Are these real phishing sites?

They're real community reports from OpenPhish's free feed. Reports are unverified and can include false positives or hosts that have already been cleaned up — a listing is a report, not a verdict.

No, and that's deliberate. The saver draws hostnames as plain canvas text with the dots bracketed, so there is no link to follow and nothing to copy accidentally into a browser.

Does it need an API key?

No. The OpenPhish community feed is free and key-less; a small background script fetches it and saves a snapshot.

Does it work offline?

The last snapshot still displays, but new reports need an internet connection.

Yes — free, no download, in your browser.

Phishing URL Feed Screensaver

The Phishing URL Feed screensaver tickers real hostnames recently reported to the OpenPhish community feed, each tagged with its top-level domain. Hosts are deliberately defanged and drawn as plain text, so nothing is clickable. It's free, needs an internet connection, and ESC exits.

How the Phishing URL Feed screensaver works

A background pipeline reads the free OpenPhish community feed of newly reported phishing URLs, with no key required.

It keeps only the hostname — never the full path or query string — and defangs it by wrapping every dot in brackets, so example.com becomes example[.]com.

The saver draws that text on a canvas: there are no anchors, no links and nothing to click, by design.

The left column shows the top-level domain, which is where the pattern shows up — a lot of phishing hides behind free subdomain hosts.

A worked example

A row like .com — ledger[.]check-tx[.]com is a classic crypto-wallet lure: the brand name sits in front of a domain the brand doesn't own. Watch for a while and the shape of the problem appears — free hosting domains and lookalike brand names, over and over.

Settings & tips

Feed speed controls how quickly rows ease up the screen.
The bracketed dots are intentional: defanging is the standard way security teams share a hostile host without anyone accidentally visiting it.
Run automation/run.py phishfeed on your pipeline machine to refresh the list.

Frequently asked questions

Are these real phishing sites?: They're real community reports from OpenPhish's free feed. Reports are unverified and can include false positives or hosts that have already been cleaned up — a listing is a report, not a verdict.
Can I click one?: No, and that's deliberate. The saver draws hostnames as plain canvas text with the dots bracketed, so there is no link to follow and nothing to copy accidentally into a browser.
Does it need an API key?: No. The OpenPhish community feed is free and key-less; a small background script fetches it and saves a snapshot.
Does it work offline?: The last snapshot still displays, but new reports need an internet connection.
Is it free?: Yes — free, no download, in your browser.

← All Security & Privacy screensavers