v1

latestOpenAPI 3.0.02026-07-24311994.6 KB

Threat Feeds

PhaaS Host Feed

Cursor-paginated feed of Phishing-as-a-Service host rows. Requires phaas_threat_feed.

post/threat-feeds/phaas

datestring

A single UTC day (YYYY-MM-DD). Ignored if a range is given.

dateFromstring

Inclusive range start on dayUtc.

dateTostring

Inclusive range end on dayUtc.

hoststring

Exact host match (lower-cased, trimmed).

familystring

Phishing-kit name membership (lower-cased).

countrystring

ISO-2 country, exact (upper-cased).

feedTypestring

asninteger

Autonomous system number.

sort'date' | 'seen' | 'host'

dir'asc' | 'desc'

cursorstring

Opaque keyset cursor from a previous response's pageInfo.nextCursor.

limitinteger

withTotalboolean

{
  "date": "2026-01-31"
}

Successful operation

{
  "data": [
    {
      "host": "phish-kit.example.com",
      "dayUtc": "2026-01-31"
    }
  ]
}