The Phishing Detection API answers it against a database of 390,000+ DNS-verified active phishing domains, rebuilt every 24 hours. One REST endpoint, one API key, a JSON verdict in under 50 milliseconds.
More than 300 organisations worldwide have trusted the AI services of our company — among them
Type any hostname below and the page calls the same lookup endpoint your application would call. The response you see is the raw JSON body: the normalised domain, the boolean verdict and the live DNS resolution status, checked in real time as you submit.
https://host/path and host are the same query.is_phishing: false rather than an error, so your code has one shape to handle.Enter a domain to query the phishing database.
This page-embedded check is rate limited and intended for evaluation. Production integrations authenticate with an API key and consume one credit per domain.
Send a domain. Get back whether it is on a DNS-verified list of live phishing hosts. Everything below follows from keeping the scope that tight.
Most threat-intelligence products fail on integration rather than on data. They arrive as a platform, they want to own a workflow, and six months later the security team is still negotiating which system of record they belong in. This one is a single question with a single answer, which means it can sit in a mail transfer agent hook, a browser extension's background worker, a SOAR playbook, a contact-centre agent desktop and a nightly log-enrichment job at the same time, with no shared state between any of them.
/api/v1/check, or as one of a hundred inside /api/v1/batch. Need the whole dataset instead of per-query answers? The daily threat feed ships it as CSV or JSON.The database holds hundreds of thousands of phishing domains, and every one of them has been confirmed to be live. It is not an archive of names that were once dangerous.
New domains are ingested daily from curated threat-intelligence and OSINT collection. Entries that no longer resolve are pruned in the same pass, which keeps the list from drifting into noise.
A typical single lookup returns in under 50 milliseconds, which is fast enough to sit inline in a mail pipeline or a link rewriter without anyone perceiving a delay.
A GET with two parameters. No SDK to install, no client library to keep current, no schema to compile. Any language with an HTTP client is a supported language.
Every candidate is resolved before publication using 50 concurrent threads through rotating proxy infrastructure with a ten-second timeout. Only domains with an active A record are retained.
Where an outbound call per request is impossible — a DNS resolver policy zone, a firewall category, an isolated analysis host — the complete database downloads as CSV or JSON.
These are the values returned by the unauthenticated /api/v1/stats endpoint, which costs no credits and needs no key.
Four stages run end to end every day. Nothing is published that has not survived all four.
Active phishing domains are collected from curated threat-intelligence feeds including phish.co.za and other OSINT sources, on a 24-hour cycle.
Every ingested domain is resolved using 50 parallel threads through rotating proxies. Only hosts with an active A record survive this stage.
Survivors are deduplicated, labelled phishing/malware, and diffed against the previous day's build to produce the changelog.
The verified set is loaded into the lookup API and exported as CSV and JSON for feed subscribers, at 04:30 UTC.
The consequence of stage two is worth stating plainly, because it defines what this product is and is not. A domain that has been registered but is not yet serving will not appear. A domain that was serving last week and has since been suspended by its registrar is removed. What remains is infrastructure that is standing up at the moment the build ran, which is exactly the set you can afford to hard-block in a resolver without generating a support queue. It also means this is not a newly-registered-domain watch service; if your control objective is spotting lookalike registrations of your own brand on the day they are filed, that is a registrar-data problem and needs a different source. The classification page explains what the single phishing/malware label covers and, just as importantly, what it does not.
The whole client is an HTTP request and a boolean. Pick a language and take the block.
# pip install requests
import requests
API_KEY = "your_api_key_here"
domain = "suspicious-site.example.com"
response = requests.get(
"https://phishingdetectionapi.com/api/v1/check",
params={"domain": domain, "apikey": API_KEY}
)
data = response.json()
if data["is_phishing"]:
print(f"WARNING: {domain} is a known phishing domain!")
else:
print(f"{domain} is not in the phishing database.")
// Node 18+ ships fetch natively
const API_KEY = 'your_api_key_here';
const domain = 'suspicious-site.example.com';
const res = await fetch(
`https://phishingdetectionapi.com/api/v1/check?domain=${domain}&apikey=${API_KEY}`
);
const data = await res.json();
if (data.is_phishing) {
console.log(`WARNING: ${domain} is a known phishing domain!`);
} else {
console.log(`${domain} is not in the phishing database.`);
}
# Single domain check
curl "https://phishingdetectionapi.com/api/v1/check?domain=suspicious-site.example.com&apikey=YOUR_KEY"
# Batch check — up to 100 domains per request, 1 credit each
curl -X POST "https://phishingdetectionapi.com/api/v1/batch" \
-H "Content-Type: application/json" \
-d '{
"apikey": "YOUR_KEY",
"domains": [
"site1.example.com",
"site2.example.com",
"site3.example.com"
]
}'
# Download the full daily feed (subscription required)
curl -o phishing_domains.csv "https://phishingdetectionapi.com/api/v1/feed?apikey=YOUR_KEY"
<?php
$apiKey = 'your_api_key_here';
$domain = 'suspicious-site.example.com';
$url = "https://phishingdetectionapi.com/api/v1/check?"
. http_build_query(['domain' => $domain, 'apikey' => $apiKey]);
$response = json_decode(file_get_contents($url), true);
if ($response['is_phishing']) {
echo "WARNING: $domain is a known phishing domain!\n";
} else {
echo "$domain is not in the phishing database.\n";
}
Each one is a different system, and each one ends up asking the same question about a hostname.
Extract every hostname from a message and batch-check them before delivery.
Load the daily feed into a response policy zone so the clone never resolves.
Warn on navigation with a server-side check behind your own backend.
Batch the distinct external domains from each log interval and raise cases on hits.
Portal clones, OTP relay pages and supplier-lookalike payment diversion.
Fake storefronts and checkout-harvest pages that trade on your brand.
One list across every tenant, with per-customer credit accounting.
Industry-specific walkthroughs with integration shapes and worked examples.
Five answers that decide whether this fits your architecture before you look at pricing.
One credit per domain. A single check against /api/v1/check consumes one credit; a batch POST consumes one credit per domain in the array, up to the 100-domain cap. Credits are bought in packs and are valid for twelve months from purchase.
They answer different questions. Per-lookup checks are for the moment a specific domain appears in front of a specific decision — a message at the gateway, an agent on a call, a case being enriched. They cost a credit and return in under 50 milliseconds.
A domain name and your API key. No message content, no user identifier, no full URL with its query string, no IP address of the person who received the link. If you are extracting hostnames from mail or proxy logs, strip the path and parameters before you call and you are sending strictly less than a public DNS query already reveals.
Design for it rather than assume it away. A hit means the domain is on today's DNS-verified build, not a guarantee of certainty. Make the consequence proportionate to how expensive a wrong answer is to reverse: quarantine and review rather than silently delete, warn-and-proceed on customer-facing web journeys, hard-block only where an unblock is cheap.
Ten requests per second per API key, and a maximum of 100 domains per batch POST. Feed downloads are unlimited with a feed subscription. Exhausting your credit balance or exceeding the rate limit returns HTTP 429 with a JSON error field.
Buy a credit pack, take your key from the dashboard, and run your last twenty-four hours of gateway or proxy domains through a single batch call. The integration is an afternoon; the answer arrives in fifty milliseconds.