Phishing Detection API documentation

Overview

Every entry in the database has passed a DNS resolution check before publication, so what you are querying is live infrastructure rather than a historical list of names. That constraint is the single most important thing to understand about the dataset, because it dictates both what the API is excellent at and where it deliberately stays silent. Domains that have been registered but are not yet serving do not appear; domains that have been suspended since the last build are dropped.

Key features

• Single domain check — query one domain at a time via a GET request.
• Batch check — check up to 100 domains in a single POST request.
• Daily feed — download the complete database as CSV or JSON (subscription required).
• Database stats — current database size and last update timestamp, with no key and no credit cost.

Authentication

All API requests require an API key passed as a query parameter (apikey), or in the request body for POST endpoints. Your API key is your username from registration.

# API key as a query parameter
GET /api/v1/check?domain=example.com&apikey=your_api_key

# API key in a POST body
POST /api/v1/batch
{
  "apikey": "your_api_key",
  "domains": ["example1.com", "example2.com"]
}

Base URL

All API endpoints are relative to a single host and version prefix. There is no regional routing to configure and no separate sandbox host.

https://phishingdetectionapi.com/api/v1/

Single domain check

Check whether a single domain is present in the phishing database. This is the most common endpoint and the one to use for real-time URL filtering, contact-centre lookups and interactive analyst tooling.

Parameters

Example request

curl "https://phishingdetectionapi.com/api/v1/check?domain=suspicious-login.example.com&apikey=YOUR_KEY"

Success response — phishing domain found

{
  "domain": "suspicious-login.example.com",
  "is_phishing": true,
  "dns_status": "resolves",
  "last_checked": "2026-07-28",
  "database_size": 120212553
}

Success response — clean domain

{
  "domain": "google.com",
  "is_phishing": false,
  "dns_status": "resolves",
  "last_checked": "2026-07-28",
  "database_size": 120212553
}

Note that a clean domain is a 200, not a 404. Both outcomes have the same response shape, so client code has exactly one branch to write and no error handling to conflate a "not phishing" verdict with a transport failure. The dns_status field is evaluated in real time on every request and is never null: a hostname that does not currently exist in DNS returns does_not_resolve. A syntactically invalid domain returns a 400 error instead of a verdict.

Batch check

Check up to 100 domains in a single request. Each domain in the batch costs 1 API credit. This is the right endpoint for processing email link lists, log files and bulk URL scanning, because it removes the per-request round-trip cost from the hot path.

Request body (JSON)

Example request

curl -X POST "https://phishingdetectionapi.com/api/v1/batch" \
  -H "Content-Type: application/json" \
  -d '{
    "apikey": "YOUR_KEY",
    "domains": [
      "0-105.com",
      "google.com",
      "suspicious-bank-login.example.com"
    ]
  }'

Success response

{
  "results": [
    {
      "domain": "0-105.com",
      "is_phishing": true,
      "dns_status": "resolves"
    },
    {
      "domain": "google.com",
      "is_phishing": false,
      "dns_status": "resolves"
    },
    {
      "domain": "suspicious-bank-login.example.com",
      "is_phishing": false,
      "dns_status": "does_not_resolve"
    }
  ],
  "checked": 3,
  "phishing_found": 1,
  "credits_used": 3,
  "database_size": 120212553
}

Daily feed download

Download the complete phishing domain database as a CSV file. This endpoint requires a daily feed subscription. The database is updated at 04:30 UTC daily.

Example

# Download as CSV
curl -o phishing_domains.csv "https://phishingdetectionapi.com/api/v1/feed?apikey=YOUR_KEY"

# Download as JSON
curl "https://phishingdetectionapi.com/api/v1/feed?apikey=YOUR_KEY&format=json"

CSV format

domain,category,dns_status
0-105.com,phishing/malware,resolves
0-amazon.weebly.com,phishing/malware,resolves
0-amfc.firebaseapp.com,phishing/malware,resolves
...

Database statistics

Get current statistics about the phishing domain database, including total domains, last update time and data source information.

{
  "total_active_domains": 212370,
  "total_all_time": 496443,
  "last_updated": "2025-07-09T04:30:00Z",
  "update_frequency": "daily",
  "dns_verification": true
}

Response format

All API responses are returned as JSON. The five fields below make up the single-check response.

