Phishing and Malware Domain Feed for Firewalls and DNS Filters
New domains are where most phishing starts. Our feed categorizes newly registered domains every day, looks at them again as they grow, and delivers the changes as compact delta files your products can load automatically.
Why newly registered domains matter
A static phishing domain list ages quickly. Attackers register fresh names, use them briefly and move on, so the useful part of any feed is how well it covers what appeared this week.
New domains a day
Categorized daily, so a domain is labelled soon after it starts appearing in traffic.
Follow-up checks
After a week and after a month, because many sites add their real content only after launch.
Threats and content together
Malware / Phishing / Suspicious sits in the same database as the other 58 categories.
Empty today, harmful next week. A domain registered this morning may show only a placeholder. If it is never checked again, it stays "parked" in your data long after it starts hosting a fake login page. Follow-up checks close that gap.
The lifecycle of a new domain in the feed
Each newly registered domain passes through three checkpoints. Every checkpoint can add, change or confirm its categories, and every change reaches you in the next delta file.
Day of first categorization
The domain is categorized from its site content, reviewed and validated.
- Clear threats labelled Malware / Phishing / Suspicious
- Placeholder pages labelled Parked / For-Sale Domains
- Real sites get content categories such as Shopping or News/Media
Second check
The same domain is looked at again once its owner has had time to build it out.
- Parked domains that went live get real categories
- Sites that turned harmful move into the threat category
- Unchanged domains are confirmed
Third check
A final early check, then the domain joins the monthly refresh cycle with all others.
- Catches slow starters and repurposed sites
- Updates ranking where several categories apply
- From here on, refreshed monthly
Want the category definitions? See phishing domains, malware domains and botnet domains.
Delta files: what arrives every day
Instead of re-downloading the whole database, products apply a small daily file with only what changed. Here is an illustrative shape; the exact schema comes with your licence documentation.
| Field | Meaning | What your import does with it |
|---|---|---|
| domain | The registered domain | Key for insert or update |
| categories | One or more categories, ranked by how much of the site they describe | Replace the stored categories for that domain |
| check | Which checkpoint produced the row: first, week or month | Optional: report on how domains evolve |
| change | Whether the domain is new or its categories changed | Add new rows, overwrite changed ones |
Deltas come as CSV, Parquet or JSON. Licensed customers can also receive them as enforcement exports; the blocklist formats guide shows RPZ, EDL, hosts and AdGuard-style output.
How vendors and MSPs use the malware domain list
The same feed powers very different enforcement points. These are the common patterns.
Firewall vendors
Push the threat category to appliances as part of the regular category update.
- Deltas reach boxes without a firmware change
- Block or send to inspection by policy
DNS filter providers
Answer threat domains with NXDOMAIN or a block page before any connection opens.
- RPZ export fits standard resolvers
- Daily new domains matter most here
SWG and SASE
Combine threat labels with content categories in one URL policy.
- Block threats for everyone
- Isolate or warn on Parked and new domains
MSPs
Apply one baseline threat policy across every client, then add content rules per tenant.
- One import serves all clients
- Threat blocks in monthly client reports
Email security
Check link domains in messages against the threat category at delivery or at click time.
- Local lookups keep latency low
- API for rare unknown domains
Security analytics
Enrich DNS and proxy logs so analysts spot traffic to new and suspicious domains.
- Parquet suits data warehouses
- History by checkpoint for investigations
More on these markets: MSP web filtering, cybersecurity web filtering and threat intelligence integration.
Combining threat data with content categories
A threat feed on its own answers one question: is this domain dangerous? Content categories answer the next ones. Together they make policies that are both safe and usable.
Malware / Phishing / Suspicious
Blocked for all users on every network, without exceptions by default.
Parked / For-Sale Domains
Low value and sometimes repurposed; a warning page is often enough.
VPN / Proxy / Anonymizers
Proxies can carry users around the threat block, so many networks limit them.
URL Shorteners
Hide the final destination; resolve or inspect before allowing.
Cloud Storage / File Hosting
Legitimate services that attackers also use to host payloads.
Remote Access Tools
Useful for IT, also common in support scams; allow for approved staff.
