← API network SECURITY / URL SCAN / PHISHING / MALWARE

Direct Platform v0.0.2 / General Availability api.dakidarts.comDirect gateway

Malware & Phishing URL Scanner API

A composite URL, IP, domain and file-hash scanner combining local heuristics with optional VirusTotal lookups, WHOIS, TLS inspection and suspicious-domain pattern checks.

Preview examples View on RapidAPI OpenAPI 3.1 ↗ GitHub repository ↗ Release feed ↗

Direct PlatformMA

api.dakidarts.comv0.0.2General Availability25ms p9523 documented endpoints

DIRECT NATIVE API

Call Malware & Phishing URL Scanner API through the Dakidarts gateway.

0 of 23 endpoints have an upstream URL configured. Other routes return 503 before billing; only send live requests to configured routes. The gateway injects upstream credentials for you.

Live checkout opens after an API route has an upstream URL. Preview examples are available below.

Base URLhttps://api.dakidarts.com/malware-url-scanner

AuthenticationX-API-Key: dk_live_...

Default reference pathGET /scan/bulk

Commercial modelPay-as-you-go / $0.0050 per call

01 / ACCESS

One key, one gateway

Use a Dakidarts API key with read or write scopes and control which APIs that key can reach.

02 / BILLING

Metered by the call

Wallet credits, plan quotas and organization invoices are settled per request with transparent response headers.

03 / RELIABILITY

Observable by default

Latency, upstream status and execution mode are logged so integration issues are visible before they spread.

RAPIDAPI SPOTLIGHTRapidAPI Marketplace

Also available through RapidAPI.

Keep the direct Dakidarts gateway as your primary route, or use the RapidAPI listing when marketplace billing and key management fit your stack better.

View on RapidAPI Plans, keys and usage stay inside RapidAPI.

CAPABILITIES

Built to disappear into the product.

The best API is the one your team can integrate, observe and then stop thinking about.

Normalize and validate URLs before scanning

Designed as a composable building block for product teams, internal tooling and automation.

Inspect cached scan reports and bulk results

Designed as a composable building block for product teams, internal tooling and automation.

Treat provider failures and unknown verdicts separately from safe results

Designed as a composable building block for product teams, internal tooling and automation.

PLATFORM FACTS

The shape of the surface.

Selected facts about coverage, delivery and production readiness.

01Composite URL scans and batches of up to 50 URLs

02Optional VirusTotal BYOK for URL, hash, IP and domain lookups

03WHOIS, SSL and suspicious-pattern utilities

FAQ

Answers before you integrate.

Access, billing and integration details for Malware & Phishing URL Scanner API.

What does the URL scanner check? +

URLs for phishing and malware indicators before they are used in your product.

Can I scan user-submitted links? +

Yes. It is designed for checks before redirects or user actions.

Does it guarantee a URL is safe? +

No. It provides risk signals and should be combined with other security controls.

How do I get access? +

Subscribe on the Dakidarts dashboard, then use an API key with this API in scope.

Can I scan in bulk? +

Bulk behavior depends on plan and rate limits; contact the team for higher-volume requirements.

SUBSCRIPTION PLANS

Choose a quota that matches the workload.

Plans are shown for reference. Live checkout opens after an API route has an upstream URL.

WALLET-ACCESS

Pay-as-you-go access

$0.00 / month

Wallet credits per call
$0.0050 / call overage
120 req/min

INTEGRATION PATH

From first request to production.

Start with a Dakidarts key, call the gateway, then monitor usage from the dashboard.

Create a Dakidarts key

Choose the API scope, then copy the key into your server environment.

Call the gateway

Send requests to https://api.dakidarts.com/malware-url-scanner with your key and JSON body.

Watch usage

Track calls, latency and spend from the API dashboard and wallet.

ENDPOINT REFERENCE

Endpoint reference & metered costs.

