Collect
Fetch each provider independently, with bounded retries and clear source health.
From live reports to a dependable feed
Fresh snapshots in. Balanced blocklists out.
Phishing Army is stateless by design: each publication is rebuilt from what trusted sources expose at that moment.
Normalize
Extract valid hostnames, standardize case and internationalized names, then remove duplicates.
Protect
Apply maintained allowlists and conservative shared-platform rules before publication.
Render
Create every supported format from one canonical set and publish files atomically.
Updated every three hours
The feeds are regenerated every three hours. The publication manifest records the generation time and source status. Your filter or security provider may apply its own update schedule and cache, so changes are not necessarily visible everywhere at the same moment.
No historical carry-over
Phishing Army does not maintain a permanent archive of indicators. If a domain is no longer present in any current source, it is not silently retained in the next build. This helps remove domains after phishing content has disappeared or a provider has withdrawn its report.
Upstream status controls the normal removal path
Removing a phishing page does not necessarily remove its report immediately. An upstream provider may need to revisit the URL and mark it inactive before its current feed changes. Once no active source supplies the hostname, it normally disappears during a subsequent Phishing Army generation.
Downstream services and local resolvers then apply their own refresh cycles and caches. Removal from Phishing Army cannot guarantee simultaneous removal from every product that consumes it or from other independently configured blocklists.
Source failures are isolated
One unavailable provider does not prevent healthy sources from contributing. Failed calls are retried within safe limits, recorded in the manifest and attempted again during the next scheduled generation. Publication is refused if all sources fail or the candidate list collapses to an unsafe size.
The complete generation code is publicly available on GitHub, together with the source registry and the project’s technical documentation.
One canonical domain set
Formats never receive extra indicators of their own. Domains, Adblock, hosts, DNSMasq, wildcard, Unbound and RPZ outputs are different representations of the same reviewed set.
Whitelists are maintained deliberately
A personal whitelist has the highest precedence. The broader popularity-based whitelist is normally refreshed manually once a month using Tranco and other maintained inputs. It is reviewed before it can replace the active file.
Transparency matters. The independent intelligence providers are listed on the Sources page. Phishing Army's work is the careful aggregation, normalization, false-positive reduction, format generation and reliable distribution of their reports.
Is Phishing Army working for you?
With an up-to-date Phishing Army feed enabled, amiprotected.it should be blocked. If the page opens, check that your DNS filter or blocker has the feed enabled and refreshed.
The feed intentionally includes amiprotected.it and www.amiprotected.it as local test indicators. They are not phishing reports from any upstream provider.
The site is deliberately harmless. This checks one test domain, not protection against every phishing attack. A failed connection alone does not prove that Phishing Army caused the block.
Visit amiprotected.it