Analyze a URL

Passive analysis of any URL. Checks it against phishunt's stored detections (active feed, prior detections, new-registration feed) and runs live URL-shape heuristics (brand match, typosquat/homograph distance, TLD abuse, PaaS hosting, clone intent). The target URL is never contacted. Suspicious unknown domains are queued for full pipeline analysis. The full URL (path and query) is transmitted and logged, and if the domain gets queued it is later fetched by the pipeline - pass a bare domain when it carries tokens or credentials.

Read verdict and probability together. verdict is the evidence ladder (unchanged). probability is a calibrated estimate that the host is malicious, for a typical URL sent to this API (base rate about 1.3%). Passive estimates are capped low by design: the page is not fetched, and phishing with no brand in the URL is invisible to URL analysis. A verdict of no_evidence, or a low probability, is not a statement that a site is safe. Use GET /api/v1/analyze/deep for more evidence. See the Probability schema.

Unicode hosts are normalized (NFKC and IDNA), and query.host is returned in the ASCII xn-- A-label form.

Each passive query is also logged to recalibrate the probability model: host, path (no query string, no fragment, no userinfo), scores, verdict and probability. This log is kept for 90 days.

get/api/v1/analyze

Request

  • Base URL: https://phishunt.io
  • URL: https://phishunt.io/api/v1/analyze
  • Auth: none declared

Query parameters

urlstring uri required

The URL to analyze. This URL is transmitted and logged; prefer a bare domain if it carries tokens. Must be http or https, max 2048 characters.

Response

Passive analysis result.

verdict'phishing' | 'likely_phishing' | 'suspicious' | 'no_evidence' | 'not_assessed'

The single adjudicated field — read this one first. Every other block above measures ONE thing on its own scale and never adjudicates against another block (known.record.verdict and live_analysis.url_risk in particular are NOT comparable to each other — see each field's own description for the measured drift between their two independent scales); verdict reconciles all of them into one answer, in strict priority order: (1) the URL could not be evaluated -> "not_assessed"; (2) live_analysis.allowlisted -> "no_evidence", ALWAYS, regardless of what any other block says; (3) known.record.verdict critical/high -> "phishing"; (4) known.record.verdict medium -> "likely_phishing"; (5) otherwise, live_analysis.url_risk high/medium/low/minimal -> likely_phishing/suspicious/suspicious/no_evidence. external_feeds and history never raise the verdict on their own — they only ever add an explanatory phrase to verdict_basis (see there). Measured reason: 27 legitimate-brand apexes are in today's PhishTank cache, and 60 of 73 known-benign corpus URLs have SOME apex history. known.in_active_feed by itself carries no independent weight either (36 of 73 benign corpus URLs are in the active feed at verdict "low" only because of the clone-hosting score cap) — only known.record.verdict (rules 3/4 above) ever adjudicates. no_evidence is not "clean" and not "safe". It means this API found nothing that points to phishing. A page that is not fetched (passive mode) and has no brand in its URL can be phishing and still read no_evidence. Read probability beside it, and use /api/v1/analyze/deep when you need more evidence.

verdict_confidence'high' | 'medium' | 'low'

How much weight to put on verdict. "high" only for an allowlisted host (rule 2) or a critical/high known.record match (rule 3); "low" for "not_assessed" and for the weakest URL-shape-only outcomes.

verdict_basisstring[]

Short human-readable phrases explaining where verdict comes from, ordered most to least determinant. Faithful to what actually decided it: a block that did NOT determine the verdict never contributes a phrase — e.g. a "critical" known.record match never mentions a low live_analysis.url_risk_score, even though both can be true in the same response (that disagreement between the two independent scales is exactly the defect this field exists to resolve).

Example response

{
  "verdict_basis": [
    "phishunt confirmed this host: verdict critical, score 95",
    "confirmed by google_safebrowsing, openphish",
    "12 prior detections on this root domain"
  ],
  "probability": {
    "status": "ok",
    "p_malicious": 0.127,
    "percent": 13,
    "interval_80": [
      0.079,
      0.198
    ],
    "band": "unlikely",
    "relative_risk": 9.5,
    "coverage": "passive_url_only",
    "prior": 0.01342,
    "evidence": [
      {
        "class": "url_shape",
        "value": 72,
        "llr": 2.74,
        "direction": "toward_malicious"
      },
      {
        "class": "external_feed",
        "value": "none",
        "llr": -0.39,
        "direction": "toward_benign"
      },
      {
        "class": "trusted_zone",
        "value": "untrusted",
        "llr": 0.03,
        "direction": "neutral"
      }
    ],
    "not_evaluated": [],
    "model_version": "2026-09-28.2",
    "note": "At this API's ~1.3% base rate of malicious hosts among queried URLs, this estimate is 9.5x the base rate. URL-only estimate; the page was not fetched. Brand-less phishing is invisible to URL-only analysis."
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.