PhishTank

PhishTank is a community-based anti-phishing service built around the reporting and verification of suspected phishing websites. It was launched in October 2006 by entrepreneur David Ulevitch as an initiative associated with OpenDNS, the domain-name and internet-security company he founded. Rather than functioning primarily as a conventional commercial security product, PhishTank developed as a collaborative clearinghouse: users submit URLs they believe are being used for phishing, and the community evaluates those submissions through a verification process. The service addresses a practical problem in online security. Phishing campaigns frequently imitate banks, payment providers, webmail services, retailers, employers, and other trusted organizations, while changing domains and hosting infrastructure quickly. A shared database of reported and verified sites can therefore help security companies, browsers, mail providers, network operators, researchers, and end users identify malicious destinations more quickly than isolated detection systems. PhishTank has provided its data for download and through an application programming interface, including for commercial use, subject to its applicable license terms. The database has been used or integrated by a broad range of security, internet, research, and communications organizations. Referenced users and adopters have included Opera, Web of Trust, Yahoo! Mail, McAfee, the Anti-Phishing Working Group, Carnegie Mellon University, Mozilla, Kaspersky, Firetrust, FINRA, Avira, SURBL, Sanesecurity for ClamAV, and PhishTank SiteChecker, among others. These relationships illustrate the service's role as an upstream source of reputation and threat-intelligence data rather than as a consumer brand with a large portfolio of packaged products. After OpenDNS was acquired by Cisco, responsibility for the PhishTank system was transferred into Cisco Talos, Cisco's threat-intelligence organization. The service consequently became part of a larger security-research environment while retaining its community-submission model. In 2018, a rebuild of the website was announced to add functionality and improve the user experience. In 2020, registration for new users was disabled following what the service described as significant abuse of the reporting system. The restriction was intended to protect the quality and reliability of submissions while the platform was reconsidered and redesigned. PhishTank's continuing identity is therefore that of a public-facing threat-intelligence community and data service, not a standalone software vendor. Its value depends on the quality of submitted evidence, the verification process, the availability of its data to downstream users, and its ability to resist manipulation. Cisco Talos has described efforts to rethink the service's architecture, improve abuse prevention, increase performance, and incorporate machine-learning-assisted phishing identification. Publicly available material does not establish a separate corporate entity, independent financial reporting, or a conventional executive structure for PhishTank itself.

PhishTank originated in the mid-2000s as an effort to make phishing reports more useful through collective review and centralized distribution. David Ulevitch launched the service in October 2006 as an offshoot of OpenDNS. Its operating concept was straightforward but influential: people encountering suspected phishing could submit the relevant URL, while other participants could assess whether the site represented a genuine phishing threat. The resulting records could then be consumed by organizations that needed current information about malicious websites. This model reflected the rapidly changing nature of phishing. Fraudulent sites commonly have short lifetimes, use disposable domains or compromised infrastructure, and imitate legitimate brands closely enough to evade simple filtering. A shared repository could combine many observers' reports and make verified indicators available to browser vendors, email providers, security companies, universities, financial organizations, and researchers. PhishTank consequently developed as a bridge between public participation and professional security operations. Its data became available through downloadable datasets and an API, with commercial use permitted under the service's licensing conditions. The database was used by or made available to a wide variety of organizations, including Opera, Web of Trust, Yahoo! Mail, McAfee, the Anti-Phishing Working Group, Carnegie Mellon University, Mozilla, Kaspersky, Firetrust, FINRA, Avira, SURBL, Sanesecurity for ClamAV, and other security or internet-service projects. This ecosystem gave PhishTank importance beyond its own website: its records could be incorporated into detection, reputation, filtering, research, and user-protection workflows. A major organizational change followed OpenDNS's acquisition by Cisco. PhishTank's system was transferred to Cisco Talos, allowing the service to sit within a large threat-intelligence and security-research organization. The transition did not eliminate the community character of the database, but it placed greater emphasis on operational reliability, abuse resistance, and integration with broader security capabilities. In 2018, PhishTank announced that it would rebuild the website and introduce new features and functionality. The project became more urgent after abuse affected the platform. In 2020, registration for new users was disabled, limiting the creation of additional accounts while the service's operating model was reconsidered. The restriction was intended to address misuse and protect the integrity of reports rather than to discontinue the database. Subsequent redesign plans associated with Cisco Talos Communities focused on rebuilding the system, improving performance, providing better support, and using machine-learning techniques to assist phishing identification. Joel Esler was associated with this work while leading or participating in the relevant Cisco Talos Communities effort; he left Cisco Talos in 2021. Public sources do not provide a complete account of the redesign's implementation, a current executive roster, or a separate corporate structure for PhishTank. The service remains best understood as a Cisco-associated, community-driven anti-phishing data platform whose core contribution is the collection, verification, and distribution of phishing intelligence.

