TAtatum
Security API

Check a domain for phishing

Changed on

/v4/data/security/domain/check

60000 credits per API call

Check a domain or URL for phishing and typosquatting. The domain is screened against known phishing lists, homograph and typosquatting detection, TLD and WHOIS heuristics, and other detectors.

Response

  • is_phishing — the overall verdict.
  • score — 0–100; higher means more likely phishing.
  • checks — every detector that ran, with its individual verdict and message, so you can show the reasoning rather than just the verdict.
post/v4/data/security/domain/check

Request

  • Base URL
    https://api.tatum.io
  • URL
    https://api.tatum.io/v4/data/security/domain/check
  • Auth
    API key in header x-api-key

Request body

urlstring required

The URL or domain to analyze.

Example request

{
  "url": "https://lookalike.example"
}

Response

OK

is_phishingboolean

Overall verdict — whether the domain is assessed as phishing.

scorenumber

Risk score, 0–100. Higher means more likely phishing.

Example response

{
  "is_phishing": true,
  "score": 60,
  "checks": [
    {
      "check_name": "Similarity/Typosquatting Check",
      "is_suspicious": true,
      "message": "Domain looks suspiciously similar to uniswap.org",
      "details": "uniswap.org"
    }
  ]
}

Changes