NoPhishy API

Anti-malware / API Key Intermediate HTTPS CORS

Varies by plan (check documentation)

87 A

Metadata Score Metadata estimate · not endpoint-tested

Visit Official Site Compare Alternatives

Overview

NoPhishy (Exerra Phishing Check) checks URLs against a maintained database of known phishing sites and returns whether the link is flagged as a phishing attempt. It is straightforward to integrate and useful for adding link verification to Discord bots, chat applications, or browser extensions. The CORS support makes it usable directly from front-end JavaScript.

Beginner Tip

Access this API through RapidAPI at rapidapi.com/Amiichu/api/exerra-phishing-check — sign up for RapidAPI (free) to get your key and test directly in the browser before writing any code.

Available Data

NoPhishy data via REST API

Example Response

JSON Response

{
  "url": "https://example.com",
  "safe": true,
  "threat_level": "none",
  "categories": [
    "clean"
  ],
  "scan_date": "2025-01-15T10:00:00Z"
}

Field Reference

url The URL that was checked against the phishing database

isPhishing True if the URL is a known phishing site, false or null if not found in the database

reportedAt ISO 8601 timestamp when this URL was first reported as phishing

Implementation Example

Request

const url = "https://rapidapi.com/Amiichu/api/exerra-phishing-check/";
// Replace headers or query params with the values required by this API.
const response = await fetch(url, {
  headers: {
  "X-API-Key": "YOUR_API_KEY"
  }
});
if (!response.ok) throw new Error(`Request failed: ${response.status}`);
const data = await response.json();
console.log(data);

What Can You Build?

Note: These code examples are AI-generated and unverified. Always refer to the official API documentation for accurate usage.

Common Errors & Troubleshooting

403 Forbidden RapidAPI key is missing or invalid

✓ Include x-rapidapi-key and x-rapidapi-host headers in every request; copy them from the RapidAPI endpoint page

"isPhishing": null The URL was not found in the phishing database

✓ A null or false result means the URL is not in the known-phishing list — the database is not exhaustive, so use additional checks for high-risk scenarios

400 Bad Request The url query parameter is missing or the value is not a valid URL

✓ Always include the full URL with protocol, e.g. https://example.com, not just the domain

Metadata Score Breakdown

Estimated from metadata — endpoint not independently tested

This score is estimated from observable metadata — HTTPS support, authentication model, declared CORS, and documentation reachability — because the API requires authentication or exposes no publicly testable endpoint. The five-signal breakdown is only shown for live-tested APIs.

Metadata estimate · endpoint not independently tested

How is this scored? →