FishFish — Free Security and Threat Intelligence API (No Key)

TL;DR

FishFish is a free threat intelligence API that provides domain and IP reputation scoring. Look up a domain to get security analysis including blacklist status, threat category, risk score, and historical data. Useful for security researchers, bot developers, and anyone building systems that need to validate URLs or IPs against known threats. No API key required.

Quick start: https://fishfish.gg/api/v1/lookup?domain=google.com

No API key needed — free threat intelligence!

How to Use This API

1. Domain Reputation Lookup

Check a domain's reputation score and threat categories:

https://fishfish.gg/api/v1/lookup?domain=google.com

2. IP Address Lookup

https://fishfish.gg/api/v1/lookup?ip=8.8.8.8

3. JavaScript — Check Before Redirect

const domain = 'suspicious-site.com';
fetch(`https://fishfish.gg/api/v1/lookup?domain=${domain}`)
  .then(r => r.json())
  .then(data => {
    if (data.malicious) {
      console.log('WARNING: Known malicious domain');
      console.log('Threat:', data.threat_category);
      console.log('Score:', data.risk_score);
    } else {
      console.log('Domain appears safe');
    }
  });

4. Python — Bulk Domain Check

import requests

domains = ['example.com', 'phishing-test.com', 'google.com']
for domain in domains:
    r = requests.get(
        'https://fishfish.gg/api/v1/lookup',
        params={'domain': domain}
    ).json()
    status = 'MALICIOUS' if r.get('malicious') else 'CLEAN'
    print(f"{domain}: {status} (score: {r.get('risk_score', 'N/A')})")

Lookup google.com: https://fishfish.gg/api/v1/lookup?domain=google.com

Try This URL Now

Frequently Asked Questions

What threat categories does FishFish detect?: Categories include phishing, malware, spam, ransomware, botnet C2, scam, and crypto fraud. Each result includes a threat_category field describing the nature of the threat.
How is the risk score calculated?: The risk_score is a numeric value (0-100) based on multiple factors: blacklist presence, domain age, SSL validity, URL patterns, and historical threat data from partner feeds.
Can I look up URLs or just domains?: Yes — you can pass full URLs as well. The API parses the domain from the URL and returns results for the base domain plus any path-specific analysis.
How often is the threat database updated?: FishFish aggregates data from multiple threat intelligence feeds, updated in near real-time. Blacklist statuses and threat scores reflect the most recent intelligence available.
Is there a rate limit?: FishFish is free for reasonable individual use. For high-volume or commercial use, check the project documentation for usage guidelines.
Are historical lookups available?: Some threat data includes historical context such as first-seen date and last-reported status, helping identify patterns over time.

API Details

API URL: https://fishfish.gg/api/v1/
Documentation: fishfish.gg
Category: Security
Authentication: Not Required
Rate Limit: Reasonable use policy

What You Can Build

URL safety checker for messaging apps and link previewers
Email security scanner validating links before user clicks
Bot protection system checking IP reputation on visitor arrival
Phishing detector for security awareness training tools
Domain monitoring dashboard alerting on reputation changes