# Crypto Phishing Check API > Tell whether a domain is a known crypto phishing or scam site before a wallet or user connects to it — using MetaMask's canonical eth-phishing-detect blocklist, the same list that protects millions of MetaMask users, read keyless and live. It runs the real detection logic: an exact and subdomain match against the blocklist and allowlist, plus a Levenshtein fuzzy match against high-value lookalike targets to catch typosquats like "myetherwaliet.com" or "app-wallet-uniswap.org". Check a domain or URL for a verdict (blocked, allowed, fuzzy or unknown) with the reason, search the 190,000-entry blocklist, or read its stats. The dApp-connection safety layer every wallet, browser extension, Telegram bot and security tool needs to warn users before they sign. Live, lightly cached. ## Authentication All requests require your oanor API key in the `x-oanor-key` header. Get one at https://www.oanor.com/developer/keys. ```bash curl -H "x-oanor-key: oanor_live_…" "https://api.oanor.com/phishingcheck-api/..." ``` ## Pricing - **Free** (Free) — 6,300 calls/Mo, 3 req/s - **Starter** ($11/Mo) — 131,000 calls/Mo, 8 req/s - **Pro** ($36/Mo) — 800,000 calls/Mo, 20 req/s - **Business** ($103/Mo) — 5,050,000 calls/Mo, 50 req/s ## Endpoints ### Phishing #### `GET /v1/check` — Check a domain or URL: blocked / allowed / fuzzy / unknown **Parameters:** - `domain` (query, required, string) — Domain or URL to check Example: `app.uniswap.org` **Example:** ```bash curl -H "x-oanor-key: $KEY" \ "https://api.oanor.com/phishingcheck-api/v1/check?domain=app.uniswap.org" ``` **Response:** ```json { "data": { "note": "Verdict from MetaMask's eth-phishing-detect: allowlist > blocklist > fuzzy typosquat > unknown. is_phishing is true for blocked and fuzzy.", "type": "neutral", "input": "app.uniswap.org", "match": null, "domain": "app.uniswap.org", "reason": "Not on the blocklist or allowlist and not a known typosquat. No reputation either way — stay cautious.", "result": "unknown", "source": "MetaMask/eth-phishing-detect", "is_phishing": false, "list_version": 2 }, "meta": { "timestamp": "2026-06-14T08:04:08.933Z", "request_id": "4a5fccc8-4d74-4878-b6af-83a5597af308" }, "status": "ok", "message": "Domain checked successfully", "success": true } ``` #### `GET /v1/search` — Search the blocklist for domains containing a term **Parameters:** - `q` (query, required, string) — Search term (min 3 chars) Example: `uniswap` - `limit` (query, optional, string) — Max results (1-500) Example: `20` **Example:** ```bash curl -H "x-oanor-key: $KEY" \ "https://api.oanor.com/phishingcheck-api/v1/search?q=uniswap&limit=20" ``` **Response:** ```json { "data": { "note": "Blocklisted domains containing the search term. The blocklist is MetaMask's eth-phishing-detect blacklist.", "count": 20, "limit": 20, "query": "uniswap", "offset": 0, "source": "MetaMask/eth-phishing-detect", "domains": [ "app-wallet-uniswap.org", "uniswap.v2x-app.org", "connect-uniswap.org-wallet-connect-network.app", "connect-uniswap.org-dex-wallet.app", "uniswap.v2-app-x.org", "uniswap-zksync.app", "uniswap-zksync.net", "zksync-uniswap.app", "zksync-uniswap.com", "zksync-uniswap.net", "zksync-uniswap.org", "app.uniswap2v.org", "uniswap.v-2-app.org", "app.uniswap-v2pool.org", "proof-of-play-uniswap.vercel.app", "uniswapp.xyz", "web3-react-osf1gjntb-uniswap.vercel.app", "dev-uniswapsupport.pantheonsite.io", "uniswap-connecting.site", "uniswapconnect.com" ], "total_matched": 1136 }, "meta": { "timestamp": "2026-06-14T08:04:09.016Z", "request_id": "d5234786-3c05-449d-873c-d6266840b60d" }, "status": "ok", "message": "Blocklist searched successfully", "success": true } ``` ### Reference #### `GET /v1/stats` — Sizes and version of the loaded eth-phishing-detect lists **Example:** ```bash curl -H "x-oanor-key: $KEY" \ "https://api.oanor.com/phishingcheck-api/v1/stats" ``` **Response:** ```json { "data": { "note": "Sizes of MetaMask's eth-phishing-detect lists currently loaded.", "source": "MetaMask/eth-phishing-detect", "list_version": 2, "allowlist_count": 42, "blocklist_count": 198096, "fuzzy_tolerance": 1, "fuzzylist_count": 8 }, "meta": { "timestamp": "2026-06-14T08:04:09.104Z", "request_id": "5cc9236b-166d-47e7-9190-3ff25139fc8a" }, "status": "ok", "message": "Stats retrieved successfully", "success": true } ``` ### Meta #### `GET /v1/meta` — Service metadata & live sample **Example:** ```bash curl -H "x-oanor-key: $KEY" \ "https://api.oanor.com/phishingcheck-api/v1/meta" ``` **Response:** ```json { "data": { "sample": { "version": 2, "blocklist": 198096 }, "source": "MetaMask/eth-phishing-detect config (raw GitHub), live", "service": "phishingcheck-api", "endpoints": { "GET /v1/meta": "This document.", "GET /v1/check": "Check a domain or url: blocked / allowed / fuzzy / unknown (domain=app.uniswap.org).", "GET /v1/stats": "Sizes and version of the loaded eth-phishing-detect lists.", "GET /v1/search": "Search the blocklist for domains containing a term (q=uniswap, limit, offset)." }, "description": "Tell whether a domain is a known crypto phishing/scam site before a wallet connects, using MetaMask's canonical eth-phishing-detect blocklist, live and keyless. Runs the real logic: exact + subdomain match against the blocklist/allowlist plus a Levenshtein fuzzy match to catch typosquats. The dApp-connection safety layer for wallets and browser extensions. Live, lightly cached.", "upstream_status": "ok" }, "meta": { "timestamp": "2026-06-14T08:04:09.205Z", "request_id": "fbfbfdba-817d-4984-a4b8-ea1d72abbb95" }, "status": "ok", "message": "Meta", "success": true } ``` --- Marketplace page: https://www.oanor.com/api/phishingcheck-api OpenAPI spec: https://www.oanor.com/api/phishingcheck-api/openapi.json