Live indicators

Phishing URLs from OpenPhish and ransomware leak-site victim domains, combined and deduplicated.

Every URL here is defanged (hxxp://, [.]) at the collector boundary. Copying an indicator gives you the defanged form; refang it yourself in an isolated analysis environment. These are observations, not blocklist recommendations.