Every domain in the database carries the category phishing/malware and a dns_status of resolves. This page explains why the classification is deliberately single-valued, what it does and does not tell you, and the campaign shapes that make up the corpus behind it.
A taxonomy you cannot populate accurately is worse than no taxonomy at all, because it invites decisions the data cannot support.
When a lookup finds a domain, category is set to phishing/malware, dns_status is resolves, and confidence is 0.98. When it does not, all three fields come back null, null and 0.0 respectively. There is no third state and no sub-category.
phishing/malware for a hit, always null for a clean domain. Present in both the API response and the third column of the feed CSV.
resolves for a hit, because nothing that fails to resolve is published. null for a clean domain.
The API does not return these as sub-types. They are how security teams describe what they find when they investigate a hit, and knowing them tells you what to do next.
A single label is easy to enforce on and hard to reason about, so it is worth being explicit about the range of things it spans. Everything below has one property in common — a hostname that a person is persuaded to visit, standing up live infrastructure at the moment the build ran. What differs is who is being deceived, what is being taken, and which team inside your organisation meets the consequence.
The archetype: a pixel-accurate copy of a login page, reached from a message about a blocked payment, an expiring password or a held delivery. Modern kits render the full multi-step journey, including whatever reassurance step the genuine site added to prove authenticity.
A page that solicits a one-time code, a card-reader response or a push approval, and relays it into a live session against the genuine platform in real time. The victim sees a plausible spinner while an action completes on the other side.
Look at the real sample rows in the feed: weebly.com, firebaseapp.com, pages.dev, web.app. These are free or near-free hosting platforms with impeccable parent-domain reputations, which is precisely why kits are deployed on them.
A near-copy of a supplier's domain, differing by one character or a swapped TLD, carrying a request to update remittance details before a scheduled payment run. The finance team acts on it and initiates a legitimate, correctly authenticated transfer to the wrong account.
Read the sample rows again and notice 00-ede.pages.dev, 001-ede.pages.dev, 002-s.pages.dev. Serialised names are the fingerprint of bulk registration or bulk subdomain creation, where dozens of hosts are provisioned in one session and rotated through as each is taken down.
Landing pages reached from SMS, messaging apps, QR codes or search advertising rather than email. Because the link never touches a mail gateway, and is frequently opened on a personal device, neither the secure email gateway nor the endpoint agent ever sees it.
The boundary is as useful as the coverage, because it tells you which controls still need somebody else.
This hostname was reported as a phishing or malware-distribution host by curated threat-intelligence and OSINT collection, and it was independently confirmed to resolve to an active A record at the time of the most recent daily build. It is live infrastructure, not a historical indicator, and it is safe to treat as an enforcement target with a proportionate consequence.
It does not identify which brand was impersonated, which threat actor deployed the kit, what the page asked for, or how many people reached it. It is not a malware verdict on a file, not a URL-level judgement on a specific path, and not a certainty — the confidence ceiling of 0.98 is there to remind you that a review path is still required.
Equally, a false is not a clean bill of health. It means the hostname is not one of the 390,000+ live phishing hosts currently tracked — nothing more. Keep whatever content inspection, attachment sandboxing and impersonation policy you already run; this sits alongside them.
A lookup response and a feed row are generated from the same daily build, so they can never disagree about a domain.
| Field / column | Value on a hit | Value on a clean domain | Where it appears |
|---|---|---|---|
domain | The normalised hostname | The normalised hostname | API response and feed CSV column 1 |
category | phishing/malware | null | API response and feed CSV column 2 |
dns_status | resolves | null | API response and feed CSV column 3 |
is_phishing | true | false | API response only |
confidence | 0.98 | 0.0 | Single check response only |
last_checked | Build date, YYYY-MM-DD | Build date, YYYY-MM-DD | Single check response only |
database_size | Current domain count | Current domain count | Single check response only |
Five habits that get more out of a single-valued classification than a rich taxonomy would.
phishing_found from a batch rather than inspecting each result — zero means log and continue, non-zero means act on the named hosts.last_checked date with every verdict you store, so an audit can reconstruct what was known on the day.Five that come up as soon as somebody reads the response schema properly.
The field is typed as a string precisely so that it can carry more values without breaking a client, and you should parse it rather than assume the constant. Today the only value returned for a hit is phishing/malware.
is_phishing boolean; record category as descriptive metadata.Because the qualification for entry is binary. A domain is either reported by collection and confirmed resolving, or it is not published. There is no scoring model in between that would produce a meaningful spread, and inventing one would imply a precision the pipeline does not have.
No. Brand attribution requires inspecting the page content at the moment it was live, and that is a different kind of collection with a different failure mode — kits are frequently taken down or cloaked before an inspection runs, and a wrong attribution is worse than none.
Yes, and this is one of the most important properties of the dataset. Each hostname is an independent entry. 0-amazon.weebly.com being present says nothing whatsoever about weebly.com, which is not and will not be in the list.
It stops resolving, fails the DNS verification stage on the next daily build, and is removed from both the API and the feed. It appears in that day's changelog under removals, so an incremental loader drops it without any expiry logic on your side.
Get a key, batch a list of hostnames, and route on the boolean. The six shapes above are for the investigation that follows — not for the decision that blocks.
