shouldiuse.io

Categories

VERDICT

PhishTank Review

Depends

Should I use PhishTank?

PhishTank is operated by Cisco Talos Intelligence Group. - phishtank.org

· 5 days ago

Use it if you run a SIEM or SOAR (Splunk, ServiceNow, TheHive) and want a free extra phishing signal for enrichment. Don't rely on it as your only defense or as a small-business phishing protection product, false-positive delisting is its weakest point.

Confidence

Medium. Based on ~50 public sources; pricing is unambiguous (free) but support and data-quality claims rest mainly on user forums.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support quality
  • Security posture

Pricing

$0

Free

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes

Best for

  • SOC and threat-intel teams
  • Splunk/ServiceNow enrichment
  • Phishing-detection researchers
  • Network admins feeding blocklists

Not for

  • Small businesses wanting end-user phishing protection
  • Site owners needing fast delisting from a false flag
  • Anyone needing an SLA-backed commercial feed
  • Teams wanting a sole source of truth for blocking

Gotchas - check before you buy

high

A false listing can get your domain suspended; delisting is slow and unresponsive.

high

Free means no SLA or support; false-positive tickets reportedly go unanswered.

medium

Critics question data freshness; cross-check other feeds before auto-blocking.

medium

It only helps inside tooling; third-party delisting services exist because support isn't included.

Pros and cons

Pros

  • Free community-run phishing URL database and API
  • Operated by Cisco Talos intelligence team
  • Prebuilt integrations for Splunk, ServiceNow, and SOAR tools
  • Community verification adds confidence to reported URLs
  • Long track record; consumed by Opera and WOT

Cons

  • Legitimate sites get listed; removal can drag on
  • False positives have led hosts to suspend domains
  • Industry critics argue data is outdated, be deprecated
  • API reliability and support complaints documented
  • Community maintenance questions raised publicly

Sources & method

- 12 sources - No known vulnerabilities found in the sources reviewed.

official x4review x4news x4

Key stats

  • Value for money: 5/5

    Rating

  • $0

    Starting price

  • 12

    Sources

  • Analyzed

  • Value for money: 5/5. Free feed; hard to beat at $0.
  • Ease of use: 3/5. Simple URL lookups; needs API keys and integrations.
  • Feature depth: 3/5. Feed plus community verification; no analytics or automation.
  • Support quality: 2/5. False-positive removal complaints go unanswered.
  • Security posture: 4/5. Cisco Talos-operated; no public vulnerabilities found.
  • Free Price Community-operated
  • Yes Free tier Data, reporting, API
  • 2006 Launched October 2006
  • Cisco Talos Operated by Talos Intelligence Group

Pricing

Free

$0

  • URL lookup and reporting
  • Community verification
  • API access

Security

No known vulnerabilities found in the sources reviewed.

What users say

Security teams still plug the free feed into Splunk and ServiceNow, but users complain about false positives and slow delisting.

“Phishtank won't remove my legit website from database”
Reddit, r/phishing
“Somebody reported my blog to Phishtank and they suspended my domain name.”
NamePros forum
“What happened to phishtank?”
Reddit, r/phishing

Companies that use it

Full analysis

Based on ~50 public sources; pricing is unambiguous (free) but support and data-quality claims rest mainly on user forums.

Free, community-run phishing URL feed. Good secondary signal for SOC tooling; risky as a sole source.

Methodology

Based on ~50 public sources; pricing is unambiguous (free) but support and data-quality claims rest mainly on user forums.

Read how a report is made.

Sources

  1. PhishTank FAQphishtank.net
    official
  2. PhishTank — Wikipediaen.wikipedia.org
    official
  3. PhishTank on Splunkbasesplunkbase.splunk.com
    official
  4. official
  5. review
  6. review
  7. news
  8. review
  9. news
  10. review
  11. news
  12. news

Add this review to your site

This check for PhishTank says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.