File Sharing/P2P
Raises malware risk; log or block depending on the organisation.
Online Banking
Often excluded from TLS inspection; reliable labels matter here too.
| Situation | Threat label only | Threat plus content categories |
|---|---|---|
| New domain, no content yet | Allowed, nothing known | Parked label, warn page until the week check |
| Fake bank login on a fresh domain | Blocked once listed | Blocked, and reported against the Online Banking look-alike |
| User tries a web proxy to reach a blocked site | Proxy allowed | Proxy blocked by VPN / Proxy / Anonymizers policy |
| Short link in an email | Allowed unless the shortener is listed | URL Shorteners policy forces inspection |
Phishing domain check API
Local files handle the bulk of traffic. The lookup API, included with licences, covers on-demand checks in support tools, admin consoles and investigations.
Support desks
Check a domain a customer reports and see its current categories in seconds.
Admin consoles
Let admins test a domain against their policy before they add an exception.
Batch checks
Send a list of domains from an incident and get categories back in one call.
Fallback lookups
Ask for domains outside your local subset, then cache the answer.
Exact endpoints, authentication and limits are in the API documentation. For a single quick check, try the URL checker.
Operational guidance for running the feed
A threat feed is only as good as the job that loads it. These are the habits that keep enforcement current.
Import
- Apply deltas daily, in date order
- Apply the monthly refresh on a fixed schedule
- Make imports atomic: load, verify, then swap
- Keep the previous version for quick rollback
Monitoring
- Alert if a delta is late, empty or far larger than usual
- Track threat blocks per day per tenant
- Watch how many lookups fall through to the API
- Log the category behind every block for audits
Caching
- Keep resolver and proxy cache times short for threat answers
- Flush caches after a large delta
- Do not cache "unknown" for long
- Re-query unknown domains after the week check
Policy
- Block the threat category everywhere by default
- Use a clear block page with a way to report mistakes
- Review allow-list exceptions regularly
- Send reported domains to us for review
Defence in depth. No domain feed catches everything, so keep it as one layer next to email security, endpoint protection and user awareness. Our guide to real-time URL classification covers how the layers fit.
Patterns that show up in new phishing domains
Knowing the common shapes helps admins read block logs and explain them to users. All examples below are placeholders under the reserved .test suffix.
Brand plus action word
Names such as example-bank-secure-login.test that pair a trusted word with "login" or "verify".
Parcel and invoice themes
Names like example-parcel-notice.test that match common text message and email lures.
Used for days, then dropped
Domains that matter most in their first week, which is why daily intake counts.
Harmless at launch
A placeholder on day one and a fake login later; caught at the week or month check.
Abuse of legitimate services
Phishing pages on file hosting or site builders, where content categories add context.
Short links to fresh domains
A shortener hides the final new domain, so inspect URL Shorteners traffic.
Remote access lures
Pages pushing a remote access download; pair threat and Remote Access Tools rules.
For-sale pages that flip
Parked domains bought and repurposed, then moved to the threat category on re-check.
Integration in five steps
Most teams already have a category table. Adding the feed is mostly about the daily job around it.
| Step | What to do | Done when |
|---|---|---|
| 1. Initial load | Import the full database file into your category store | Lookups return categories for known domains |
| 2. Daily job | Fetch and apply the delta file every day, in order | New domains appear the day after intake |
| 3. Monthly job | Apply the monthly refresh for all other domains | Older domains carry current categories |
| 4. Policy | Map the threat category to block, and related categories to warn or inspect | Test domains under .test trigger the right action |
| 5. Fallback | Send unknown domains to the lookup API and cache briefly | Unknown share falls and stays low |
Rolling the feed out across an MSP client base
MSPs get the most from a threat feed when every client receives the same baseline first and tailored rules later. A staged rollout keeps tickets low.
Monitor only
Load the feed and log matches for every tenant without blocking.
- See how often each client hits threat domains
- Find business tools that need an allow rule
- Prepare the block page and reporting path
Block threats
Turn on blocking for Malware / Phishing / Suspicious across all tenants.
