#phishing

Phishing URLs, domains and IPs from public Twitter/X researchers

Subscribe (RSS)


#phishing

Phishing IOCs from Twitter/X researchers

Subscribe (RSS)

IOCs by window

Today

59

IOCs tagged #phishing

Week

331

IOCs tagged #phishing

Month

3,431

IOCs tagged #phishing

Year

34,479

IOCs tagged #phishing

Counts as of 2026-10-28. Regenerated daily.

About #phishing

  • Definition: Impersonates a trusted brand, service or individual.
  • MITRE: T1566, with sub-techniques for attachment, link and via-service.
  • Variants: Credential phishing, BEC, smishing, vishing, QR phishing (quishing).
  • Legacy MFA bypass: Adversary-in-the-middle kits like Evilginx and Tycoon-2FA.
  • Detection: SPF, DKIM, DMARC, URL reputation, certificate transparency, user reports.
  • Best preventative control: Phishing-resistant MFA (FIDO2/WebAuthn).
  • References: MITRE ATT&CK T1566 · CISA Phishing · phishunt.io (sister project, real-time phishing detection).

Recent IOCs tagged #phishing

Latest 10 IOCs from the past 30 days. Live JSON: api.tweetfeed.live/v1/month/phishing.

Date Type Value Source
Oct 28, 16:00 domain flipkarrt-helu-sale.shop @Malwarehunterr
Oct 28, 16:00 url http://flipkarrt-helu-sale.shop @Malwarehunterr
Oct 28, 13:30 domain anthropic.rsvpconnect-events.com @anyrun_app
Oct 28, 13:30 url http://anthropic.rsvpconnect-events.com @anyrun_app
Oct 28, 13:30 domain register.rsvpconnect-events.com @anyrun_app
Oct 28, 13:30 url http://register.rsvpconnect-events.com @anyrun_app
Oct 28, 13:30 domain us968web-zoom.us @anyrun_app
Oct 28, 13:30 url http://us968web-zoom.us @anyrun_app
Oct 28, 13:30 domain rsvpconnect-events.com @anyrun_app
Oct 28, 13:30 url http://rsvpconnect-events.com @anyrun_app

Related tags

Often seen with #phishing.

See all tags on the Dashboard or browse the full IOC feed.

Frequently asked questions

What is phishing?

A social-engineering attack that impersonates a trusted brand, service or individual to steal credentials, deploy malware or get funds. MITRE ATT&CK lists it as T1566.

What kind of IOCs are tagged #phishing on TweetFeed?

URLs, domains and IPs hosting phishing kits or fake login pages, seen by public Twitter/X researchers. Hashes are rare; related tags include #scam and #opendir.

How is this list updated?

The feed and the API update every 15 minutes from researcher posts on X. This page refreshes once a day.

What is the license? Can I use this commercially?

Yes. All IOC data, including this Phishing subset, is CC0 1.0 Universal. No attribution needed. No warranty. The website code and branding are not CC0.

License

Phishing IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.