Phishing Watch · 12-hour resolution

Aggregate volume in the OpenPhish Community Feed — a rolling window of live, verified phishing URLs refreshed roughly every 12 hours. The meaningful signal is the movement of unique phishing domains and shifts in the TLD mix, which reflect the breadth and churn of active phishing infrastructure. Raw phishing URLs are never stored or displayed. Phishing sits outside the six VECTRS dimensions; this baseline informs any future model-shape decision. Methodology →