PhishTank is a community database of phishing URLs. If a page on your domain is listed, browsers, mail filters and security tools can block it.
- List zone: PhishTank
- Operated by: Cisco Talos (community verified)
- List type: Phishing URL database
- Typical removal time: 1 to 7 days
What is PhishTank URLs?
PhishTank is a free, community-driven database of suspected phishing URLs, operated with Cisco Talos. Users submit URLs and other users vote to verify them. The data feeds many security products, browsers and email filters.
Why domains get listed on PhishTank URLs
- Your site was hacked and a phishing kit was uploaded
- A form or login page on your domain looks like a well-known brand
- A redirect on your domain sent visitors to a phishing site
- Community voters wrongly marked a legitimate login page as phishing
What a listing means for your email
Security tools that use PhishTank data can block your page and any email that links to it.
How to get delisted from PhishTank URLs
Find the listed URL
Search PhishTank for your domain and note the listed URLs and their status.
Remove the phishing content
Delete phishing kits, close the hole that let attackers in and make sure the listed URLs return a 404.
Tip: Phishing kits often sit in hidden folders. Search for recently changed files on your server.
Report the false positive or offline status
Once the page is gone, PhishTank checks will mark it offline. For a mistaken listing, contact PhishTank or Cisco Talos with the URL and evidence that the page is legitimate.
Check other vendors
Phishing listings spread quickly. Recheck Google Safe Browsing and other security vendors.
Let BrandsDefender handle it
We find the cause, file the PhishTank URLs removal request and monitor all 20 spam blacklists so you are warned before your emails bounce. No cure, no pay.
Frequently asked questions
How do PhishTank listings get verified?
Community members vote on whether a submitted URL is phishing. Verified entries are shared with security products.