Block the malicious hostname, not the whole neighbourhood.

A listing is not a judgement about an organization

The presence of a hostname means that at least one upstream source associated it with phishing activity. It does not mean that the company, domain owner or entire infrastructure is malicious. This distinction is especially important for hosting providers, universities, SaaS products, AI services and user-generated-content platforms.

The explicitly declared harmless hostnames amiprotected.it and www.amiprotected.it are local filtering tests, not upstream phishing reports. See how to test your configuration.

The observed hostname is the starting point

After validation and whitelist checks, Phishing Army blocks the hostname reported by a source. A hostname beginning with the exact relative label www may also add its registrable parent. Arbitrary subdomains are not automatically promoted.

Shared hosting and dynamic DNS

Services such as Netlify, Vercel, No-IP and other multi-tenant platforms have legitimate roots used by many unrelated people. A malicious tenant like phishing.example-platform.test can be blocked without adding example-platform.test.

The same rule applies to free web hosting and dynamic DNS. A provider is not considered malicious merely because one customer abuses it.

User-generated content needs isolation

Form builders, link-in-bio services, document sharing, free hosting, landing-page builders and similar platforms can be abused even when their core business is legitimate. At DNS level, a malicious path cannot be separated from legitimate paths on the same hostname.

Providers should keep their institutional website and customer-published content on different registrable domains. A subdomain such as usercontent.company.example provides some operational separation, but a completely separate registrable domain is more robust against blocklists that work at parent-domain level. A visible abuse contact and rapid takedown process are equally important.

AI-generated HTML can become hosted phishing

An AI service that lets users generate HTML and immediately publish a live preview is also operating a form of public hosting. If criminals publish a phishing page through that feature, the infrastructure is hosting active malicious content even though the AI company itself is legitimate. Preview and published content should use a separate domain and strong anti-abuse controls.

URL shorteners

Shorteners such as bit.ly can redirect to phishing, but they are also widely used for legitimate links. DNS blocklists cannot express a path-level rule safely, so Phishing Army does not block an entire shortening service because of individual malicious redirects.

Paste and file-sharing services

Paste sites and public file-sharing platforms are frequently abused to distribute phishing HTML, payloads and malicious configuration, but also have substantial legitimate use. Broad DNS blocking can therefore create disproportionate collateral damage. Widely used services may be protected by policy while their operators are expected to maintain effective abuse handling.

Open Redirects are still an abuse vector

A clean-looking domain can be involved in phishing through a vulnerable redirect endpoint. Attackers use the reputation of the legitimate hostname as the first step toward another destination. Removing the final destination does not fix the vulnerable redirect; the original endpoint must be corrected and retested.

Compromised websites are not false positives

Phishing found under paths such as /wp-content/uploads/, random directories or hidden pages commonly indicates a compromise. Deleting the reported file is not a complete cleanup. Site owners should determine how it was uploaded, review accounts and credentials, patch components, inspect logs and remove persistence mechanisms before requesting review.

Whitelists and precedence

The manually maintained personal whitelist has the highest precedence. Shared-service policies and the reviewed popularity whitelist add further protection against broad false positives. Inclusion in a popularity ranking is a safety signal, not proof that every URL on a domain is harmless.

A popular shared-platform root does not protect all its tenants. A tenant explicitly included in the reviewed whitelist protects its own namespace. A parent rule is also suppressed if it would block a specifically allowed descendant.

A whitelist entry is not a security certification. It means only that blocking the hostname at DNS level is currently judged more harmful than allowing it. Platforms that repeatedly host phishing or do not respond to abuse reports may deliberately remain unwhitelisted.

Removal

Each build starts from current source snapshots. When a hostname disappears from every active source, and is not independently present in another feed, Phishing Army does not keep it merely because it appeared in a previous build.