These routes include contracts imported from the product implementation. 0 of 23 endpoints have an upstream URL configured. Other routes return 503 before billing; saved examples are previews only. Configure an upstream URL in API Studio to enable those routes.

GROUP / 01

Operations

Operations endpoints sourced from the Malware & Phishing URL Scanner API implementation.

2 endpoints

GET /status Ping SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Returns malware scanner service health and API version.

Snapshot from docs/endpoints/status.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

`/status` — Health check & API meta

Added in v0.0.1. Refreshed in v0.0.2 (version meta, endpoint listing).

Methods

GET / POST

Parameters

None.

Example

curl "https://<host>/status"

Response `200`

{
  "success": true,
  "status": "API is online",
  "api": {
    "name": "Malware Scanner API",
    "version": "v0.0.2",
    "base_url": "https://malware-scanner.p.rapidapi.com",
    "docs": "https://...",
    "byok": "External provider keys (e.g. VirusTotal) are supplied per-request in the 'x-apikey' header.",
    "subscriptions": "Managed via the RapidAPI dashboard."
  },
  "endpoints": [
    { "method": "GET/POST", "path": "/status", "version": "v0.0.1", "description": "Health check & API meta" },
    { "method": "GET/POST", "path": "/scan", "version": "v0.0.1", "description": "Composite URL scan (local heuristics + optional VirusTotal)" },
    { "method": "POST", "path": "/scan/bulk", "version": "v0.0.2", "description": "Batch-scan up to 50 URLs" }
  ],
  "meta": {
    "name": "Malware Scanner API",
    "version": "v0.0.2",
    "docs": "https://..."
  }
}

Notes

Used by uptime monitors and by the RapidAPI "Test endpoint" tool.
The meta.version field is the source of truth for API versioning.

Source contract imported from malware scanner/app.py. Handler: ping. Reference: docs/endpoints/status.md.

QUICK CURL

curl -X GET https://api.dakidarts.com/malware-url-scanner/status -H 'X-API-Key: dk_live_...' -H 'Accept: application/json'

POST /status Ping SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Returns malware scanner service health and API version.

Snapshot from docs/endpoints/status.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

`/status` — Health check & API meta

Added in v0.0.1. Refreshed in v0.0.2 (version meta, endpoint listing).

Methods

GET / POST

Parameters

None.

Example

curl "https://<host>/status"

Response `200`

{
  "success": true,
  "status": "API is online",
  "api": {
    "name": "Malware Scanner API",
    "version": "v0.0.2",
    "base_url": "https://malware-scanner.p.rapidapi.com",
    "docs": "https://...",
    "byok": "External provider keys (e.g. VirusTotal) are supplied per-request in the 'x-apikey' header.",
    "subscriptions": "Managed via the RapidAPI dashboard."
  },
  "endpoints": [
    { "method": "GET/POST", "path": "/status", "version": "v0.0.1", "description": "Health check & API meta" },
    { "method": "GET/POST", "path": "/scan", "version": "v0.0.1", "description": "Composite URL scan (local heuristics + optional VirusTotal)" },
    { "method": "POST", "path": "/scan/bulk", "version": "v0.0.2", "description": "Batch-scan up to 50 URLs" }
  ],
  "meta": {
    "name": "Malware Scanner API",
    "version": "v0.0.2",
    "docs": "https://..."
  }
}

Notes

Used by uptime monitors and by the RapidAPI "Test endpoint" tool.
The meta.version field is the source of truth for API versioning.

Source contract imported from malware scanner/app.py. Handler: ping. Reference: docs/endpoints/status.md.

