Phishing Army FAQ

Visit amiprotected.it, our deliberately harmless test site. With an up-to-date Phishing Army feed enabled, the domain should be blocked. If the page opens, check your feed subscription, list updates and filtering settings. This checks one test domain, not protection against every phishing attack. A failed connection alone does not prove which filter caused the block.

Visit amiprotected.it

No. A listing means that an upstream source associated a hostname with phishing activity. It is not a judgement about the company, domain owner or entire infrastructure, and Phishing Army is not an autonomous phishing-detection engine.

A legitimate organization can still have a compromised page, hidden upload, vulnerable redirect or customer-controlled resource. Review the specific reported URL. HTTPS, a valid certificate, Cloudflare or a clean homepage do not prove that every path is safe.

Phishing Army is primarily used for DNS filtering. DNS resolvers know hostnames, not HTTP paths, so they cannot block example.com/phishing while allowing example.com/legitimate on the same hostname.

The parent may be a shared hosting or dynamic DNS service used by many unrelated customers. Phishing Army blocks an observed tenant hostname without automatically disrupting the entire platform.

They are frequently abused but also have substantial legitimate use. Since DNS cannot block one redirect or paste path, blocking the complete service may cause more harm than protection. An allowlist decision is not a declaration that every URL is safe.

A false positive was never phishing. A remediated true positive really hosted or redirected to phishing but has since been fixed. A legitimate compromised site, abused platform and Open Redirect are real abuse cases even when their owners are innocent.

The original provider may need to recheck the URL and update its active feed. Phishing Army then removes the hostname after it disappears from every current source and a new build is generated. This process is not always immediate.

A page that visually says 404 but returns HTTP 200 is a soft 404 and may still appear active to automated checks. Removed content should normally return 404 Not Found or, where appropriate, 410 Gone.

Not necessarily. Providers use different evidence and update schedules. VirusTotal aggregates vendor results, and a clean homepage scan does not invalidate a report about a specific path. The evidence that originated the listing must be investigated.

Each build starts from current source snapshots. If a hostname is no longer supplied by any source, Phishing Army does not retain it merely because it appeared in an older release.

Refresh your local list and DNS cache, then check every other configured blocklist. Third-party resolvers, products and downstream aggregators have independent sources, caches and refresh schedules that Phishing Army cannot control.

No. Phishing Army distributes files. DNS resolver administrators, firewalls, ISPs and security products decide whether and how to use them. Implementation-specific problems may also need to be raised with that provider.

PhishTank supplies verified URLs currently marked online and is one active source. Its reports can also feed multiple downstream lists, so several detections may share the same original evidence rather than represent independent investigations.

You may request review, but entries are evaluated case by case. Whitelisting suppresses future reports and is therefore used cautiously, especially when a platform repeatedly hosts abuse or does not cooperate with takedown requests. It is not a security certification.

First verify that the exact hostname is present in a current Phishing Army feed. Carefully check the website for malicious material, review any abuse notices, contact the hosting provider when appropriate and remove anything malicious that is found. Removed resources should return an accurate HTTP 404 or 410 status. You can then email Phishing Army and describe the affected domain and the checks or remediation performed.

Phishing Army is a community project without a commercial support SLA. Requests are reviewed when possible. Repeated emails within a short period do not accelerate investigation, even when a block has business impact.

Use Domains for general DNS filtering, Adblock for compatible blockers, Hosts for hosts-file consumers, DNSMasq or Unbound for those resolvers, and RPZ for policy-zone systems. The Downloads page explains every option.

Phishing Army regenerates its feeds every three hours from current source snapshots. The publication manifest records the generation time and source status. Your filtering tool or provider has its own refresh schedule and cache, so a new generation or removal may take longer to reach your devices.

View the publication manifest

No. The historic normal and extended filenames remain available so existing integrations do not break, but both contain the same canonical balanced domain feed.

Yes. Organizations may use the public feeds and are warmly encouraged to support the project. They remain responsible for reviewing every upstream provider's conditions and obtaining permissions required for commercial use. A donation is voluntary and does not purchase upstream licensing rights.

Anyone can contribute. Donations, tips and recurring support from individual users are always welcome. Organizations that benefit from Phishing Army as part of a product, service or business activity are especially encouraged to support its development, hosting and distribution.

No. Source attribution is a core requirement. Phishing Army's added value is balanced aggregation, normalization, false-positive reduction, format generation and reliable distribution. Every active provider is named on the Sources page.