• 2020

  New-user registration suspended

  [1]PhishTanken.wikipedia.org

  Registration for new users was removed after abuse of the system, while the service's future design and safeguards were reconsidered.

• 2018

  Website rebuild announced

  [1]PhishTanken.wikipedia.org

  PhishTank announced plans to rebuild its website and add new functionality.

• 2013

  OpenDNS is acquired by Cisco

  [1]PhishTanken.wikipedia.org

  Following Cisco's acquisition of OpenDNS, the PhishTank system was transferred to Cisco Talos.

• 2006

  PhishTank launches

  [1]PhishTanken.wikipedia.org

  David Ulevitch launched PhishTank in October as an OpenDNS-associated community service for reporting and verifying suspected phishing websites.

A community-powered phishing intelligence and verification service that supplies shared threat data to security, internet, research, and communications organizations.

• Threat-intelligence database · 2006

  PhishTank community database

  The core service collects URLs submitted as suspected phishing sites and records the results of community verification. The database gives security practitioners and internet-service providers a shared source of phishing indicators that can supplement proprietary detection systems. Its usefulness depends on the freshness of reports, the quality of verification, and controls against fraudulent or abusive submissions.

• Security API

  PhishTank API

  The API provides programmatic access to PhishTank records so external applications and security services can query or incorporate phishing information. It is intended for integrations such as filtering, reputation checks, research tools, and automated analysis. Public material indicates that the data is available for commercial use under a restrictive license.

• Threat-data distribution

  PhishTank data downloads

  Downloadable data allows organizations and researchers to obtain phishing indicators in bulk rather than querying individual records. This distribution model supports offline analysis, security research, mail and web filtering, and the maintenance of downstream reputation lists.

• Website security checker

  PhishTank SiteChecker

  PhishTank SiteChecker is a service or integration associated with the PhishTank data ecosystem that allows users or applications to check whether a website has been identified as a phishing threat. Specific implementation and product details are not established in the available reference material.

• 2020

  Suspend registration for new usersStrategy

  Background

  The service experienced significant abuse of its reporting system, creating risks to the reliability of community-generated threat data.

  Action taken

  PhishTank removed new-user registration and kept it closed while the service was reconsidered and redesigned.

  Aftermath

  The restriction reduced the ability of new participants to submit reports and became part of a wider effort to improve abuse prevention, operational speed, and detection quality.

  Source

• 2018

  Rebuild the PhishTank websiteStrategy

  Background

  The existing service required modernization and additional functionality to support its community reporting and data-distribution role.

  Action taken

  PhishTank announced a planned website rebuild with new features and functionality.

  Aftermath

  The rebuild became part of a broader reconsideration of the platform's architecture, performance, support, and abuse controls.

  Source

• 2020

  New-user registration disabled after abuse of the reporting system[1]PhishTanken.wikipedia.org

  Other

  PhishTank removed new-user registration after substantial abuse of the platform. The restriction was presented as an effort to reduce manipulation and preserve the quality of community submissions.

• 2018

  PhishTank announces website rebuild[1]PhishTanken.wikipedia.org

  Other

  PhishTank announced plans to rebuild its website and add new functionality as part of an effort to modernize the service.

• PhishTank redesign placed under Cisco Talos Communities[1]PhishTanken.wikipedia.org

  Other

  The service's planned rethinking and redesign was associated with the Cisco Talos Communities team, with goals including stronger abuse controls, faster operation, and machine-learning-assisted phishing identification.

1. 1PhishTanken.wikipedia.org