--- title: "Domain Threat Feeds Documentation: Daily Feed & Database" slug: "/documentation/domain-threat-feeds" description: "Explore WhoisFreaks Domain Threat Feeds with daily phishing, malware, and spam CSVs, enriched with infrastructure pivots and consistent schemas." --- # Domain Threat Feeds Documentation Domain Threat Feeds deliver daily CSV files of flagged domains with scores, dates, and infrastructure links. Built from verified seed indicators and expanded via infrastructure pivots across the WhoisFreaks domain database, feeds cover phishing, malware, and spam. ## Phishing Domain Feed The Phishing Domain Feed delivers a daily CSV file of domains observed hosting credential theft pages or impersonating trusted brands. Each feed begins with verified phishing seed domains, from which the pipeline extracts shared attributes such as registrant email, phone, organization, NS, MX, and CNAME records. These pivots are then matched across the WhoisFreaks domain database to surface related domains, often before they are reported on public blocklists. Security teams load the feed into mail gateways and SIEMs to block or investigate domains built for credential theft. Your first request returns a full dump of every domain currently in the feed, and every request after that returns a daily update file containing only new and changed records. Every feed shares the same schema, so a single parser can process all threat types. **Important References:** For details on request limits and handling rate limiting, see the [Rate Limits](https://whoisfreaks.com/documentation/api-rate-limiting) documentation. For a complete overview of API credit consumption and usage, refer to the [API Credit Consumption](https://whoisfreaks.com/documentation/credit-usage) guide. ### Authorization You can make authorized requests to our API by passing your API key as a query parameter. To get your API key, login to our billing dashboard and copy it from there. If your API key has been compromised, you can change it by clicking the reset button in the billing dashboard. ### Query Parameters ##### Required * apiKey Get your API key from our billing dashboard. ##### Optional * date The date in YYYY-MM-DD format for which the daily update file is requested. If you don't pass the date parameter, a full dump of the feed is returned. * format Only CSV is available for the threat feeds. If you don't specify the format parameter, the file is delivered as CSV. ### Fields Description | Fields | Details | Example | | --- | --- | --- | | domain | Flagged domain name | 00057365.com | | threat_type | Category of detected threat | phishing | | confidence | Confidence score of the threat classification (0 to 1) | 1 | | first_seen | Timestamp when the domain was first flagged | 2026-06-12 10:15:25+00 | | last_seen | Timestamp when the domain was most recently flagged | 2026-07-09 10:12:45.256919+00 | | No_of_threat_matched_pivots | Number of infrastructure pivots that matched this domain to the threat | 3 | ## Malware Domain Feed The Malware Domain Feed delivers a daily CSV file of domains distributing malware payloads or hosting infected downloaders. The feed starts from confirmed malware seed domains, extracts the infrastructure pivots those seeds share, and matches them across the WhoisFreaks domain database to reveal related domains tied to the same campaigns. This infrastructure-level expansion surfaces malicious domains early, often before they appear on community lists. The feed loads directly into DNS firewalls and RPZ zones to stop connections before payloads are fetched. As with every feed, your first request returns a full dump of the current feed, and each request after that returns the daily file of new and changed records for lightweight ingestion. ### Query Parameters ##### Required * apiKey Get your API key from our billing dashboard. ##### Optional * date The date in YYYY-MM-DD format for which the daily update file is requested. If you don't pass the date parameter, a full dump of the feed is returned. * format Only CSV is available for the threat feeds. If you don't specify the format parameter, the file is delivered as CSV. ### Fields Description | Fields | Details | Example | | --- | --- | --- | | domain | The flagged domain name. | 000234522.xyz | | threat_type | The threat category assigned to the domain. For this feed the value is malware. | malware | | confidence | How strongly the evidence supports the classification, expressed from 0 to 1. | 1 | | first_seen | Timestamp when the domain first appeared in the WhoisFreaks threat data. | 2026-06-12 10:15:25+00 | | last_seen | Most recent timestamp on which the threat activity was observed. | 2026-07-09 10:12:45.256919+00 | | No_of_threat_matched_pivots | Number of shared infrastructure pivots that link the domain to related malware infrastructure. | 1 | ## Spam Domain Feed The Spam Domain Feed delivers a daily CSV file of domains sending unsolicited bulk email or feeding spam link networks. Verified spam seed domains are expanded through shared infrastructure pivots to reveal the wider sending networks behind each campaign, giving mail filters far more coverage than a single reported domain. Feeding the list into mail filters blocks unwanted messages surfaced through shared sending infrastructure. The delivery model matches the other feeds: your first request returns a full dump of the current feed, and every request after that returns a daily update file that carries only new and changed records, keeping ingestion fast and predictable. ### Query Parameters ##### Required * apiKey Get your API key from our billing dashboard. ##### Optional * date The date in YYYY-MM-DD format for which the daily update file is requested. If you don't pass the date parameter, a full dump of the feed is returned. * format Only CSV is available for the threat feeds. If you don't specify the format parameter, the file is delivered as CSV. ### Fields Description | Fields | Details | Example | | --- | --- | --- | | domain | The flagged domain name. | 0accounts.com | | threat_type | The threat category assigned to the domain. For this feed the value is malware. | spam | | confidence | How strongly the evidence supports the classification, expressed from 0 to 1. | 1 | | first_seen | Timestamp when the domain first appeared in the WhoisFreaks threat data. | 2026-06-12 10:15:25+00 | | last_seen | Most recent timestamp on which the threat activity was observed. | 2026-07-09 10:12:45.256919+00 | | No_of_threat_matched_pivots | Number of shared infrastructure pivots that link the domain to related malware infrastructure. | 5 |