DNS-verified phishing intelligence

Ask one question about any domain: is it phishing right now?

The Phishing Detection API answers it against a database of 390,000+ DNS-verified active phishing domains, rebuilt every 24 hours. One REST endpoint, one API key, a JSON verdict in under 50 milliseconds.

Trusted worldwide

More than 300 organisations worldwide have trusted the AI services of our company — among them

  • Tier 1 Telcos
  • Cybersecurity Corporations
  • Media Conglomerates
  • Leading TV Networks
  • Defense Industry Companies
  • Leading Institutional Asset Managers
  • Virtualization Software Providers
  • School Districts
  • Global Digital Marketplaces
  • AdTech Corporations
  • and many others
390K+Active phishing domains
DailyFull database rebuild
<50msTypical response time
100Domains per batch call
Only resolving domains published
Rebuilt at 04:30 UTC daily
Sub-50ms lookups
Single and batch endpoints
Full CSV / JSON feed
Pay-as-you-go credits
Try it now

Check a domain against the live database

Type any hostname below and the page calls the same lookup endpoint your application would call. The response you see is the raw JSON body: the normalised domain, the boolean verdict and the live DNS resolution status, checked in real time as you submit.

Nothing here is special-cased. It queries the identical dataset a paying integration queries — satisfy yourself the answer is real before you write a line of code against it.
  • Protocol prefixes and path segments are stripped for you, so https://host/path and host are the same query.
  • A clean domain returns is_phishing: false rather than an error, so your code has one shape to handle.
  • Subdomains are treated as distinct hosts, because that is how phishing kits are actually deployed.
GET /api/v1/check

Live domain lookup

Enter a domain to query the phishing database.

This page-embedded check is rate limited and intended for evaluation. Production integrations authenticate with an API key and consume one credit per domain.

What the service is

A deliberately narrow product, built to be placed anywhere

Send a domain. Get back whether it is on a DNS-verified list of live phishing hosts. Everything below follows from keeping the scope that tight.

Most threat-intelligence products fail on integration rather than on data. They arrive as a platform, they want to own a workflow, and six months later the security team is still negotiating which system of record they belong in. This one is a single question with a single answer, which means it can sit in a mail transfer agent hook, a browser extension's background worker, a SOAR playbook, a contact-centre agent desktop and a nightly log-enrichment job at the same time, with no shared state between any of them.

The narrowness is what makes the pricing legible. No seat count, no platform fee. A credit is a domain lookup — on its own through /api/v1/check, or as one of a hundred inside /api/v1/batch. Need the whole dataset instead of per-query answers? The daily threat feed ships it as CSV or JSON.

390,000+ active domains

The database holds hundreds of thousands of phishing domains, and every one of them has been confirmed to be live. It is not an archive of names that were once dangerous.

All-time tracking: 496,443 domains. The pipeline retires entries as aggressively as it adds them.

Rebuilt every 24 hours

New domains are ingested daily from curated threat-intelligence and OSINT collection. Entries that no longer resolve are pruned in the same pass, which keeps the list from drifting into noise.

Publishes at 04:30 UTC — the answer you get at 09:00 is hours old, not weeks.

Sub-50ms responses

A typical single lookup returns in under 50 milliseconds, which is fast enough to sit inline in a mail pipeline or a link rewriter without anyone perceiving a delay.

Fast enough to be a blocking call, not an async enrichment nobody reads.

One REST endpoint

A GET with two parameters. No SDK to install, no client library to keep current, no schema to compile. Any language with an HTTP client is a supported language.

Batch is the same idea with a JSON array, capped at 100 domains per POST.

DNS-verified, not just listed

Every candidate is resolved before publication using 50 concurrent threads through rotating proxy infrastructure with a ten-second timeout. Only domains with an active A record are retained.

That one rule separates an enforceable blocklist from a historical dump.

Full feed for offline enforcement

Where an outbound call per request is impossible — a DNS resolver policy zone, a firewall category, an isolated analysis host — the complete database downloads as CSV or JSON.

A daily changelog ships alongside it, so you patch instead of reloading.
Live database statistics

The numbers the pipeline actually reports

These are the values returned by the unauthenticated /api/v1/stats endpoint, which costs no credits and needs no key.

391,489Total active phishing domains
496,443All-time domains tracked
50Concurrent DNS verification threads
Every 24hDatabase update frequency
10sDNS resolution timeout per domain
04:30 UTCDaily publication time
Data pipeline

How a reported domain becomes an enforceable answer

Four stages run end to end every day. Nothing is published that has not survived all four.

Threat feed ingestion

Active phishing domains are collected from curated threat-intelligence feeds including phish.co.za and other OSINT sources, on a 24-hour cycle.

DNS verification

Every ingested domain is resolved using 50 parallel threads through rotating proxies. Only hosts with an active A record survive this stage.

Deduplication & classification

Survivors are deduplicated, labelled phishing/malware, and diffed against the previous day's build to produce the changelog.

API & feed delivery

The verified set is loaded into the lookup API and exported as CSV and JSON for feed subscribers, at 04:30 UTC.