- One policy, applied everywhere
- Warn page for Parked / For-Sale Domains
- Weekly review of reported blocks
Tailor per client
Add content categories according to each client's acceptable use policy.
- Proxy and remote access limits where needed
- Sector rules, for example schools or clinics
- Threat statistics in monthly client reports
For multi-tenant design ideas, see custom policy management.
What to ask before choosing any threat domain feed
Whatever source you use, these questions show whether a feed will hold up in production.
How many new domains a day?
And how soon after they appear in traffic are they labelled?
Are new domains re-checked?
A single check on day one misses sites that change later.
Do recovered domains leave the list?
Stale entries cause blocks that users rightly complain about.
Are content categories included?
Threat labels alone cannot express proxy, shortener or parked rules.
Can it run locally?
Local files avoid a network round trip for every lookup.
Does it fit your device?
RPZ, EDL, hosts and adblock style save conversion work.
Is accuracy measured?
Ask for validation reports with measured figures, not adjectives.
Can you embed it?
Check rights for products you sell and for devices at customer sites.
Measuring the feed's impact
Track a few numbers from the first week. They show whether the feed is loaded correctly and whether policies need tuning.
Threat blocks per day
A sudden drop to zero usually means a broken import, not a safer week.
Reported blocks
How many users ask for a review, and how many of those turn out to be correct blocks.
Unknown share
Share of traffic to domains with no category; it should fall as deltas are applied.
| Term | What it means on this page |
|---|---|
| Newly registered domain | A domain that recently entered the registries and appears in the daily intake |
| Delta file | A daily file with only the domains that were added or changed |
| Follow-up check | The look at each new domain after a week and after a month |
| Look-alike domain | A name made to resemble a brand, for example example-bank-secure-login.test |
| Parked domain | A domain showing ads or a for-sale page instead of a real site |
Looking for a list of phishing websites?
Many people search for a public list of phishing sites to paste into a filter. Here is why a licensed, updated feed works differently.
| Question | One-off downloaded list | Licensed daily feed |
|---|---|---|
| Covers domains from this week | Only until the day it was made | About 300,000 new domains added daily |
| Follows up on new domains | No | After a week and after a month |
| Removes recovered domains | Rarely | Changes arrive in delta files |
| Context beyond "bad" | None | 59 categories plus IAB taxonomy |
| Format for your device | Whatever was published | CSV, Parquet, JSON, plus enforcement exports |
| Quality evidence | Unknown | Validation reports for licence holders |
Our data is licensed for use inside products and networks and is not published as a public list. Vendors can read about OEM licensing; everyone else can start with the web filtering database overview.
Phishing and malware domain feed FAQ
What is a phishing and malware domain feed?
It is a regularly updated list of domains labelled as malware, phishing or suspicious, delivered in a machine-readable form so firewalls, DNS filters and gateways can block them automatically.
Why are new domains checked again after a week and a month?
Many sites have little or no content on the day they are registered and change after launch. Checking each new domain again after a week and after a month catches domains whose purpose only becomes clear later.
How is the feed delivered?
As daily delta files with the new and changed domains, next to the full database that is refreshed monthly. Files come as CSV, Parquet or JSON, and licensed customers can receive exports such as DNS RPZ or firewall external dynamic lists.
Is there a phishing domain check API?
Yes. A lookup API is included with licences, so support tools and admin consoles can check a single domain or a batch on demand.
Do you publish a public list of phishing websites?
No. The data is licensed for use inside products and networks, and licences do not allow resale or publication of the raw data.
Can the feed run in an air-gapped network?
Yes. The files run inside your own systems, and air-gapped sites import the daily deltas through their own transfer process.
What should happen when a user reports a wrong block?
Show a block page with a short report form, add a temporary allow rule if the business needs it, and send the domain to us for review. Keep the exception list small and review it regularly.
Does the feed include IP addresses?
The feed is domain based. Each domain carries its categories, which suits DNS filters, proxies and firewalls that enforce by name.
How is the feed priced?
Starter database tiers from $999; enterprise and OEM licences are quoted per deployment. See pricing.
Add daily threat coverage to your product
License the database with daily new-domain deltas, follow-up checks and the lookup API.