Sites API
Is this website on a known crypto-phishing list?
Whether a website hostname is on a crypto-phishing/drainer blocklist. A hit is a strong signal; a miss is null, never false, and is not a safety claim. Crypto-only; a subdomain inherits its listing.
/api/external/site-analysis/site-listed/{host}What it returns
Looks up one hostname against a crypto-phishing/wallet-drainer blocklist. This is a list-membership check, not a phishing detector: measured 2026-09-16 over 252 live calls, it finds 100% of a public blacklist that is very likely one of its own inputs, but only 16.00% (curated) / 5.00% (uncurated) of an independent one. Treat listed: true as a strong signal and listed: null as "not on a list we can see" — never as "this site is safe". Covers crypto phishing only, not general phishing. Has no chain: the underlying lookup takes no chain parameter at all. Accepts either a bare hostname or a full URL — a full URL's host is extracted before the lookup runs, so https://evil.com/path and evil.com are the same call.
Chains
This endpoint is not tied to a chain: it takes no chain in its request.
Request
Send your key in the x-dex-data-key header. Replace each <placeholder> with a real value.
curl -H "x-dex-data-key: $DEXDATA_API_KEY" \ "https://api.dexdata.io/api/external/site-analysis/site-listed/<host>"
| Parameter | Description |
|---|---|
hostpath · string · required | A website's hostname — e.g. "example.com" — OR a full URL, e.g. "https://example.com/path". A full URL has its host extracted before the lookup runs; scheme, path, query and port otherwise change nothing about the answer (measured). Case-insensitive. |
Response fields
A JSON response. Every field is always present; null means the value could not be established, never zero.
| Field | Type | Description |
|---|---|---|
host | string | The normalised host actually queried -- trimmed and lowercased. Always present, even when the lookup below fails: it is computed from your own input, not from the underlying source. |
listed | boolean | null | Whether this host (or an ancestor of it -- see listedVia) is on the blocklist. NEVER false. The underlying source answers the identical 0 for a domain that has never resolved and for a string that is not a URL at all -- there is no state distinguishing "checked and found clean" from "never asked". null means "not asserted": it covers both "no record on this blocklist" and "the lookup could not be completed" (a timeout or a source-side failure), which are indistinguishable in this response and carry no retry hint. A freshly-registered phishing site will typically also read null here -- being unlisted is not being safe. |
listedVia | string | null | The shallowest ancestor host that itself carries the listing, or the same value as host when the listing is specific to it. null whenever listed is not true. The underlying source flags entire shared-hosting domains and every subdomain inherits the flag (measured: an entire Cloudflare R2 public-bucket apex and a free-hosting apex are both listed outright, including bucket names nobody has ever registered), so a true with listedVia equal to a hosting apex is a fact about that shared apex, not a targeted judgement of the exact site. |
Start building with DexData today
Sign in, create a key and make your first call in a minute. Free credits every month, and you only pay for calls that succeed.
Get a free API key