{"openapi":"3.1.0","info":{"title":"Crypto Phishing Check API","version":"1.0.0","description":"Tell whether a domain is a known crypto phishing or scam site before a wallet or user connects to it — using MetaMask's canonical eth-phishing-detect blocklist, the same list that protects millions of MetaMask users, read keyless and live. It runs the real detection logic: an exact and subdomain match against the blocklist and allowlist, plus a Levenshtein fuzzy match against high-value lookalike targets to catch typosquats like \"myetherwaliet.com\" or \"app-wallet-uniswap.org\". Check a domain or URL for a verdict (blocked, allowed, fuzzy or unknown) with the reason, search the 190,000-entry blocklist, or read its stats. The dApp-connection safety layer every wallet, browser extension, Telegram bot and security tool needs to warn users before they sign. Live, lightly cached.","contact":{"name":"PremiumApi","url":"https://www.oanor.com/by/premiumapi"}},"servers":[{"url":"https://api.oanor.com/phishingcheck-api","description":"oanor gateway"}],"tags":[{"name":"Phishing"},{"name":"Reference"},{"name":"Meta"}],"components":{"securitySchemes":{"oanorKey":{"type":"apiKey","in":"header","name":"x-oanor-key","description":"Get your key at https://www.oanor.com/developer/keys"}}},"security":[{"oanorKey":[]}],"paths":{"/v1/check":{"get":{"operationId":"get_v1_check","tags":["Phishing"],"summary":"Check a domain or URL: blocked / allowed / fuzzy / unknown","description":"","parameters":[{"name":"domain","in":"query","required":true,"description":"Domain or URL to check","schema":{"type":"string"},"example":"app.uniswap.org"}],"security":[{"oanorKey":[]}],"responses":{"200":{"description":"OK","content":{"application/json":{"example":{"data":{"note":"Verdict from MetaMask's eth-phishing-detect: allowlist > blocklist > fuzzy typosquat > unknown. is_phishing is true for blocked and fuzzy.","type":"neutral","input":"app.uniswap.org","domain":"app.uniswap.org","reason":"Not on the blocklist or allowlist and not a known typosquat. No reputation either way — stay cautious.","result":"unknown","source":"MetaMask/eth-phishing-detect","is_phishing":false,"list_version":2},"meta":{"timestamp":"2026-06-14T08:04:08.933Z","request_id":"4a5fccc8-4d74-4878-b6af-83a5597af308"},"status":"ok","message":"Domain checked successfully","success":true}}}},"401":{"description":"Missing or invalid x-oanor-key header"},"402":{"description":"Active subscription required"},"429":{"description":"Rate-limit or monthly quota reached"},"502":{"description":"Upstream did not respond"}}}},"/v1/search":{"get":{"operationId":"get_v1_search","tags":["Phishing"],"summary":"Search the blocklist for domains containing a term","description":"","parameters":[{"name":"q","in":"query","required":true,"description":"Search term (min 3 chars)","schema":{"type":"string"},"example":"uniswap"},{"name":"limit","in":"query","required":false,"description":"Max results (1-500)","schema":{"type":"string"},"example":"20"}],"security":[{"oanorKey":[]}],"responses":{"200":{"description":"OK","content":{"application/json":{"example":{"data":{"note":"Blocklisted domains containing the search term. The blocklist is MetaMask's eth-phishing-detect blacklist.","count":20,"limit":20,"query":"uniswap","offset":0,"source":"MetaMask/eth-phishing-detect","domains":["app-wallet-uniswap.org","uniswap.v2x-app.org","connect-uniswap.org-wallet-connect-network.app","connect-uniswap.org-dex-wallet.app","uniswap.v2-app-x.org","uniswap-zksync.app","uniswap-zksync.net","zksync-uniswap.app","zksync-uniswap.com","zksync-uniswap.net","zksync-uniswap.org","app.uniswap2v.org","uniswap.v-2-app.org","app.uniswap-v2pool.org","proof-of-play-uniswap.vercel.app","uniswapp.xyz","web3-react-osf1gjntb-uniswap.vercel.app","dev-uniswapsupport.pantheonsite.io","uniswap-connecting.site","uniswapconnect.com"],"total_matched":1136},"meta":{"timestamp":"2026-06-14T08:04:09.016Z","request_id":"d5234786-3c05-449d-873c-d6266840b60d"},"status":"ok","message":"Blocklist