Phishing Watch · 12-hour resolution

Aggregate volume in the OpenPhish Community Feed — a rolling window of live, verified phishing URLs refreshed roughly every 12 hours. The meaningful signal is the movement of unique phishing domains and shifts in the TLD mix, which reflect the breadth and churn of active phishing infrastructure. Raw phishing URLs are never stored or displayed. Since model v7 (r80.0) phishing drives O · Actor Operations, the seventh scored VECTORS dimension: unique phishing domains in the OpenPhish window (80%) plus positive 7-day domain momentum (20%). Methodology →