PhishStats Getting Started: API Setup & First Request (2026)

Getting started overview

This guide outlines the steps to begin using the PhishStats API for integrating real-time phishing threat intelligence into security applications. It covers account creation, API key retrieval, and making an initial API request. PhishStats provides data feeds for phishing URLs, IP addresses, and domains, which can be used by security researchers, threat intelligence platforms, and Security Operations Centers (SOCs) for detection and analysis.

The API is designed for direct HTTP requests, returning data in JSON format. Developers are responsible for constructing their own HTTP clients, as no official SDKs are provided by PhishStats for specific programming languages. The primary authentication method utilizes an API key included as a URL parameter in each request.

Before proceeding, ensure you have an internet connection and a tool capable of sending HTTP requests, such as curl, Postman, or a programming language's HTTP client library.

Quick Reference: PhishStats API Getting Started

Create an account and get keys

To access the PhishStats API, you must first register for an account. PhishStats offers a free tier that includes API access, subject to rate limits of 50 requests per hour. Paid plans, starting at $20 per month, offer increased request limits and additional features.

1. Navigate to the PhishStats website: Open your web browser and go to the PhishStats homepage.

2. Register for an account: Look for a "Sign Up" or "Register" link, typically located in the top right corner of the page. You will likely need to provide an email address and create a password.

3. Verify your email: After registration, PhishStats may send a verification email to the address you provided. Follow the instructions in this email to activate your account.

4. Log in to your account: Once your account is active, log in using your registered credentials.

5. Locate your API key: Within your account dashboard, there should be a section dedicated to API access or developer settings. Your unique API key will be displayed there. This key is essential for authenticating your API requests. Copy this key and store it securely.

The API key serves as your authentication credential for all requests to the PhishStats API. It is a unique string that identifies your account and authorizes your usage within your allocated rate limits. Keeping this key confidential is important to prevent unauthorized use of your API access.

Your first request

After obtaining your API key, you can make your first request to a PhishStats API endpoint. This example demonstrates how to retrieve the latest phishing URLs. The PhishStats API uses a simple query parameter for authentication.

API Endpoint Structure

PhishStats API endpoints generally follow this structure:

https://phishstats.com/api.php?api_key=[YOUR_API_KEY]&{endpoint_parameters}

Replace [YOUR_API_KEY] with the key you obtained from your PhishStats account dashboard.

Example: Get Latest Phishing URLs

To retrieve a list of the latest reported phishing URLs, you can use the latest endpoint.

Endpoint: https://phishstats.com/api.php?api_key=[YOUR_API_KEY]&report=latest

Using curl (Command Line)

curl is a widely available command-line tool for making HTTP requests. Replace YOUR_API_KEY_HERE with your actual PhishStats API key.

curl "https://phishstats.com/api.php?api_key=YOUR_API_KEY_HERE&report=latest"

Using Python (requests library)

If you are using Python, the requests library simplifies HTTP interactions. First, ensure you have it installed (pip install requests).

import requests
import json

api_key = "YOUR_API_KEY_HERE" # Replace with your actual API key
url = f"https://phishstats.com/api.php?api_key={api_key}&report=latest"

try:
    response = requests.get(url)
    response.raise_for_status() # Raise an exception for HTTP errors (4xx or 5xx)
    data = response.json()
    print(json.dumps(data, indent=2))
except requests.exceptions.RequestException as e:
    print(f"An error occurred: {e}")

Expected Response (JSON)

A successful response will return a JSON array containing objects, each representing a phishing incident. The structure might vary slightly, but typically includes details like the URL, timestamp, and other relevant information.