searched successfully","success":true}}}},"401":{"description":"Missing or invalid x-oanor-key header"},"402":{"description":"Active subscription required"},"429":{"description":"Rate-limit or monthly quota reached"},"502":{"description":"Upstream did not respond"}}}},"/v1/stats":{"get":{"operationId":"get_v1_stats","tags":["Reference"],"summary":"Sizes and version of the loaded eth-phishing-detect lists","description":"","parameters":[],"security":[{"oanorKey":[]}],"responses":{"200":{"description":"OK","content":{"application/json":{"example":{"data":{"note":"Sizes of MetaMask's eth-phishing-detect lists currently loaded.","source":"MetaMask/eth-phishing-detect","list_version":2,"allowlist_count":42,"blocklist_count":198096,"fuzzy_tolerance":1,"fuzzylist_count":8},"meta":{"timestamp":"2026-06-14T08:04:09.104Z","request_id":"5cc9236b-166d-47e7-9190-3ff25139fc8a"},"status":"ok","message":"Stats retrieved successfully","success":true}}}},"401":{"description":"Missing or invalid x-oanor-key header"},"402":{"description":"Active subscription required"},"429":{"description":"Rate-limit or monthly quota reached"},"502":{"description":"Upstream did not respond"}}}},"/v1/meta":{"get":{"operationId":"get_v1_meta","tags":["Meta"],"summary":"Service metadata & live sample","description":"","parameters":[],"security":[{"oanorKey":[]}],"responses":{"200":{"description":"OK","content":{"application/json":{"example":{"data":{"sample":{"version":2,"blocklist":198096},"source":"MetaMask/eth-phishing-detect config (raw GitHub), live","service":"phishingcheck-api","endpoints":{"GET /v1/meta":"This document.","GET /v1/check":"Check a domain or url: blocked / allowed / fuzzy / unknown (domain=app.uniswap.org).","GET /v1/stats":"Sizes and version of the loaded eth-phishing-detect lists.","GET /v1/search":"Search the blocklist for domains containing a term (q=uniswap, limit, offset)."},"description":"Tell whether a domain is a known crypto phishing/scam site before a wallet connects, using MetaMask's canonical eth-phishing-detect blocklist, live and keyless. Runs the real logic: exact + subdomain match against the blocklist/allowlist plus a Levenshtein fuzzy match to catch typosquats. The dApp-connection safety layer for wallets and browser extensions. Live, lightly cached.","upstream_status":"ok"},"meta":{"timestamp":"2026-06-14T08:04:09.205Z","request_id":"fbfbfdba-817d-4984-a4b8-ea1d72abbb95"},"status":"ok","message":"Meta","success":true}}}},"401":{"description":"Missing or invalid x-oanor-key header"},"402":{"description":"Active subscription required"},"429":{"description":"Rate-limit or monthly quota reached"},"502":{"description":"Upstream did not respond"}}}}},"x-oanor-pricing":[{"slug":"free","name":"Free","price_cents_month":0,"monthly_call_quota":6300,"rps_limit":3,"hard_limit":true},{"slug":"starter","name":"Starter","price_cents_month":1090,"monthly_call_quota":131000,"rps_limit":8,"hard_limit":true},{"slug":"pro","name":"Pro","price_cents_month":3550,"monthly_call_quota":800000,"rps_limit":20,"hard_limit":true},{"slug":"business","name":"Business","price_cents_month":10300,"monthly_call_quota":5050000,"rps_limit":50,"hard_limit":true}],"x-oanor-marketplace-url":"https://www.oanor.com/api/phishingcheck-api"}