SAMPLE RESPONSE

{
  "api": {
    "byok": "External provider keys (e.g. VirusTotal) are supplied per-request in the 'x-apikey' header.",
    "docs": "https://...",
    "name": "Malware Scanner API",
    "version": "v0.0.2",
    "base_url": "https://malware-scanner.p.rapidapi.com",
    "subscriptions": "Managed via the RapidAPI dashboard."
  },
  "meta": {
    "docs": "https://...",
    "name": "Malware Scanner API",
    "version": "v0.0.2"
  },
  "status": "API is online",
  "success": true,
  "endpoints": [
    {
      "path": "/status",
      "method": "GET/POST",
      "version": "v0.0.1",
      "description": "Health check & API meta"
    },
    {
      "path": "/scan",
      "method": "GET/POST",
      "version": "v0.0.1",
      "description": "Composite URL scan (local heuristics + optional VirusTotal)"
    },
    {
      "path": "/scan/bulk",
      "method": "POST",
      "version": "v0.0.2",
      "description": "Batch-scan up to 50 URLs"
    }
  ]
}

QUICK CURL

curl -X POST https://api.dakidarts.com/malware-url-scanner/status -H 'X-API-Key: dk_live_...' -H 'Accept: application/json'

GROUP / 02

Analysis

Analysis endpoints sourced from the Malware & Phishing URL Scanner API implementation.

4 endpoints

GET /scan Scan SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Combines local URL analysis with optional VirusTotal checks for a URL.

Snapshot from docs/endpoints/scan.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

`/scan` — Composite URL scan

Added in v0.0.1. Enhanced in v0.0.2:

structured checks object (was a flat string list),
optional VirusTotal via BYOK header,
normalized input (missing https:// is auto-added).

Methods

GET / POST

Parameters

Param	Type	Required	Description
`url`	string	yes	URL (or bare domain) to scan

Optional header

Header	Description
`x-apikey`	VirusTotal key. If present, VirusTotal analysis is included in the scan.

Example


Source contract imported from malware scanner/app.py. Handler: scan. Reference: docs/endpoints/scan.md.

PARAMETERS

Name	In	Type	Required	Description
`url`	query	string	Yes	URL (or bare domain) to scan
`x-apikey`	header	string	No	Optional VirusTotal API key for external checks (BYOK).
`x-virustotal-apikey`	header	string	No	Accepted alias for the optional VirusTotal API key.

QUICK CURL

curl -X GET https://api.dakidarts.com/malware-url-scanner/scan -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'x-apikey: YOUR_X_APIKEY' -H 'x-virustotal-apikey: YOUR_X_VIRUSTOTAL_APIKEY'

POST /scan Scan SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Combines local URL analysis with optional VirusTotal checks for a URL.

Snapshot from docs/endpoints/scan.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

`/scan` — Composite URL scan

Added in v0.0.1. Enhanced in v0.0.2:

structured checks object (was a flat string list),
optional VirusTotal via BYOK header,
normalized input (missing https:// is auto-added).

Methods

GET / POST

Parameters

Param	Type	Required	Description
`url`	string	yes	URL (or bare domain) to scan

Optional header

Header	Description
`x-apikey`	VirusTotal key. If present, VirusTotal analysis is included in the scan.

Example


Source contract imported from malware scanner/app.py. Handler: scan. Reference: docs/endpoints/scan.md.

PARAMETERS

Name	In	Type	Required	Description
`url`	body	string	Yes	URL (or bare domain) to scan
`x-apikey`	header	string	No	Optional VirusTotal API key for external checks (BYOK).
`x-virustotal-apikey`	header	string	No	Accepted alias for the optional VirusTotal API key.

QUICK CURL

curl -X POST https://api.dakidarts.com/malware-url-scanner/scan -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'x-apikey: YOUR_X_APIKEY' -H 'x-virustotal-apikey: YOUR_X_VIRUSTOTAL_APIKEY' -H 'Content-Type: application/json' -d '{"url": "example"}'

GET /scan/report Scan Report SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Returns the previously cached `/scan` result (including its `cached_at` timestamp).

Snapshot from docs/endpoints/scan-report.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

`/scan/report` — Retrieve a cached scan

Added in v0.0.2.