[
  {
    "id": "123456",
    "url": "https://example.phishing.com/login",
    "ip_address": "192.0.2.1",
    "country": "US",
    "timestamp": "2026-05-29 10:30:00",
    "score": "0.95"
  },
  {
    "id": "123457",
    "url": "https://another.phish.net/verify",
    "ip_address": "203.0.113.45",
    "country": "DE",
    "timestamp": "2026-05-29 10:29:45",
    "score": "0.92"
  }
]

This output indicates a successful retrieval of phishing data. The specific fields and their values will depend on the data available at the time of your request and the specific PhishStats API endpoint used. For a comprehensive list of available endpoints and parameters, consult the PhishStats API documentation.

Common next steps

After successfully making your first API request, consider these common next steps to further integrate PhishStats into your security workflows:

1. Explore additional endpoints: The PhishStats API offers various endpoints beyond just the latest URLs. You can query for specific phishing domains, IP addresses, or historical data. Refer to the PhishStats API reference for a full list of available API calls and their parameters.

2. Implement error handling: Production applications should always include robust error handling. This involves checking HTTP status codes (e.g., 200 OK for success, 400 Bad Request, 401 Unauthorized, 429 Too Many Requests), and parsing error messages returned in the JSON response. For a general understanding of HTTP status codes, consult the MDN Web Docs on HTTP status codes.

3. Manage rate limits: Be aware of the API rate limits associated with your PhishStats plan (e.g., 50 requests/hour for the free tier). Implement a mechanism in your application to respect these limits, such as exponential backoff or a token bucket algorithm, to avoid hitting rate limit errors. The API documentation may provide specific headers for tracking your current rate limit status.

4. Secure your API key: Never hardcode your API key directly into your source code, especially if the code will be publicly accessible (e.g., in a client-side application or public repository). Instead, use environment variables, a secure configuration management system, or a secrets manager. For server-side applications, ensure your API key is stored and accessed securely.

5. Integrate into security tools: Consider how PhishStats data can enhance your existing security tools. This might involve feeding phishing URLs into a web proxy for blocking, integrating with a SIEM (Security Information and Event Management) system for alerting, or enriching incident response playbooks with real-time threat intelligence.

6. Monitor data freshness: Phishing threats evolve rapidly. Depending on your use case, you may need to poll the PhishStats API regularly to ensure you are working with the most current data. Design your polling frequency to balance data freshness with your API rate limits.

Troubleshooting the first call

If your initial API call to PhishStats does not return the expected data, consider the following common issues and troubleshooting steps:

• Incorrect API Key: Double-check that the API key included in your request exactly matches the key provided in your PhishStats account dashboard. Even a single character mismatch will result in an authentication failure.

• Missing API Key: Ensure the api_key parameter is present in your request URL, correctly formatted, and assigned your actual key. The PhishStats API requires the key as a URL query parameter.

• Rate Limit Exceeded (HTTP 429): If you receive an HTTP 429 status code (Too Many Requests), it means you have exceeded your account's rate limit. Wait for the specified time (often indicated in a Retry-After HTTP header) before making further requests. For information on handling rate limits, refer to the Cloudflare API rate limiting documentation as a general reference for best practices.

• Network Connectivity Issues: Verify that your machine has an active internet connection and can reach phishstats.com. Try pinging the domain or accessing the website in your browser to confirm general connectivity.

• Incorrect Endpoint or Parameters: Review the PhishStats API documentation to ensure you are using the correct endpoint URL and any required parameters for the specific data you are trying to retrieve. Typos in endpoint paths or parameter names are common errors.

• JSON Parsing Errors: If your code is attempting to parse the response as JSON but failing, inspect the raw response content. It's possible the API returned an HTML error page, plain text error message, or malformed JSON. Print the raw response body to diagnose.

• Firewall or Proxy Restrictions: If you are making requests from a corporate network, a firewall or proxy server might be blocking outbound connections to phishstats.com. Consult your network administrator if you suspect this is the case.

• Account Status: Ensure your PhishStats account is active and in good standing. If your account has been suspended or deactivated, your API key will no longer function.

When troubleshooting, always examine the HTTP status code and the full response body from the API, as these often contain specific error messages that can guide your debugging process.