---
title: "Check a domain for phishing"
method: POST
path: "/v4/data/security/domain/check"
tags: ["Security API"]
---

# Check a domain for phishing

`POST /v4/data/security/domain/check`

## Request

- Base URL: `https://api.tatum.io`
- URL: `https://api.tatum.io/v4/data/security/domain/check`
- Auth: API key in header `x-api-key`

/v4/data/security/domain/check

**60000 credits per API call**

Check a domain or URL for phishing and typosquatting. The domain is screened against known phishing lists, homograph and typosquatting detection, TLD and WHOIS heuristics, and other detectors.

**Response**

*   `is_phishing` — the overall verdict.
*   `score` — 0–100; higher means more likely phishing.
*   `checks` — every detector that ran, with its individual verdict and message, so you can show the reasoning rather than just the verdict.

## Request body

- SecurityDomainCheckRequest
  - `url` string, required: The URL or domain to analyze.

## Response `200`

OK

- SecurityDomainCheckResponse: Phishing analysis of the submitted domain.
  - `is_phishing` boolean: Overall verdict — whether the domain is assessed as phishing.
  - `score` number: Risk score, 0–100. Higher means more likely phishing.
  - `checks` object[]: Every detector that ran, with its individual verdict and reasoning.
    - `check_name` string
    - `is_suspicious` boolean
    - `message` string
    - `details` string

## Other responses

- `400`: Bad Request
- `401`: Unauthorized. Not valid or inactive subscription key present in the HTTP Header.
- `403`: Forbidden. The request is authenticated, but it is not possible to perform the operation due to logical error or invalid permissions.
- `500`: Internal server error. There was an error on the server during the processing of the request.

## Changes

- **2026-11-03** `1a87afa0f639`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/tatum/apis/blockchain-data/changes/v4/data/security/domain/check/post.md)

---

[API](https://skmtc.dev/tatum/apis/blockchain-data.md) - [All operations](https://skmtc.dev/tatum/apis/blockchain-data/llms.txt) - [OpenAPI document](https://skmtc.dev/tatum/apis/blockchain-data/revisions/1a87afa0f639?raw)