Domain Threat Feeds Documentation

The Phishing Domain Feed delivers a daily CSV file of domains observed hosting credential theft pages or impersonating trusted brands. Each feed begins with verified phishing seed domains, from which the pipeline extracts shared attributes such as registrant email, phone, organization, NS, MX, and CNAME records. These pivots are then matched across the WhoisFreaks domain database to surface related domains, often before they are reported on public blocklists. Security teams load the feed into mail gateways and SIEMs to block or investigate domains built for credential theft. Your first request returns a full dump of every domain currently in the feed, and every request after that returns a daily update file containing only new and changed records. Every feed shares the same schema, so a single parser can process all threat types.

The Malware Domain Feed delivers a daily CSV file of domains distributing malware payloads or hosting infected downloaders. The feed starts from confirmed malware seed domains, extracts the infrastructure pivots those seeds share, and matches them across the WhoisFreaks domain database to reveal related domains tied to the same campaigns. This infrastructure-level expansion surfaces malicious domains early, often before they appear on community lists. The feed loads directly into DNS firewalls and RPZ zones to stop connections before payloads are fetched. As with every feed, your first request returns a full dump of the current feed, and each request after that returns the daily file of new and changed records for lightweight ingestion.

The Spam Domain Feed delivers a daily CSV file of domains sending unsolicited bulk email or feeding spam link networks. Verified spam seed domains are expanded through shared infrastructure pivots to reveal the wider sending networks behind each campaign, giving mail filters far more coverage than a single reported domain. Feeding the list into mail filters blocks unwanted messages surfaced through shared sending infrastructure. The delivery model matches the other feeds: your first request returns a full dump of the current feed, and every request after that returns a daily update file that carries only new and changed records, keeping ingestion fast and predictable.