The consequence of stage two is worth stating plainly, because it defines what this product is and is not. A domain that has been registered but is not yet serving will not appear. A domain that was serving last week and has since been suspended by its registrar is removed. What remains is infrastructure that is standing up at the moment the build ran, which is exactly the set you can afford to hard-block in a resolver without generating a support queue. It also means this is not a newly-registered-domain watch service; if your control objective is spotting lookalike registrations of your own brand on the day they are filed, that is a registrar-data problem and needs a different source. The classification page explains what the single phishing/malware label covers and, just as importantly, what it does not.

Integration

Copy, paste, ship

The whole client is an HTTP request and a boolean. Pick a language and take the block.

Single domain check
# pip install requests
import requests

API_KEY = "your_api_key_here"
domain  = "suspicious-site.example.com"

response = requests.get(
    "https://phishingdetectionapi.com/api/v1/check",
    params={"domain": domain, "apikey": API_KEY}
)
data = response.json()

if data["is_phishing"]:
    print(f"WARNING: {domain} is a known phishing domain!")
else:
    print(f"{domain} is not in the phishing database.")
// Node 18+ ships fetch natively
const API_KEY = 'your_api_key_here';
const domain  = 'suspicious-site.example.com';

const res = await fetch(
  `https://phishingdetectionapi.com/api/v1/check?domain=${domain}&apikey=${API_KEY}`
);
const data = await res.json();

if (data.is_phishing) {
  console.log(`WARNING: ${domain} is a known phishing domain!`);
} else {
  console.log(`${domain} is not in the phishing database.`);
}
# Single domain check
curl "https://phishingdetectionapi.com/api/v1/check?domain=suspicious-site.example.com&apikey=YOUR_KEY"

# Batch check — up to 100 domains per request, 1 credit each
curl -X POST "https://phishingdetectionapi.com/api/v1/batch" \
  -H "Content-Type: application/json" \
  -d '{
    "apikey": "YOUR_KEY",
    "domains": [
      "site1.example.com",
      "site2.example.com",
      "site3.example.com"
    ]
  }'

# Download the full daily feed (subscription required)
curl -o phishing_domains.csv "https://phishingdetectionapi.com/api/v1/feed?apikey=YOUR_KEY"
<?php
$apiKey = 'your_api_key_here';
$domain = 'suspicious-site.example.com';

$url = "https://phishingdetectionapi.com/api/v1/check?"
     . http_build_query(['domain' => $domain, 'apikey' => $apiKey]);

$response = json_decode(file_get_contents($url), true);

if ($response['is_phishing']) {
    echo "WARNING: $domain is a known phishing domain!\n";
} else {
    echo "$domain is not in the phishing database.\n";
}
Where it gets placed

Eight of the fifty-one documented integration surfaces

Each one is a different system, and each one ends up asking the same question about a hostname.

Questions

What engineers ask in the first conversation

Five answers that decide whether this fits your architecture before you look at pricing.

What exactly does a lookup cost?

One credit per domain. A single check against /api/v1/check consumes one credit; a batch POST consumes one credit per domain in the array, up to the 100-domain cap. Credits are bought in packs and are valid for twelve months from purchase.

Per-lookup cost falls with pack size: $0.0059 in Starter down to $0.0008 in Scale. Full ladder on the pricing page, pack-by-pack on the credit packages page.
Should I use per-lookup checks or the daily feed?

They answer different questions. Per-lookup checks are for the moment a specific domain appears in front of a specific decision — a message at the gateway, an agent on a call, a case being enriched. They cost a credit and return in under 50 milliseconds.

The feed is for enforcement points that cannot call out per request — a resolver, a firewall category, an internal blocklist service. No per-query cost, no runtime reachability dependency. Most teams use both: feed for the network layer, API for applications. See the daily feed page.
What is actually transmitted when I make a check?

A domain name and your API key. No message content, no user identifier, no full URL with its query string, no IP address of the person who received the link. If you are extracting hostnames from mail or proxy logs, strip the path and parameters before you call and you are sending strictly less than a public DNS query already reveals.

Keys are server-side credentials. Never embed one in a mobile app or browser JavaScript — proxy the call through your own backend.
How should I handle a false positive?

Design for it rather than assume it away. A hit means the domain is on today's DNS-verified build, not a guarantee of certainty. Make the consequence proportionate to how expensive a wrong answer is to reverse: quarantine and review rather than silently delete, warn-and-proceed on customer-facing web journeys, hard-block only where an unblock is cheap.

Keep an allow-list ahead of the check for your estate, suppliers and partners, and never call the API for those. One step, two wins: less operational risk and less credit spend.
Is there a rate limit?

Ten requests per second per API key, and a maximum of 100 domains per batch POST. Feed downloads are unlimited with a feed subscription. Exhausting your credit balance or exceeding the rate limit returns HTTP 429 with a JSON error field.

The real throughput lever is batching plus deduplication. Size on distinct domains per day, not messages. Full limit table in the API documentation.

Start checking domains today

Buy a credit pack, take your key from the dashboard, and run your last twenty-four hours of gateway or proxy domains through a single batch call. The integration is an afternoon; the answer arrives in fifty milliseconds.