PhishTank Domain Search
PhishTank only lets you look up a full URL. Enter a domain in the form below to list every online phishing URL on it and on its subdomains.
- Runs in your browser
- Free to use
About this tool
PhishTank is one of the most used sources of verified phishing URLs, but its website only answers "is this exact URL listed?". When you investigate a domain, you want the opposite question: which phishing pages are hosted on it? The PhishTank Domain Search loads the online-valid dataset once, matches the hostname of every entry against the domain you typed, including all subdomains, and lists the URLs with their phish IDs, submission times and targeted brands, ready to copy or download.
Preview a page safely with the Website Screenshot.
How to use it — quick steps
- 01
Enter the domain
Type the domain, for example example.com; a pasted URL or a www. prefix is trimmed automatically.
- 02
Press "Search PhishTank"
The verified dataset is downloaded once and searched in your browser for the domain and subdomains.
- 03
Review the URLs
The list shows how many URLs were found, with copy and download actions and a table with phish IDs.
Key features of this tool
Search by domain, not URL
PhishTank's own search needs the exact URL; this tool matches the hostname, so one query reveals every listed page on a domain.
Subdomains included
login.example.com, cdn.example.com and any other subdomain are matched together with the domain itself.
Searched in your browser
The dataset is a static file refreshed from PhishTank; the search runs locally and the domain you type is never sent to our servers.
Frequently asked questions
What is PhishTank?
A community database of phishing URLs run by Cisco Talos, where submissions are verified by volunteers. This tool uses its "online, verified" dataset, the set of phishing pages confirmed to be live.
How fresh is the data?
The dataset is refreshed from PhishTank periodically (a few times a day); the result shows the timestamp of the copy you searched.
A domain shows phishing URLs, is it malicious?
Not necessarily: compromised sites, free hosting providers, URL shorteners and large platforms appear because phishing pages were hosted or redirected through them. Look at the URL paths and subdomains before judging the domain.
Why is the first search slow?
The whole dataset (several megabytes, compressed in transit) is downloaded on the first search so that every following search is instant; it stays cached for your visit.
Are my files or data uploaded?
No. The tool is plain JavaScript that runs in your browser; the files or data you provide here are never uploaded to our servers.