Censys vs PhishStats

Censys grew out of the University of Michigan's ZMap internet-scanning research and now re-scans the full public IPv4 space multiple times a day, fingerprinting open ports, services, and TLS certificates. Its Search API exposes that host and certificate-transparency dataset for asset discovery, exposure monitoring, and threat hunting, and underpins Censys's own attack-surface-management product. Access is account-scoped through an API key, with a limited free community tier and metered paid plans for higher query volume.

PhishStats crowdsources and republishes a running feed of phishing URLs, screenshots, and detection metadata, giving anyone a free real-time phishing blocklist to query or download. The REST API — now served from api.phishstats.info after moving off its old port-based endpoint — supports complex filter queries against the phishing database and returns JSON records ready to stream into an existing security stack. Anonymous lookups are capped at 50 requests/day per IP; a free registered key raises that to 150/day, with paid tiers for higher volume.