Free APIs to Check a Malicious URL or Domain
Short answer
Five free options are worth knowing: the VirusTotal public API, abuse.ch URLhaus, Google Safe Browsing, urlscan.io and the OpenPhish community feed. Each has conditions: VirusTotal’s public API is limited to 500 requests per day and 4 per minute and must not be used in commercial products or services, and Safe Browsing is for non-commercial use only. A clean result never proves a URL is safe, so combine at least two sources.
Last reviewed 4 November 2026. Limits and terms were read on each provider’s own page that day and can change; check the page before you build on them.
Free URL and domain checking APIs compared
| Service | What it checks | Free-tier limits and terms (from its docs) | Source |
|---|---|---|---|
| VirusTotal public API | Files, URLs, domains and IPs against many scanners | 500 requests per day and 4 requests per minute. The docs say the Public API must not be used in commercial products or services, or in business workflows that do not contribute new files. | VirusTotal docs: public vs premium API |
| abuse.ch URLhaus | URLs and hosts distributing malware | Free under fair use, but an Auth-Key is required. The docs say use by companies or for-profit needs may require a paid subscription. No request rate limit is stated on the page. | urlhaus.abuse.ch/api |
| Google Safe Browsing | URLs against Google’s lists of unsafe web resources | The docs say there is no cost, but the API is for non-commercial use only (not for sale or revenue-generating purposes). You get a default quota when you enable it; the number is shown in your Google developer console. For commercial use the docs point to Web Risk. | Safe Browsing usage limits |
| urlscan.io | Scans a page in a sandbox browser and lets you search past scans | You need an account and an API key. The docs say unauthenticated users receive only minor quotas; read urlscan’s rate-limits page for the current numbers. | urlscan.io API docs |
| OpenPhish community feed | A text list of known phishing URLs (a feed, not a lookup API) | The free community tier is a text file refreshed every 12 hours (paid tiers refresh every 5 minutes). Using it means accepting OpenPhish’s Terms of Use; read them for any commercial restriction. | openphish.com/phishing_feeds.html |
How to combine them
Use a reputation source for a quick verdict (VirusTotal or Safe Browsing), a malware-distribution list (URLhaus) for hosts serving payloads, and a sandbox scan (urlscan.io) when you need to see what the page does. Cache results so you stay inside the daily limits.
Treat no detection as unknown rather than safe. New phishing pages are often missed for hours. Check the domain’s age and registrar, its DNS records and its certificate as well.
What we left out, and why
AbuseIPDB’s API checks IP addresses only according to its docs (free accounts: 1,000 reports and checks per day), so it does not answer a domain question. PhishTank’s API page does not state its rate limits or whether new registrations are open, so we did not list it.
Before you ship anything built on these APIs, read the provider’s terms. Several of the free tiers above exclude commercial use.
No-key checks you can do in the browser
PlayCISO’s tools below run without an API key from you. They give signals, not verdicts: pair them with one of the APIs above.
Try it on PlayCISO
Check the shape of a link for look-alike and tracking tricks.
Reputation checkerLook up a hash, URL, domain or IP against existing VirusTotal results with no key.
WHOIS lookupRegistrar and registration dates for a domain (young domains are a phishing signal).
DNS lookupQuery A, MX, TXT, NS and other records for a domain.
Punycode converterReveal look-alike (homograph) domains.
SSL/TLS certificate decoderRead the issuer, validity and names on a certificate.
Frequently asked questions
What are the best free APIs to check a malicious URL or domain?
The VirusTotal public API, abuse.ch URLhaus, Google Safe Browsing and urlscan.io are the main free options, with the OpenPhish community feed as a free phishing list. Their free tiers carry limits and terms, summarised in the table above: VirusTotal allows 500 requests per day and 4 per minute and excludes commercial use, and Safe Browsing is non-commercial only.
Can I use the VirusTotal public API in a company product?
Not under its public terms. The VirusTotal docs say the Public API must not be used in commercial products or services or in business workflows that do not contribute new files. Ask VirusTotal about its premium API.
Does Google Safe Browsing cost anything?
The usage-limits page says there is no cost, but the API is for non-commercial use only. For commercial needs the page points to Web Risk.
If every API says a URL is clean, is it safe?
No. Reputation lists lag new phishing pages. Check domain age, DNS and the certificate, and open suspicious links only in an isolated environment.