Phishing · Scam · Brand impersonation
StalkPhish is a French company specialised in detecting phishing, scams and brand impersonation. We build the StalkPhish.io platform, maintain open source tools for the community and share our research with security teams and the public.
As seen on
All coverage →Every single day
Our sensors pre-qualify, crawl and analyse suspicious websites around the clock, then download the phishing kits left behind to extract what scammers would rather keep hidden.
Our platform
StalkPhish.io is our product, available at stalkphish.io. Nearly 1,000 users rely on it to spot phishing URLs, protect their brand and move fast on takedowns.
Your daily phishing and brand impersonation feed: enriched URLs, phishing kits, targeted brands and the threat actors behind the campaigns.
Plug our intelligence into your own tools: search by URL, domain, IP or brand, with boolean queries and up to 180 days of history.
Search by URL, domain or IP address and get instant results from our threat database, covering the last 7 days of phishing activity.
Trusted by the ecosystemThey implement our tools or datasets.
Press & Media
Our phishing and fraud expertise is regularly featured on TV, radio and in the press, to alert and educate the public.
Thomas Damonneville explained, on the prime-time show "Cash Investigation", certain recent techniques used by French scammers, particularly the use of inbound calls and how the call centers are set up.
Watch / read ↗
Thomas Damonneville describes how "lookups" work, those aggregators of personal databases derived from data breaches. for FranceInfo.
Watch / read ↗
Some tips from Thomas Damonneville on how best to protect yourself against the potential use of data stolen from the DGFiP (the French General Directorate of Public Finance) for FranceInfo.
Watch / read ↗Research
Phishing kit teardowns, threat intelligence and product news.
Brand protection, SOC enrichment, threat hunting, Telegram exfiltration tracking: eight practical ways to use the StalkPhish API against phishing and fraud.
The enhanced StalkPhish.io API: boolean search by URL, IP, page title or brand, phishing kit and Telegram data, and plans with up to 180 days of history.
Nouvelles techniques de smishing des escrocs francophones depuis 2025 : appels entrants, contournement des filtres et organisation des réseaux « au allo ».
Community
We build and maintain free tools used by analysts worldwide to hunt phishing kits.
YARA rules to identify phishing kits from their ZIP archives. Integrated into VirusTotal’s detection engine.
The phishing kits stalker: finds kit URLs in OSINT sources, downloads sources and extracts exfiltration emails.
Spots phishing kits reusing your own website files by analysing referers in your web server logs.
A collaborative glossary of the slang used in French-speaking scam and phishing networks, from Allo to Vouch.
Start with a free search, or talk to us about API access and custom intelligence for your brand.
