> ## Documentation Index
> Fetch the complete documentation index at: https://wiki.darknetsearch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Phishing References

> Search the PhishTank community database for phishing sites impersonating your brand

Search the PhishTank community database for phishing sites that impersonate your brand. Use it to find live and historical phishing pages built around your name or domain, so you can confirm an active campaign and push the URLs to takedown.

This source is asynchronous. You submit a search, poll until it finishes, then read the matching phishing pages.

<Steps>
  <Step title="Submit">
    Submit a brand term. The response returns a search request `id` you will poll and read against.

    ```bash theme={"dark"}
    curl -X POST "https://client-api.leak.center/api/service/create_phishing_search_request/" \
      -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
      -H "Content-Type: application/json" \
      -d '{
        "search_term": "acme.com"
      }'
    ```

    See [create\_phishing\_search\_request](https://client-api.leak.center/scalar-docs/#tag/phishtank-monitoring/POST/service/create_phishing_search_request/).
  </Step>

  <Step title="Poll">
    Poll the request by `id` until `status` shows the search is finished.

    ```bash theme={"dark"}
    curl "https://client-api.leak.center/api/service/get_phishing_search_request/REQUEST_ID/" \
      -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
    ```

    See [get\_phishing\_search\_request](https://client-api.leak.center/scalar-docs/#tag/phishtank-monitoring/GET/service/get_phishing_search_request/\{id}/).
  </Step>

  <Step title="Read">
    Read the phishing pages. Pass the request `id` as `searchrequest`. Results are paginated.

    ```bash theme={"dark"}
    curl "https://client-api.leak.center/api/service/list_phishing_search_result/?searchrequest=REQUEST_ID&page=1&page_size=100" \
      -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
    ```

    See [list\_phishing\_search\_result](https://client-api.leak.center/scalar-docs/#tag/phishtank-monitoring/GET/service/list_phishing_search_result/).
  </Step>
</Steps>

### Request parameters

| Parameter       | Type    | Required | Notes                                                                                                                   |
| --------------- | ------- | -------- | ----------------------------------------------------------------------------------------------------------------------- |
| `search_term`   | string  | Yes      | Brand or domain to search PhishTank for. Max 255 characters. Sent in the POST body to `create_phishing_search_request`. |
| `org_id`        | string  | No       | Subsidiary organization ID. System-level users set this to scope the search to a sub-organization.                      |
| `searchrequest` | string  | Yes      | The search request `id` from the submit step. Query parameter on `list_phishing_search_result`.                         |
| `page`          | integer | No       | Page number, 1-based. Defaults to `1`.                                                                                  |
| `page_size`     | integer | No       | Results per page. Defaults to `100`.                                                                                    |

Every endpoint here costs 0 credits. Throttles are per day: 100 submits, 500 polls, and 500 result reads.

### What comes back

The submit and poll endpoints both return the search request itself. The fields that matter while polling:

* `id` — the search request ID; use it as `searchrequest` when you read results.
* `search_term` — the brand term you submitted.
* `status` — request state; poll until it reports finished.
* `create_date` / `update_date` — when the request was created and last updated.

The read endpoint returns a paginated object — `count`, `next`, `previous`, and a `results` array. Each result is one phishing page:

* `id` — result ID.
* `link` — the phishing URL.
* `phish_id` — the PhishTank submission ID for the page.
* `verified` — whether the PhishTank community confirmed it as phishing.
* `online` — whether the page was still live at last check.
* `target` — the brand PhishTank recorded the page as targeting.
* `date_created` — when the page was recorded.
* `source` — origin of the record.
* `detail` — raw PhishTank metadata for the entry.
* `searchrequest` — the parent search request ID.

```json theme={"dark"}
{
  "count": 1,
  "next": null,
  "previous": null,
  "results": [
    {
      "id": "a1b2c3d4",
      "link": "http://acme-secure-login.example/verify",
      "phish_id": "8472913",
      "verified": true,
      "online": true,
      "target": "Acme",
      "date_created": "2026-06-18",
      "source": "phishtank",
      "detail": {
        "submission_time": "2026-06-18T09:14:00Z",
        "verification_time": "2026-06-18T11:02:00Z"
      },
      "searchrequest": "REQUEST_ID"
    }
  ]
}
```

Treat `verified` and `online` pages as live takedown candidates — pull the `link` and `phish_id`, file the abuse report with the hosting provider, and re-run the search on a schedule to catch new variants of the same campaign.