Find phishing URLs that reference an organization's brand

Phishing feeds list URLs that host phishing pages or malware. This source checks those feeds for your domain or brand, so you can see whether a page built around your name is already listed. There are two ways in:

You want to…	Use
Check whether a domain appears in phishing feeds, filtered by feed and date, in one call	Look up a domain (`phishing_search`)
Find every recent phishing URL that contains a brand string, in its host or its path	Scan the feeds for a term (async)

A quick search on a domain runs the lookup. A quick search on a brand runs the scan. See Quick search. Availability: Expert Search, included in every edition. Cost: no metered allowance. With an API key, each call that returns 2xx uses 1 unit of your monthly API Calls allowance, and a non-2xx response is refunded. Every call also counts toward the per-second rate limit. See Rate limits.

Look up a domain

phishing_search checks nine phishing and blocklist feeds for a domain. The answer comes back in the same response.

curl -G https://client-api.leak.center/api/service/phishing_search/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "domain=acme-login.com" \
  --data-urlencode "date_from=2026-09-01" \
  --data-urlencode "page_size=50"

Parameter	Type	Required	Notes
`domain`	string	Yes	A domain or a brand name, such as `acme-login.com` or `acme`. A quick search sends the name without its suffix.
`source`	string	No	One feed. See the list below.
`date_from`	string	No	`YYYY-MM-DD`. Keeps entries with `created_at` on or after this date.
`date_to`	string	No	`YYYY-MM-DD`. Keeps entries with `created_at` on or before this date.
`page`	integer	No	Page number.
`page_size`	integer	No	Default `10`.

source takes one of these feed names, spelled exactly: Phishtank · Phishhunt · Openphish · Phishing Army · Phish Stats · Hagezi CTI Feed · ShadowWhisperer BlockLists · Mitchellkrogza Phishing List · Malware Filter The response holds a count of matching entries across all pages and the entries of this page in results. There are no next or previous links: page with page until you have read count entries.

domain — the domain the feed lists.
url — the listed URL.
db — the feed that lists it, one of the source names.
created_at — when the entry was recorded, in UTC. date_from and date_to filter on it.

{
  "count": 2,
  "results": [
    {
      "domain": "acme-login.com",
      "url": "https://acme-login.com/verify",
      "db": "Openphish",
      "created_at": "2026-10-06T04:12:55Z"
    },
    {
      "domain": "acme-login.com",
      "url": "https://acme-login.com/account/update",
      "db": "Phishing Army",
      "created_at": "2026-10-04T03:01:17Z"
    }
  ]
}

Scan the feeds for a term

The scan reads DarknetSearch’s own copies of four phishing feeds and keeps every URL that contains your term.

Feed	`source` value
PhishTank	`phishtank`
OpenPhish	`openphish`
Phishunt	`phishunt`
URLhaus	`urlhaus`

How the scan matches:

Case-sensitive substring of the whole URL. acme matches https://acme-login.com/verify and http://login.example/acme/. Acme does not match either.
A full domain only matches URLs that contain it literally. acme.com misses acme-login.com. Send the shortest distinctive lowercase token of your brand.
About the last 90 days. The feed copies are refreshed once a day, and an entry is dropped 90 days after DarknetSearch first stored it.

Start the scan

create_phishing_search_request takes one field, search_term: required, up to 255 characters.

curl https://client-api.leak.center/api/service/create_phishing_search_request/ \
  -X POST \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"search_term": "acme"}'

The call returns 201 with the scan:

{
  "id": "7e8f9a0b-1c2d-4e3f-8a4b-5c6d7e8f9a0b",
  "search_term": "acme",
  "create_date": "2026-10-07T09:14:02.481203Z",
  "update_date": "2026-10-07T09:14:02.481203Z",
  "is_monitoring": false,
  "alert_cycle": "week",
  "is_email": false,
  "is_reporting": false,
  "status": "in_progress",
  "report_id": null
}

Keep the id. A scan you start here runs once and does not refresh. is_monitoring, alert_cycle and is_email are monitoring settings this scan does not use. is_reporting and report_id are filled only on scans that a report started.

Poll until it ends

Fetch the scan with get_phishing_search_request until status is finished.

curl https://client-api.leak.center/api/service/get_phishing_search_request/7e8f9a0b-1c2d-4e3f-8a4b-5c6d7e8f9a0b/ \
  -H "X-API-Key: YOUR_API_KEY"

status is in_progress while the scan runs and finished when it ends. There is no failed state: a scan that hits an error also ends finished, with the URLs matched so far. Poll every 10 seconds or slower.

Read the URLs

list_phishing_search_result returns the URLs of one scan. Pass the scan id as searchrequest.

curl -G https://client-api.leak.center/api/service/list_phishing_search_result/ \
  -H "X-API-Key: YOUR_API_KEY" \
  --data-urlencode "searchrequest=7e8f9a0b-1c2d-4e3f-8a4b-5c6d7e8f9a0b" \
  --data-urlencode "page_size=1000"

searchrequest is required.
page starts at 1. page_size defaults to 100, max 1000.
The response holds count, next, previous and results. next and previous point at an internal service, so page by raising page until next is null.

