M
API Matrix

PhishStats API

Security / No Auth Required Beginner HTTPS
Free to Use Varies (check documentation)
82 Score
Grade A
Visit Official Site Compare Alternatives

Overview

PhishStats is a real-time phishing URL database that aggregates phishing site data from multiple sources. You can use it to check whether a URL has been flagged as a phishing site or to download bulk phishing data for research. It's free to use and great for building security tools or browser extensions.

💡

Beginner Tip

Use the /api/phishing.json endpoint with the ?url= parameter to check individual URLs, and check the score field — higher values indicate stronger phishing confidence.

Available Data

Use case: Integrate phishing database data into web and mobile applications
PhishStats data via REST API
JSON-formatted response data
Freely accessible without authentication

Example Response

JSON Response 
{
  "url": "https://example.com",
  "safe": true,
  "threat_level": "none",
  "categories": [
    "clean"
  ],
  "scan_date": "2025-01-15T10:00:00Z"
}

Field Reference

id Unique identifier for this phishing record.
url The full phishing URL that was reported.
ip IP address hosting the phishing page.
countrycode Two-letter country code where the phishing server is located.
score Phishing confidence score; higher values indicate stronger evidence of phishing activity.
date Timestamp when this phishing URL was first detected.

Implementation Example 

const url = "https://phishstats.info/";
const response = await fetch(url);
if (!response.ok) throw new Error(`Request failed: ${response.status}`);
const data = await response.json();
console.log(data);

What Can You Build?

Note: These code examples are AI-generated and unverified. Always refer to the official API documentation for accurate usage.

Common Errors & Troubleshooting

Connection refused or port error PhishStats API runs on non-standard port 2096, which may be blocked by firewalls.
✓ Ensure your environment allows outbound connections on port 2096, or use the provided HTTPS endpoint.
Empty results array The URL you searched for may not be in the PhishStats database.
✓ Try searching by domain fragment using the like operator: ?_where=(url,like,~yourdomain~).
Overwhelming data volume Bulk CSV downloads can be very large (hundreds of MB).
✓ Use the API query parameters (_size, _page) to fetch only the records you need rather than downloading the full dataset.

Matrix Score Breakdown

🌐 Reachability 30/30
⚡ Speed 15/20
🔒 Security 15/15
🛠 Developer XP 15/20
✓ Reliability 7/15
Response Time 268ms

Fully tested on Apr 5, 2026

Technical Specifications

Auth No Auth
HTTPS REQUIRED
CORS UNKNOWN
Category Security
Difficulty Beginner
Verified: 2026-04-04

Similar APIs

View All →

Classify

0

Classify provides programmatic access to encrypting & decrypting text messages via REST API.

No Auth Beginner HTTPS 1ms

Dehash.lt

0

Dehash.lt provides programmatic access to hash decryption md5, sha1, sha3, sha256, sha384, sha512 via REST API.

No Auth Beginner HTTPS 52ms

EmailRep

⭐ Beginner's Pick
95

EmailRep is a free API that evaluates the risk and reputation of an email address in seconds.

No Auth Beginner HTTPS 36ms

Escape

⭐ Beginner's Pick
84

EscapeAPI is a simple open-source utility API that takes raw user input and returns properly escaped versions safe for use in HTML, SQL, shell, and other contexts.

No Auth Beginner HTTPS 80ms

FilterLists

⭐ Beginner's Pick
87

FilterLists is a community-maintained directory API that catalogs hundreds of filter lists used by ad blockers and firewalls like uBlock Origin and Pi-hole.

No Auth Beginner HTTPS 83ms