Free crypto phishing URL check API

Short answer

Send GET https://fakewatch.pro/api/v1/url-safe?url= with the link to check. You get JSON with a verdict (Safe, Suspicious, Malicious or Unknown), the lists that flag the host, and the crypto project it belongs to or imitates. It is free, needs no key, and never opens the URL.

Who this is for: Developers of wallets, bots, browser extensions and Telegram or Discord moderation tools that need to check links before users click them.

Request

One endpoint, one parameter. No key, no sign-up. Cross-origin requests from browsers are allowed.

GET https://fakewatch.pro/api/v1/url-safe?url=https://axieinfinity-app.tech/claim

Parameter	What to send
`url`	The link to check, URL-encoded, up to 2048 characters. A bare host such as `example.com` works too, and so do defanged links like `hxxps://example[.]com`. Only the host is checked: the path and query are ignored.

Try it in your browser: /api/v1/url-safe?url=axieinfinity.com.

Response

JSON, always with the same fields. This is the answer for the request above:

{
  "url": "https://axieinfinity-app.tech/claim",
  "host": "axieinfinity-app.tech",
  "verdict": "Malicious",
  "safe": false,
  "detections": 2,
  "sources": ["phishingdb", "scamsniffer"],
  "brand": "Axie Infinity",
  "official_domains": ["axieinfinity.com"],
  "confidence": 0.95,
  "summary": "Imitates Axie Infinity. On public phishing lists: Phishing.Database, ScamSniffer. Official site of Axie Infinity: axieinfinity.com.",
  "checked_at": "2026-11-09T12:00:00Z"
}

Field	Meaning
`url`	The URL as you sent it.
`host`	The lowercase host that was checked, in ASCII (punycode). Empty when the input has no domain name.
`verdict`	`Safe`, `Suspicious`, `Malicious` or `Unknown`, see Verdicts.
`safe`	`true` for Safe, `false` for Suspicious and Malicious, `null` for Unknown.
`detections`	How many phishing lists flag the host. 0 unless the verdict is Malicious.
`sources`	Those lists: `metamask`, `scamsniffer`, `phishingdb`.
`brand`	The crypto project the host belongs to or imitates, or `null`.
`official_domains`	That project's official domains from the FakeWatch directory.
`confidence`	0 to 1: 0.95 list match, 0.9 official domain, 0.7 lookalike, 0.6 popular site, 0.3 Unknown.
`summary`	One or two sentences with the verdict and its evidence, ready to show to a user.
`checked_at`	Time of the answer, ISO 8601 in UTC.

Verdicts

Verdict	When
Malicious	The host or a parent domain is on MetaMask eth-phishing-detect, ScamSniffer or Phishing.Database.
Suspicious	The name copies a project in the directory, by keyword, typo or look-alike letters, and is not one of its official domains. No list flags it yet.
Safe	An official domain of a project in the directory, or a long-standing popular site (Majestic Million) that no list flags.
Unknown	No evidence either way. Also returned for IP addresses, for shared hosts of popular sites where some pages were reported, and for anything that is not an http or https link.

Unknown is not Safe. A new phishing site that copies no tracked project and is on no list yet comes back as Unknown, so do not show it to users as checked and clean.

Errors and limits

422 when url is missing, empty or longer than 2048 characters.
429 after 600 requests a minute from one IP address, with a Retry-After header in seconds.

Errors are JSON too:

{"error": {"code": "invalid_url", "message": "Pass the URL to check as ?url=, e.g. ?url=uniswap.org."}}

Successful answers may be cached for five minutes (Cache-Control: public, max-age=300).

Where the answers come from

The API never opens, fetches or scans the URL you send. It looks the host up in the FakeWatch database:

three public phishing lists, synced several times a day: MetaMask eth-phishing-detect, ScamSniffer and Phishing.Database;
the official domains of the crypto projects in the FakeWatch directory, each checked against the project's own site and accounts;
the Majestic Million list of popular sites.

The lists are the work of their maintainers, not ours. Their licenses and credits are on the data sources page. A project that finds a mistake in its official domains can write to [email protected].

Frequently asked questions

Does the API open or scan the URL I send?

No. It reads only the host name and looks it up in the FakeWatch database. Sending a live phishing link is safe: no request is made to that site.

Does Unknown mean the site is safe?

No. Unknown means FakeWatch has no evidence either way: the host is on none of the lists, imitates no project in the directory and is not a known popular site. Treat it as unchecked.

How fresh are the answers?

The phishing lists are synced several times a day. An answer may be served from a cache for up to five minutes.

Do I need an API key?

No. The API is free and open to anyone, within the rate limit of 600 requests a minute per IP address.