Data API and exports

Direct answer

Can PhishNet feed existing tools? Yes. Export profiles and API endpoints are designed for existing SOC, MISP, SIEM and fraud tooling.

Profiles

Fresh Belgian domains, confirmed URLs, verified-live URLs, mule routes, smishing routes, fake financial platforms, brand pressure, infra exposure, credential metadata, ads evidence and campaign clusters.

Formats

CSV, JSONL, STIX, MISP, PDF summaries and evidence bundles.

Row quality

Rows include source, confidence, confirmation state, freshness, liveness, brand, country, campaign/kit, Belgian relevance and evidence/detail URL.

How PhishNet uses this

Inside PhishNet this topic is treated as operational graph context: observations are linked to sources, evidence, Belgian relevance, confirmation state, liveness, campaigns and exports. Public pages explain the method; authenticated users can pivot into the full platform workflow when a signal needs investigation or handoff.

Selected sources and research

These pages combine PhishNet platform knowledge with public research, official Belgian sources and open OSINT documentation.

APWG Phishing Activity Trends Reports ENISA Threat Landscape 2025 Why Phishing Works, Dhamija, Tygar and Hearst, CHI 2006 CCB Belgium: phishing messages surge urlscan.io API documentation Microsoft Ad Library API Common Crawl CDX Index

Common questions

Can PhishNet feed existing tools?

Yes. Export profiles and API endpoints are designed for existing SOC, MISP, SIEM and fraud tooling.

Are weak signals exported as confirmed?

No. Confirmation state stays explicit.