Returns the previously cached /scan result (including its cached_at timestamp).

Methods

GET / POST

Parameters

Param	Type	Required	Description
`url`	string	yes	The URL whose cached report you want

Example

curl "https://<host>/scan/report?url=example.com"

Response `200`

{
  "success": true,
  "input": "https://example.com",
  "analysis": {
    "status": "safe",
    "reason": "No suspicious indicators found",
    "checks": {},
    "cached_at": "2026-08-27T22:47:19.417668"
  },
  "meta": { "name": "Malware Scanner API", "version": "v0.0.2", "docs": "https://..." }
}

Errors

Status	Condition
`400`	Missing or invalid `url`
`404`	No cached report found (run `/scan` first)

Notes

Reports expire automatically after 90 days (see Caching).
A report is stored separately for scans with a VirusTotal key and without one.

The most complete available report is returned.

Source contract imported from malware scanner/app.py. Handler: scan_report. Reference: docs/endpoints/scan-report.md.

PARAMETERS

Name	In	Type	Required	Description
`url`	query	string	Yes	The URL whose cached report you want
`x-apikey`	header	string	No	Optional VirusTotal API key for external checks (BYOK).
`x-virustotal-apikey`	header	string	No	Accepted alias for the optional VirusTotal API key.

QUICK CURL

curl -X GET https://api.dakidarts.com/malware-url-scanner/scan/report -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'x-apikey: YOUR_X_APIKEY' -H 'x-virustotal-apikey: YOUR_X_VIRUSTOTAL_APIKEY'

POST /scan/report Scan Report SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Returns the previously cached `/scan` result (including its `cached_at` timestamp).

Snapshot from docs/endpoints/scan-report.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

`/scan/report` — Retrieve a cached scan

Added in v0.0.2.

Returns the previously cached /scan result (including its cached_at timestamp).

Methods

GET / POST

Parameters

Param	Type	Required	Description
`url`	string	yes	The URL whose cached report you want

Example

curl "https://<host>/scan/report?url=example.com"

Response `200`

{
  "success": true,
  "input": "https://example.com",
  "analysis": {
    "status": "safe",
    "reason": "No suspicious indicators found",
    "checks": {},
    "cached_at": "2026-08-27T22:47:19.417668"
  },
  "meta": { "name": "Malware Scanner API", "version": "v0.0.2", "docs": "https://..." }
}

Errors

Status	Condition
`400`	Missing or invalid `url`
`404`	No cached report found (run `/scan` first)

Notes

Reports expire automatically after 90 days (see Caching).
A report is stored separately for scans with a VirusTotal key and without one.

The most complete available report is returned.

Source contract imported from malware scanner/app.py. Handler: scan_report. Reference: docs/endpoints/scan-report.md.

PARAMETERS

Name	In	Type	Required	Description
`url`	body	string	Yes	The URL whose cached report you want
`x-apikey`	header	string	No	Optional VirusTotal API key for external checks (BYOK).
`x-virustotal-apikey`	header	string	No	Accepted alias for the optional VirusTotal API key.

SAMPLE RESPONSE

{
  "meta": {
    "docs": "https://...",
    "name": "Malware Scanner API",
    "version": "v0.0.2"
  },
  "input": "https://example.com",
  "success": true,
  "analysis": {
    "checks": {},
    "reason": "No suspicious indicators found",
    "status": "safe",
    "cached_at": "2026-08-27T22:47:19.417668"
  }
}

QUICK CURL

curl -X POST https://api.dakidarts.com/malware-url-scanner/scan/report -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'x-apikey: YOUR_X_APIKEY' -H 'x-virustotal-apikey: YOUR_X_VIRUSTOTAL_APIKEY' -H 'Content-Type: application/json' -d '{"url": "example"}'

GROUP / 03

Batch operations

Batch operations endpoints sourced from the Malware & Phishing URL Scanner API implementation.