What each scan result means

Each result is one URL. link, source, date_created, id and searchrequest mean the same on every row. The other fields depend on the feed, so read source first.

Field	`phishtank`	`openphish`, `phishunt`	`urlhaus`
`phish_id`	PhishTank’s ID for the entry	`"-"`	`"-"`
`target`	The brand PhishTank recorded	`"-"`	URLhaus’s threat type
`verified`	`true` when PhishTank verified the entry	always `false`	always `false`
`online`	`true` when PhishTank lists the page as online	always `false`	`true` when URLhaus listed the URL as online on `date_created`
`detail`	`{"items": [...]}`, PhishTank’s own details	`{}`	`{}`

link — the URL the feed lists.
source — the feed it came from.
date_created — the date DarknetSearch first stored the feed entry (YYYY-MM-DD).
id — the result ID, for the single-result and delete calls.
searchrequest — the scan it belongs to.

For PhishTank, verified and online are the feed’s status when the scan ran. For URLhaus, online is the status when DarknetSearch first stored the entry (date_created). Keeping only rows where verified or online is true drops every OpenPhish and Phishunt row, so read them together with source.

{
  "count": 2,
  "next": null,
  "previous": null,
  "results": [
    {
      "id": "3a4b5c6d-7e8f-4a0b-9c1d-2e3f4a5b6c7d",
      "link": "https://acme-login.com/verify",
      "verified": true,
      "online": true,
      "target": "Acme",
      "detail": { "items": [] },
      "phish_id": "8472913",
      "source": "phishtank",
      "date_created": "2026-10-06",
      "searchrequest": "7e8f9a0b-1c2d-4e3f-8a4b-5c6d7e8f9a0b"
    },
    {
      "id": "9d8c7b6a-5e4f-4d3c-8b2a-1f0e9d8c7b6a",
      "link": "http://acme-login.com/invoice.zip",
      "verified": false,
      "online": true,
      "target": "malware_download",
      "detail": {},
      "phish_id": "-",
      "source": "urlhaus",
      "date_created": "2026-10-05",
      "searchrequest": "7e8f9a0b-1c2d-4e3f-8a4b-5c6d7e8f9a0b"
    }
  ]
}

To fetch one result again, call get_phishing_search_result with its id. To follow a host from a result, search it in New domain registrations to see when it was registered, or in SSL transparency logs to see its certificates.

Monitor a domain

To receive new feed entries for a domain without repeating the lookup, create a monitor on the Phishing service (11 in the service list) with {"domain": "acme.com"} as args. It runs the same lookup as phishing_search, so each match carries domain, url, db and created_at. See Create and manage monitors and Read and triage monitor matches.

List and delete scans

list_phishing_search_request returns your organization’s scans, newest first.

page starts at 1. page_size defaults to 20, max 100.
ordering takes create_date, -create_date, update_date or -update_date. Default -create_date.

Both deletes return 204 and are permanent. Delete a scan only after it is finished.

delete_phishing_search_result removes one result.
delete_phishing_search_request removes the scan and all of its results.

Errors

Status	When	Body
`400`	`domain` is missing on `phishing_search`	`{"domain": ["This field is required."]}`
`400`	`source` is not one of the nine feed names	`{"source": ["\"<name>\" is not a valid choice."]}`
`400`	`date_from` or `date_to` is not `YYYY-MM-DD`	`{"date_from": ["Date has wrong format. Use one of these formats instead: YYYY-MM-DD."]}`
`400`	`search_term` is missing, blank or over 255 characters	`{"search_term": [...]}`
`404`	No scan or result with that `id`, or `page` is past the last page	—
`429`	The per-second rate limit is hit, or the monthly API Calls allowance is spent	See Rate limits
`502` / `504`	The feed service failed or did not answer in time	See Errors

Endpoints

Action	Endpoint
Look up a domain in phishing feeds	`GET /api/service/phishing_search/`
Start a scan	`POST /api/service/create_phishing_search_request/`
Get a scan and its status	`GET /api/service/get_phishing_search_request/{id}/`
List scans	`GET /api/service/list_phishing_search_request/`
Delete a scan and its results	`DELETE /api/service/delete_phishing_search_request/{id}/`
List a scan’s results	`GET /api/service/list_phishing_search_result/`
Get one result	`GET /api/service/get_phishing_search_result/{id}/`
Delete one result	`DELETE /api/service/delete_phishing_search_result/{id}/`

Get started

Search

Leaked credentials

Assess & report

Monitors

Domain monitoring

Downloads & exports

Changelog

Find phishing URLs that reference an organization's brand

Look up a domain

Scan the feeds for a term

What each scan result means

Monitor a domain

List and delete scans

Errors

Endpoints

​Look up a domain

​Scan the feeds for a term

​What each scan result means

​Monitor a domain

​List and delete scans

​Errors

​Endpoints

Look up a domain

Scan the feeds for a term

What each scan result means

Monitor a domain

List and delete scans

Errors

Endpoints