Wild APIs
1,609 listings19 categoriesVerified weeklySubmit an API

Phishing & Malicious URLs APIs

Phishing and malicious URL APIs either check a link against a blocklist or analyze it directly. Google Safe Browsing is free and checks URLs against Google's malware and phishing lists, while URLhaus and FishFish maintain community databases of bad links. URLScan.io returns screenshots and DOM snapshots of scanned sites, and ScanMalware loads URLs in a sandboxed browser.
7 listings
TableRows
APIPricingAuthFormatFree tierStatus
FishFishCommunity-flagged database of phishing domains and URLs, with a live WebSocket feed of new entries.
Identity & Security › Threat Intel
API keyJSONUnlimitedLive
Google Safe Browsing APIChecks URLs against Google's lists of malware, phishing and unwanted-software sites.
Identity & Security › Threat Intel
FreeAPI keyJSON—Live
PhishStatsSearchable phishing URL, IP, and domain database with ML confidence scores, updated every 90 minutes.
Identity & Security › Threat Intel
FreemiumNoneJSON100–1k/dayLive
ScanMalwareScans URLs for malware and phishing in a sandboxed browser; search past scans by domain, IP or ASN.
Identity & Security › Threat Intel
FreeNoneJSON10k+/dayDegraded
URLhausDatabase of malicious URLs and malware samples used for phishing and malware distribution.
Identity & Security › Threat Intel
FreemiumAPI keyJSON—Live
URLScan.ioSearch public website scans for screenshots, DOM snapshots, and phishing/malware threat indicators.
Identity & Security › Threat Intel
FreemiumAPI keyJSON100–1k/dayLive
Web of TrustDomain and IP reputation/safe-browsing scores from WOT's user community and ML models.
Identity & Security › Threat Intel
Free trial—Untested

Choosing a Phishing & Malicious URLs API

Is there a free Phishing & Malicious URLs API?

Yes. Google Safe Browsing API and ScanMalware are free to use, and URLScan.io, URLhaus and PhishStats have a free tier alongside paid plans.

Which Phishing & Malicious URLs APIs work without an API key?

PhishStats and ScanMalware need no key or sign-up, so you can try them with a plain request.

Can I call a Phishing & Malicious URLs API from front-end JavaScript?

ScanMalware allows cross-origin requests and needs no key, so it works straight from the browser. For the others, call them from your server so your key stays private.

Can I use Phishing & Malicious URLs APIs in a commercial project?

Web of Trust permits commercial use. Google Safe Browsing API and URLhaus restrict it, for example to non-commercial or attributed use, so read the terms first.

Which Phishing & Malicious URLs APIs work with AI agents?

ScanMalware has an MCP server, so an AI agent can call it directly.

Broader: Threat Intel APIs · Identity & Security APIs

More in Threat Intel: IP Reputation APIs · CVE & Vulnerabilities APIs · Data Breach APIs