CheckPhish URL Scan

curl -X POST https://api.dfir-lab.ch/v1/phishing/checkphish \
  -H "Authorization: Bearer sk-dfir-your-key-here" \
  -H "Content-Type: application/json" \
  -d '{
    "urls": [
      "https://suspicious-site.com",
      "https://another-url.com"
    ]
  }'

import requests

response = requests.post(
    "https://api.dfir-lab.ch/v1/phishing/checkphish",
    headers={
        "Authorization": "Bearer sk-dfir-your-key-here",
        "Content-Type": "application/json",
    },
    json={
        "urls": [
            "https://suspicious-site.com",
            "https://another-url.com",
        ]
    },
    timeout=90,  # Allow for polling time
)

response.raise_for_status()
data = response.json()
for result in data["data"]["results"]:
    disposition = result["disposition"]
    brand = result.get("brand", "N/A")
    if disposition in ("phishing", "malware", "suspicious"):
        print(f"FLAGGED {result['url']}: {disposition} (brand: {brand})")
    elif result.get("state") == "complete" and result.get("status") == "done" and result.get("resolved") is True and not result.get("error") and disposition == "clean":
        print(f"NO KNOWN THREATS {result['url']} — safety unverified")
    else:
        print(f"UNKNOWN {result['url']} — scan incomplete or inconclusive")

const response = await fetch(
  "https://api.dfir-lab.ch/v1/phishing/checkphish",
  {
    method: "POST",
    headers: {
      Authorization: "Bearer sk-dfir-your-key-here",
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      urls: [
        "https://suspicious-site.com",
        "https://another-url.com",
      ],
    }),
  }
);

if (!response.ok) throw new Error(`HTTP ${response.status}`);
const { data, meta } = await response.json();

console.log(`Credits used: ${meta.credits_used}`);
console.log(`Summary: ${data.summary.flagged} flagged / ${data.summary.total} total`);

for (const result of data.results) {
  const flagged = ["phishing", "malware", "suspicious"].includes(result.disposition);
  const completed = result.state === "complete" && result.status === "done" && result.resolved === true && !result.error;
  const status = flagged ? "FLAGGED"
    : completed && result.disposition === "clean" ? "NO KNOWN THREATS" : "UNKNOWN";
  console.log(`[${status}] ${result.url} - ${result.disposition}`);
}