Error codes

The API uses standard HTTP status codes. Error responses include a JSON body with an error field.

{
  "error": "API credits exhausted. Please purchase more credits."
}

A 429 is the only status that changes behaviour depending on cause: it is returned both when the per-second rate limit is exceeded and when the credit balance reaches zero. Treat the first as retryable with backoff and the second as an operational alert, and read the error string to tell them apart.

Rate limits

Rate limits depend on your plan and credit balance. Each API call consumes 1 credit, and batch calls consume 1 credit per domain.

The practical lever on both cost and throughput is deduplication rather than concurrency. A mail gateway sees enormous message volume but a comparatively small set of distinct external hostnames per day, and a short-lived in-process cache collapses most of what remains. Size your credit pack on distinct domains per day, batch them a hundred at a time, and the per-second ceiling stops being a constraint.

Code examples

Four complete clients. Each one covers the single-check endpoint, and the first two also wrap the batch endpoint.

Python

import requests

API_KEY  = "your_api_key"
BASE_URL = "https://phishingdetectionapi.com/api/v1"

# Single domain check
def check_domain(domain):
    response = requests.get(
        f"{BASE_URL}/check",
        params={"domain": domain, "apikey": API_KEY}
    )
    return response.json()

# Batch check
def batch_check(domains):
    response = requests.post(
        f"{BASE_URL}/batch",
        json={"apikey": API_KEY, "domains": domains}
    )
    return response.json()

# Usage
result = check_domain("suspicious-site.com")
if result["is_phishing"]:
    print(f"BLOCKED: {result['domain']} is phishing!")

# Batch usage
results = batch_check(["site1.com", "site2.com", "site3.com"])
for r in results["results"]:
    if r["is_phishing"]:
        print(f"Phishing: {r['domain']}")

Node.js

const API_KEY  = 'your_api_key';
const BASE_URL = 'https://phishingdetectionapi.com/api/v1';

// Single check
async function checkDomain(domain) {
  const url = `${BASE_URL}/check?domain=${domain}&apikey=${API_KEY}`;
  const res = await fetch(url);
  return res.json();
}

// Batch check
async function batchCheck(domains) {
  const res = await fetch(`${BASE_URL}/batch`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ apikey: API_KEY, domains })
  });
  return res.json();
}

// Usage
const result = await checkDomain('suspicious-site.com');
if (result.is_phishing) {
  console.log(`BLOCKED: ${result.domain}`);
}

PHP

<?php
$apiKey  = 'your_api_key';
$baseUrl = 'https://phishingdetectionapi.com/api/v1';

// Single check
function checkDomain($domain) {
    global $apiKey, $baseUrl;
    $url = $baseUrl . '/check?' . http_build_query([
        'domain' => $domain,
        'apikey' => $apiKey
    ]);
    return json_decode(file_get_contents($url), true);
}

// Usage
$result = checkDomain('suspicious-site.com');
if ($result['is_phishing']) {
    echo "BLOCKED: {$result['domain']} is phishing!\n";
}

cURL

# Single check
curl "https://phishingdetectionapi.com/api/v1/check?domain=suspicious.com&apikey=YOUR_KEY"

# Batch check
curl -X POST "https://phishingdetectionapi.com/api/v1/batch" \
  -H "Content-Type: application/json" \
  -d '{"apikey":"YOUR_KEY","domains":["site1.com","site2.com"]}'

# Download daily feed
curl -o phishing.csv "https://phishingdetectionapi.com/api/v1/feed?apikey=YOUR_KEY"

SDKs & libraries

The API uses standard REST conventions, so any HTTP client works. No SDK is required. Make GET or POST requests with your API key and parse the JSON response.

Integration tips

• Email gateways — check URLs extracted from email bodies before delivery, using the batch endpoint for efficiency. Walkthrough on the email security use case.
• DNS filtering — subscribe to the daily feed and import the CSV into your DNS sinkhole, such as Pi-hole, Bind or Unbound. See the DNS filtering use case.
• Browser extensions — call the single-check endpoint on page load to warn users, proxying through your own backend so the key stays server-side.
• SIEM integration — enrich security logs by checking domains against the API during log ingestion. Detail on the SIEM integration use case.
• Firewalls — automate daily blocklist updates with a cron job that downloads the feed CSV each morning.