Phishing Detection

Phishing Detection provides automated protection against malicious URLs, using open-source threat intelligence from PhishTank (managed by Cisco Talos Intelligence Group) — around 50,000 verified phishing URLs, continuously maintained. Lookups run in sub-millisecond time, so the check adds negligible latency.

How it's used

Phishing Detection is already integrated into:

• Classifier — the URL text rule extracts URLs from submitted content, and a match against the PhishTank list triggers URL_PHISHING, scoring the submission as spam.
• Email Spam Filter — links inside inbound email are checked the same way.

You can also call it directly:

POST /v1/phishing
Authorization: Bearer {API_KEY}

{ "url": "https://example.com" }

{
  "id": "123456",
  "info": "http://www.phishtank.com/phish_detail.php?phish_id=123456",
  "phishing": true,
  "submittedAt": 1758308530,
  "target": "Other",
  "time": 0.67
}

Configuration

If you're a registered PhishTank member, you can configure an authenticated feed URL using your PhishTank app key, for higher rate limits than the public feed.

Related

• Classifier — the URL / URL_PHISHING rules this feeds into.
• Email Spam Filter
• Data Sources — where the PhishTank feed fits among Sentinel's other data sources.
• ENV Variables