Phishing Checker Template

What it does

Links or domains

Takes a full link or just a domain, and sends each to the API the right way.

A clear verdict

A red or green card with advice for each case, and an honest note that an unlisted site isn’t a guarantee.

Risk score and sources

On paid plans, shows a 0 to 100 risk meter, the matched list entry, which feeds reported it, and look-alike warnings.

Recent checks

Keeps your last six checks on the device, each tagged Phishing or Clear.

Keeps your key private

The browser only talks to your own API route, which checks the input, caches answers and limits each visitor to 10 checks a minute.

How it works

The API route: it decides whether you sent a link or a domain, then calls Phishing Domain Checker.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

/** GET /api/check?q=...: checks a domain or a full link against known phishing lists. */
export async function GET(request: Request) {
  const q = str(new URL(request.url).searchParams.get('q'), 2000);
  if (!q) return fail('Enter a link or a domain to check');

  // A full link (with a scheme or a path) goes as url; a bare name goes as domain.
  const isUrl = /^[a-z]+:\/\//i.test(q) || q.includes('/');
  const body = isUrl ? { url: /^[a-z]+:\/\//i.test(q) ? q : `https://${q}` } : { domain: q.toLowerCase() };
  if (!isUrl && !/^[a-z0-9.-]+\.[a-z0-9-]{2,}$/i.test(q) && !/^xn--/i.test(q)) {
    return fail('That doesn’t look like a domain, like example.com');
  }

  const key = `check:${JSON.stringify(body)}`;
  const hit = fromCache<Verdict>(key, TTL_MS);
  if (hit) return Response.json(hit);

  const blocked = guard(request);
  if (blocked) return blocked;

  return respond(async () => {
    const data = await callApi<Verdict>('phishingcheck', { json: body });
    toCache(key, data);
    return data;
  });
}

See the whole file on GitHub →

Deploy it

1. Get a free API key

   The free plan includes 200 credits a month, no card needed. Create your key.

2. Deploy it

   Click Deploy to Vercel. Vercel copies the repo to your GitHub account and asks for APIVERVE_API_KEY: paste your key there.

3. Open your app

   Vercel builds it and gives you a live URL, usually in about a minute. Every push to the repo redeploys it.

Try the Phishing Domain Checker API — the call this template makes

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

{
  "status": "ok",
  "error": null,
  "data": {
    "domain": "secure-banking-login.suspicious-domain.com",
    "isPhishing": true,
    "matchedDomain": "suspicious-domain.com",
    "inputType": "url",
    "originalInput": "https://secure-banking-login.suspicious-domain.com/auth",
    "isPunycode": false,
    "isIpAddress": false,
    "riskScore": 85,
    "riskLevel": "high",
    "sources": [
      "phishing-database",
      "blocklistproject"
    ]
  }
}