PhishTank Phishing URLs Scraper

PhishTank Phishing URLs Scraper

Scrape verified phishing URLs from PhishTank by keyword, validation status, and online state, up to a million per run. Every record includes the reported URL, submission date, verification status, and target brand. No API key required. Export to CSV, JSON, Excel, or XML.

PhishTank is the internet's community-powered clearinghouse for phishing data, but its web interface is built for manual lookups, not bulk collection. This Actor reads the public report feed directly, letting you filter by search term, validation status, and whether the malicious page is still online, then returns every match in one clean dataset.

Who uses it	What they scrape PhishTank for
SOC analysts	Pull the latest verified phishing URLs targeting their organization into a SIEM or threat feed.
Brand protection teams	Monitor PhishTank for newly submitted reports that mention their company name or trademarks.
Security researchers	Gather large samples of live phishing pages to study kit patterns and infrastructure.
Domain registrars and hosting providers	Find phishing sites hosted on their infrastructure so abuse teams can take them down quickly.

What it does

This Actor collects phishing report records from PhishTank filtered by keyword, validation state, and online status, and returns each one as a flat row.

• 🔍 Keyword search: filter reports by brand name, domain fragment, or any term found in the reported URL.
• ✅ Validation filter: collect only verified phishes, only unverified submissions, or both.
• 🌐 Online status filter: restrict results to phishing pages that are still reachable, already offline, or all reports regardless.
• 📊 Bulk collection: set a ceiling from one to one million reports per run, respecting the public feed order.

Results export to CSV, JSON, Excel, or XML, or straight from the API.

What you can do with PhishTank data

🛡️ Feed a SIEM with fresh phishing indicators.

A SOC analyst runs the Actor daily with a keyword for their company domain, pulls only verified and online phishes, and loads the URLs into a watchlist.

📋 Audit unverified submissions for a brand.

A brand protection manager collects all unverified reports mentioning their trademark, triages them, and submits verification votes back to the community.

🧪 Sample live phishing kits at scale.

A researcher scrapes thousands of verified, online phishing URLs, then fetches the landing pages to analyze kit families and evasion techniques.

🚨 Monitor for newly registered phishing domains.

A hosting provider pulls the latest offline-only reports to cross-reference with their customer base and identify accounts that were already terminated for abuse.

Why choose this scraper

	What you get
No API key	Reads the public PhishTank report feed directly with no registration or authentication.
Fixed schema	Every row arrives with the same fields, ready for threat intelligence pipelines.
Flexible filtering	Combine keyword, validation state, and online status to narrow results to exactly what you need.
High volume	Collect up to a million reports in a single run for large-scale analysis.

How it compares

No other Store actor targets PhishTank the same way, so the honest comparison is with the alternatives teams actually weigh.

	PhishTank Phishing URLs Scraper	Build it in-house	By hand
Setup	Run it now, zero config	Days of engineering	None, but hours per pull
When PhishTank changes	Maintained for you	You fix it	You re-learn the page
Proxies, retries, anti-bot	Built in	Your problem	Browser only
Output	Fixed JSON schema, CSV/Excel export	Whatever you build	Copy-paste
Cost	Pay per result	Engineering time	Analyst hours

Configure the run

Drive the Actor with an optional search keyword and select validation and online status filters; filtering runs as each report is read so only matching records land in your dataset. The Input tab lists every parameter.

A first run with the defaults:

{
  "maxItems": 10
}

A larger pull:

{
  "maxItems": 200
}

Pricing

Pay-per-result: $0.005 per result collected. You pay only for the results written to your dataset.

Results collected	Approximate cost
100 results	$0.50
1,000 results	$5.00
10,000 results	$50.00

New Apify accounts start with $5 in free credit.

Free users

Free-plan runs return up to 10 results as a preview. Upgrade your Apify plan to collect up to 1,000,000 results per run.

Run it

1. Create a free Apify account with $5 in credit.
2. Open the PhishTank Phishing URLs Scraper.
3. Set your inputs and any filters, then click Start.
4. Export the results as CSV, Excel, JSON, or XML from the Dataset tab.

Run it programmatically through the Apify API (run-sync-get-dataset-items) or the ApifyClient for JavaScript and Python.

Use with AI agents (MCP)

Give an AI agent live access to PhishTank through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:

$claude mcp add --transport http apify "https://mcp.apify.com?tools=parseforge/phishtank-scraper"

Then prompt it in plain language to run the scraper and read back the results.

Troubleshooting

Why am I getting no results?

Check your filters. If you set validity to 'Valid phishes only' and online status to 'Online only' with a very specific keyword, the combination may match zero reports. Try broadening one filter at a time, or set both to 'All' and add a keyword to see what is available.

The Actor returns fewer reports than my maxItems setting.

This is expected when the public feed has fewer reports matching your filters than the limit you set. The Actor stops when it runs out of matching reports, not when it hits the ceiling.

Can I scrape historical PhishTank data?

This Actor reads the current public listing, which shows recent reports. It does not access historical archives. For older data, consider PhishTank's downloadable database dumps.

The run takes a long time with a high maxItems value.

The Actor respects PhishTank's server response times. If you request a very large number of reports, the run will take longer. Schedule it during off-peak hours or reduce the limit if speed is critical.

FAQ

Question	Answer
Do I need a PhishTank API key to use this scraper?	No. This Actor reads the public web listing of reports, so no registration or API key is required.
What does the validation status filter do?	PhishTank lets the community vote on whether a submitted URL is a phish. Choose 'Valid phishes only' for confirmed threats, 'Unverified only' for submissions still under review, or 'All' to collect both.
Can I search for a specific brand or domain?	Yes. Use the search field to filter reports by a keyword like 'paypal' or a domain fragment. Leave it empty to collect the most recent reports regardless of target.
What does the online status filter mean?	It filters reports by whether the phishing page is still reachable at the time of scraping. 'Online only' returns live threats, 'Offline only' returns pages already taken down, and 'All' returns both.
How many reports can I collect in one run?	You can set the maximum from 1 up to 1,000,000 reports. The Actor stops when it reaches your limit or exhausts the available feed.
Is this Actor suitable for production threat intelligence pipelines?	Yes. The fixed output schema and bulk collection support make it straightforward to schedule regular runs and feed the results into a SIEM, SOAR, or blocklist.
Does this Actor visit the phishing pages themselves?	No. It collects the report metadata from PhishTank's listing. It does not fetch or interact with the reported phishing URLs.
Can I get only the newest reports?	The Actor reads reports in the order PhishTank presents them, which defaults to most recent first. Use the maxItems setting to cap how many you pull.
What export formats are supported?	Your dataset can be exported to CSV, JSON, Excel, or XML from the Apify platform.
Is this an official PhishTank product?	No. This is an independent scraper that reads publicly available data. PhishTank is operated by Cisco Systems, Inc.

Related actors

Browse the full ParseForge collection for more scrapers.

🆘 Need help? Email parseforge@protonmail.com with your run ID, your input, and what you expected.

⚠️ Disclaimer. This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by Cisco Systems, Inc. It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.