# Phishing Detection

Phishing Detection provides automated protection against malicious URLs, using open-source threat intelligence from [PhishTank](https://phishtank.org) (managed by Cisco Talos Intelligence Group) — around 50,000 verified phishing URLs, continuously maintained. Lookups run in sub-millisecond time, so the check adds negligible latency.

## How it's used

Phishing Detection is already integrated into:

- **[Classifier](/docs/sentinel/features/classifier/)** — the `URL` text rule extracts URLs from submitted content, and a match against the PhishTank list triggers `URL_PHISHING`, scoring the submission as spam.
- **[Email Spam Filter](/docs/sentinel/features/email-spam-filter/)** — links inside inbound email are checked the same way.

You can also call it directly:

```
POST /v1/phishing
Authorization: Bearer {API_KEY}
```

```json
{ "url": "https://example.com" }
```

```json
{
"id": "123456",
"info": "http://www.phishtank.com/phish_detail.php?phish_id=123456",
"phishing": true,
"submittedAt": 1758308530,
"target": "Other",
"time": 0.67
}
```

## Configuration

| Variable | Default | Purpose |
|---|---|---|
| `PHISHING_LIST_URL` | `https://data.phishtank.com/data/online-valid.csv` | Source feed. Set to an empty string to disable the feature entirely. |
| `PHISHING_LIST_SCHEDULE` | `0 */12 * * *` | Update schedule (cron) — every 12 hours by default. |

If you're a registered PhishTank member, you can configure an authenticated feed URL using your PhishTank app key, for higher rate limits than the public feed.

## Related

- [Classifier](/docs/sentinel/features/classifier/) — the `URL` / `URL_PHISHING` rules this feeds into.
- [Email Spam Filter](/docs/sentinel/features/email-spam-filter/)
- [Data Sources](/docs/sentinel/integrations/data-sources/) — where the PhishTank feed fits among Sentinel's other data sources.
- [ENV Variables](/docs/sentinel/operations/env-variables/#lists-phishing-disposable-email-user-agents)