Crypto Phishing Domains
Crypto phishing domains and legitimate protocol domains with a label and features for classifiers: TLD, length, subdomains, hyphens, digits, character entropy, punycode, the nearest real brand, edit distance to it, and whether a brand name is embedded. Built from the threat data behind Halt.
Crypto Phishing Domains is a free dataset by Aethereal with 166,157 rows and 12 columns, updated daily at 01:15 UTC and available as CSV and Parquet at https://dataset.aethereal.top/datasets/phishing-domains-labeled.
Load it in Python
import pandas as pd
df = pd.read_csv("https://dataset.aethereal.top/files/phishing-domains-labeled.csv")
# or, faster for large files (needs pyarrow):
# df = pd.read_parquet("https://dataset.aethereal.top/files/phishing-domains-labeled.parquet")
print(df.head())Questions about this dataset
What is in the Crypto Phishing Domains dataset?
Crypto phishing domains and legitimate protocol domains with a label and features for classifiers: TLD, length, subdomains, hyphens, digits, character entropy, punycode, the nearest real brand, edit distance to it, and whether a brand name is embedded. Built from the threat data behind Halt. It has 12 columns: domain, label, tld, length, subdomains, hyphens, digits, entropy, punycode, nearest_brand, brand_distance, contains_brand.
How often is Crypto Phishing Domains updated?
Daily at 01:15 UTC. It currently has 166,157 rows and was last updated on 2026-10-21.
How do I download Crypto Phishing Domains?
Download it for free, without an account, as CSV from https://dataset.aethereal.top/files/phishing-domains-labeled.csv or as Parquet from https://dataset.aethereal.top/files/phishing-domains-labeled.parquet. AI assistants can also query it through the MCP server at https://dataset.aethereal.top/mcp.
Can I use Crypto Phishing Domains in my project?
License: CC BY 4.0. Free to use with attribution to Aethereal.
How to cite
Aethereal (2026). Crypto Phishing Domains [Data set]. Aethereal Data. https://dataset.aethereal.top/datasets/phishing-domains-labeled. Accessed 2026-10-21.
Columns
| Name | Type | Description |
|---|---|---|
| domain | string | Domain. |
| label | string | phishing or legit. |
| tld | string | Top-level domain. |
| length | number | Characters. |
| subdomains | number | Labels before the registrable name. |
| hyphens | number | Hyphen count. |
| digits | number | Digit count. |
| entropy | number | Shannon entropy of the characters. |
| punycode | string | yes if it uses punycode (xn--). |
| nearest_brand | string | Closest name among the 300 largest DeFi protocols, within 4 edits. |
| brand_distance | number | Edit distance to that brand, 0 to 4. |
| contains_brand | string | yes if a brand name appears inside a different domain. |
More Security datasets
Preview latest 20 rows
| domain | label | tld | length | subdomains | hyphens | digits | entropy | punycode | nearest_brand | brand_distance | contains_brand |
|---|---|---|---|---|---|---|---|---|---|---|---|
| binance.com | legit | com | 11 | 0 | 0 | 0 | 3.096 | no | binance | 0 | no |
| okx.com | legit | com | 7 | 0 | 0 | 0 | 2.522 | no | mexc | 3 | no |
| lido.fi | legit | fi | 7 | 0 | 0 | 0 | 2.522 | no | lido | 0 | no |
| bitfinex.com | legit | com | 12 | 0 | 0 | 0 | 3.418 | no | bitfinex | 0 | yes |
| aave.com | legit | com | 8 | 0 | 0 | 0 | 2.75 | no | aave | 0 | no |
| bybit.com | legit | com | 9 | 0 | 0 | 0 | 2.948 | no | bybit | 0 | no |
| layerzero.network | legit | network | 17 | 0 | 0 | 0 | 3.41 | no | layerzero | 0 | no |
| robinhood.com | legit | com | 13 | 0 | 0 | 0 | 3.085 | no | robinhood | 0 | no |
| ssv.network | legit | network | 11 | 0 | 0 | 0 | 3.278 | no | solv | 2 | no |
| app.morpho.org | legit | org | 14 | 1 | 0 | 0 | 2.842 | no | morpho | 0 | no |
| wbtc.network | legit | network | 12 | 0 | 0 | 0 | 3.252 | no | wbtc | 0 | no |
| coinbase.com | legit | com | 12 | 0 | 0 | 0 | 3.252 | no | coinbase | 0 | no |
| gate.com | legit | com | 8 | 0 | 0 | 0 | 3 | no | gate | 0 | no |
| app.hyperliquid.xyz | legit | xyz | 19 | 1 | 0 | 0 | 3.682 | no | hyperliquid | 0 | no |
| eigencloud.xyz | legit | xyz | 14 | 0 | 0 | 0 | 3.665 | no | eigencloud | 0 | no |
| bitget.com | legit | com | 10 | 0 | 0 | 0 | 3.122 | no | bitget | 0 | no |
| app.sky.money | legit | money | 13 | 1 | 0 | 0 | 3.239 | no | usdd | 3 | no |
| gemini.com | legit | com | 10 | 0 | 0 | 0 | 2.922 | no | gemini | 0 | no |
| mexc.com | legit | com | 8 | 0 | 0 | 0 | 2.5 | no | mexc | 0 | no |
| spark.finance | legit | finance | 13 | 0 | 0 | 0 | 3.393 | no | spark | 0 | no |