IeAjcEh3cQNi7sQJ?/linkedin/slink?code=afSN103785
http://142cee.ralind.at/referal/endetal.php
https://polimova.com/geboes/prup-secure.html
https://www.roblox.com.ml/users/402261613481/profile
http://vmi3503792.contaboserver.net/rssvp/Invte/view/
https://qr.fm/0MbCqS
https://financialcompany-controls.s3.us-east-005.backblazeb2.com/aumento.html
http://barclkaysbankk.support/
http://netflx-update.com/fiscalio/netflixx/
https://www.roblox.com.bn/games/9697246773/Cart-Ride-Into-Spider-Man-SpidermaParameters
| Parameter | Type | Required | Description |
|---|---|---|---|
(no parameters) | n/a | Optional | A static text file. Fetch and parse line by line. |
(redirect) | n/a | Optional | The canonical URL redirects to a GitHub-hosted copy of the feed. Follow redirects. |
Response fields
(body)text- Newline-delimited phishing URLs, one per line, with no header, footer or metadata.
(entries)string- Full URLs including scheme and path, not bare domains — phishing frequently lives on a path of an otherwise legitimate host.
What you can build with the OpenPhish Community Feed API
- Populate a DNS sinkhole or proxy blocklist
- Check outbound links in a mail or chat filter
- Enrich SIEM alerts with known phishing indicators
- Study phishing hosting trends across platforms
- Warn users before they follow a flagged link
Common errors and how to fix them
Blocking whole domains by mistake
Entries are full URLs on frequently legitimate hosts.
Fix: Match the full URL or the path prefix. Blocking `github.io` or `pages.dev` because one page was flagged takes down enormous amounts of innocent content.
Feed appears unchanged
It regenerates on a schedule, not continuously.
Fix: Fetch every 15 to 30 minutes at most. More frequent polling returns identical bytes.
Redirect not followed
The canonical URL 302s to a mirror.
Fix: Enable redirect following. A client configured not to follow will get an empty body.
Coverage gaps
The community feed is a delayed subset.
Fix: Full coverage and faster updates are commercial. Combine with other free feeds if you need breadth without paying.
OpenPhish Community Feed API — frequently asked questions
Is the OpenPhish feed free?
The community feed is free for non-commercial use with no key or account. It is a sampled, delayed subset of the commercial product, and OpenPhish's terms restrict commercial use and redistribution — worth reading before you build it into anything you sell.
Why are so many entries on legitimate hosting platforms?
Because that is where phishing lives now. Free site builders, cloud storage and preview deployments give attackers zero-cost hosting, a valid TLS certificate and a reputable parent domain. It is also why you must match full URLs rather than domains.
How often is the feed updated?
It regenerates on a regular schedule through the day. Fetching every 15 to 30 minutes keeps you current; polling more often just re-downloads the same bytes.
Can I use this in a commercial product?
Not the community feed. Its terms limit it to non-commercial use, and commercial deployment requires an OpenPhish subscription — which also gets you full coverage rather than a sampled subset.
Tools that pair with this API
Extract URLs
Extract all URLs and links from any text online. Detect http, https and www addresses, remove duplicates, sort them, and export one per line or comma-separated.
URL Parser
Parse a URL into protocol, host, port, path, query parameters and hash. Handles relative URLs with a base and shows query params in a table. Free and private.
IP Blocklist Generator
Turn a list of IPs and CIDR ranges into nginx, Apache, iptables, ufw, netsh or plain CIDR rules, with duplicates removed and ranges merged.
OpenPhish Community Feed is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-21; always check the official documentation before relying on this API in production, as terms and limits can change.