Description
PhiShark 2026 is a hosting-aware phishing website dataset created for reproducible cybersecurity research. It contains 53,591 scan-level observations: 25,598 phishing and 27,993 benign records collected between April and July 2026.
Unlike URL-only collections, this release pairs labels with available rendered page artifacts and raw technical observations. Detector scores, model-generated explanations, and internal risk indicators are excluded from the public research package.
Files
2 release components53,591 self-contained scan archives with raw evidence and available artifacts.
Scan identifiers, labels, source, hosting category, timestamps, status, and artifact availability.
Archive structure
One ZIP archive per scanEvery scan is packaged independently. Availability varies by observation, and missing evidence is represented explicitly rather than inferred.
phishark2026dataset/
└── <scan_id>.zip
├── metadata.json
├── data/
│ ├── dns.json
│ ├── whois.json
│ ├── ip_geo.json
│ ├── ip_whois.json
│ ├── ports.json
│ ├── tls_certificate.json
│ ├── web_page.json
│ ├── compliance_files.json
│ ├── redirection.json
│ └── geo_accessibility.json
└── artifacts/
├── screenshot.png
├── favicon.ico
└── page.html.gzThe archive may contain captured material and references associated with phishing observations. Use an isolated environment and do not execute captured content, visit live targets, submit forms, probe systems, or contact observed parties.
Access applications are collected through a detailed Google Form. Applicants provide their academic affiliation, institutional contact details, research purpose, intended outputs, and secure data-handling plan. After manual approval, PhiShark provides a Data Use Agreement for signature. Google Drive Viewer access is granted only after the agreement has been completed.