API documentation for the PhishFeed phishing intelligence API

1. Copyright 2019 Phish Feed, LLC
API SPEC
April 2019
PhishFeed

2. Copyright 2019 Phish Feed, LLC
Table of Contents
Modification History...........................................................................................................................3
Document Status................................................................................................................................4
Product Descriptions and Specifications..............................................................................................4
PhishFeed API ............................................................................................................................................... 4
POST /API Request................................................................................................................................................................4
Appendix A – Error Codes.....................................................................................................................................................8

3. Copyright 2019 Phish Feed, LLC
MODIFICATION HISTORY
Version Date Notes
V 1.0 04/14/2019 API SPEC V 1.0

4. Copyright 2019 Phish Feed, LLC
DOCUMENT STATUS
This document supports V 1.0 for PhishFeed API. This is subject to change to reflect later versions of
the API.
PRODUCT DESCRIPTIONS AND SPECIFICATIONS
Contained in this document are descriptions and specifications for the PhishFeed API that enable
transfer of phishing-related data to customers who sign-up for the product.
Please note that all data and analysis delivered via the API is for informational purposes only. PhishFeed
shall not be liable to any third party in connection with the use of, or reliance on, this information and
analysis.
PHISHFEED API
As part of the PhishFeed project, data on Phishing URLs will be provided to customers who sign-up and pay for
access to the PhishFeed API.
POST /API Request
The customer will query the PhishFeed API URL using a POST request with their API key on the header.
NOTE: A maximum of 20,000 URLs per request can be specified. If no URL count limit is set, the maximum
number of URLs returned will be 10,000. If more data is needed please contact us at www.phishfeed.com/contact.
Request Body Example
curl -X 'POST' -H 'Accept: application/json' -H 'x-api-key:
paste_api_key_here'
https://api.phishfeed.com/v1/feed?country_code=GB&urls=2'
Input parameters:
Parameter Name Description Data Type Required
order Indicates the order in which the user wants
the URLs to be returned, as determined by the
discovery time; possible values are as follows:
• ASC
• DESC
<string> No
brand Substring that can be found in the tagged
Brand
<string> No

5. Copyright 2019 Phish Feed, LLC
Parameter Name Description Data Type Required
For example, “face” would return all URLs
tagged with the brand “Facebook” alongside
any other brands with “Face” in them
days Number of days to look back for data to be
retrieved
“5” would return data from the past five days
<integer> No
hours Number of hours to look back for data to be
retrieved
“5” would return data from the past five hours
<integer> No
minutes Number of minutes to look back for data to be
retrieved
“5” would return data from the past five
minutes
<Integer> No
url_term Substring that can be found in the URL
For example, if “PayPal” was the url_term used,
the API would return results with PayPal in the
URL
<string> No
ip Substring found in the IP Address of the
phishing URL server
For Example, “32.54.6” would return all data
with “32.54.6” in the IP Address field
<string> No
urls Number of URLs that the user wants to be
returned
<integer> No
country Country name of where the server of the IP is
hosted.
For Example: “bulg” would return all URLs
hosted in Bulgaria
<string> No
country_code ISO Country code for the country <string> No

6. Copyright 2019 Phish Feed, LLC
Parameter Name Description Data Type Required
Example: “DE” would return all URL’s hosted in
Germany
city Name of the city where the server of the IP is
hosted.
<string> No
region Name of the region where the server of the IP
is hosted.
<string> No
Response Body Example
{
"count": 2,
"data": [
{
"id": 12345,
"url": "phishingurl1.com",
"ip": "11.222.3.44",
"ip_location": "US, New York, Buffalo",
"ip_as": "11111",
"ip_asn": "Company LLC, US",
"date_found": "2019-03-17 16:58:47",
"brand": "Brand1",
"zip_kits": "xyz.zip"
},
{
"id": 67890,
"url": "phishingurl2.com",
"ip": "55.666.7.88",
"ip_location": "US, California, Sacramento",
"ip_as": "22222",
"ip_asn": "Company Inc, US",
"date_found": "2019-04-16 18:48:23",
"brand": "Brand2",
"zip_kits": "xyz.zip"
}
]
}

7. Copyright 2019 Phish Feed, LLC
Output parameters:
Parameter Name Description Data Type
count Indicates a count of URLs returned <integer>
data A list of phishing URLs and the URLs’
respective data; data possess the
following attributes:
• ID
• URL
• IP
• IP Location
• IP System Number
• IP System Name
• Date Found
• Brand
• Zip Kits
Array of JSON Objects
id PhishFeed-assigned unique identifier of the
URL
<integer>
url The detected phishing URL <string>
ip IP of the server the URL is on <string>
ip_location The location (country code, region, city) of
the server
<string>
ip_as The IP autonomous system number <string>
ip_asn The IP autonomous system name <string>
date_found The date/time the phishing URL (in UTC)
was discovered
<string>
brand Brand impersonated by phishing URL <string>
zip_kits The names of any zip kits (phishing kits)
found on that server.
<string>

8. Copyright 2019 Phish Feed, LLC
APPENDIX
Appendix A – Error Codes
The list of error codes sent by our APIs is included below:
HTTP Status Code Error code Description
400 1000 Missing parameters; please include one of <parameter list>
400 1001 Bad parameters: <list of unsupported parameters>
403 1002 API Key not found
429 1003 Rate limit exceeded