1 endpoint

POST /scan/bulk Scan Bulk SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Scans a batch of up to 50 URLs and returns per-URL verdicts.

Snapshot from docs/endpoints/scan-bulk.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

`/scan/bulk` — Batch scan URLs

Added in v0.0.2.

Methods

POST

Parameters

Param	Type	Required	Description
`urls`	array of strings	yes	1–50 URLs to scan

Optional header

Header	Description
`x-apikey`	VirusTotal key. If present, VirusTotal is included in each scan.

Example

curl -X POST "https://<host>/scan/bulk" \
     -H "Content-Type: application/json" \
     -d '{"urls": ["example.com", "secure-login-bank.example", "google.com"]}'

Response `200`

{
  "success": true,
  "scanned": 2,
  "invalid_urls": ["bad url"],
  "vt_key_used": false,
  "results": [
    {
      "url": "https://example.com",
      "analysis": {
        "status": "safe",
        "reason": "No suspicious indicators found",
        "checks": {}
      }
    },
    {
      "url": "https://secure-login-bank.example",
      "analysis": {
        "status": "suspicious",
        "reason": ["Contains suspicious keyword(s): secure, login, bank"],
        "checks": {}
      }
    }
  ],
  "meta": { "name": "Malware Scanner API", "version": "v0.0.2", "docs": "https://..." }
}

Behavior

Invalid entries are not scanned; they appear in invalid_urls.
URLs are scanned concurrently (up to 5 workers) for speed.
Each entry uses the same verdict logic as /scan.

Errors

Status	Condition
`400`	`urls` missing, not an array, or more than 50 entries
`500`	Unexpected internal error

Notes

The analysis object per URL has the same shape as /scan's analysis.
Scans are not written to the shared cache in bulk mode, so /scan/report may return

404 for bulk-scanned URLs.

Source contract imported from malware scanner/app.py. Handler: scan_bulk. Reference: docs/endpoints/scan-bulk.md.

PARAMETERS

Name	In	Type	Required	Description
`urls`	body	array	Yes	1–50 URLs to scan

SAMPLE RESPONSE

{
  "meta": {
    "docs": "https://...",
    "name": "Malware Scanner API",
    "version": "v0.0.2"
  },
  "results": [
    {
      "url": "https://example.com",
      "analysis": {
        "checks": {},
        "reason": "No suspicious indicators found",
        "status": "safe"
      }
    },
    {
      "url": "https://secure-login-bank.example",
      "analysis": {
        "checks": {},
        "reason": [
          "Contains suspicious keyword(s): secure, login, bank"
        ],
        "status": "suspicious"
      }
    }
  ],
  "scanned": 2,
  "success": true,
  "vt_key_used": false,
  "invalid_urls": [
    "bad url"
  ]
}

QUICK CURL

curl -X POST https://api.dakidarts.com/malware-url-scanner/scan/bulk -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'Content-Type: application/json' -d '{"urls": "example"}'

GROUP / 04

Vt

Vt endpoints sourced from the Malware & Phishing URL Scanner API implementation.

8 endpoints

GET /vt/url Vt Url Endpoint SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Looks up a URL in VirusTotal and returns its analysis.

Snapshot from docs/endpoints/vt-url.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

`/vt/url` — VirusTotal URL analysis

Added in v0.0.2. BYOK required.

Methods

GET / POST

Required header

Header	Description
`x-apikey`	Your VirusTotal API key

Parameters

Param	Type	Required	Description
`url`	string	yes	URL to analyze (scheme auto-added if missing)

Example

curl "https://<host>/vt/url?url=example.com" -H "x-apikey: YOUR_VIRUSTOTAL_KEY"

Response `200`

{
  "success": true,
  "input": "https://example.com",
  "analysis": {
    "provider": "virustotal",
    "url": "https://example.com",
    "status": "safe",
    "reason": "No engines flagged",
    "detection_stats": {
      "malicious": 0, "suspicious": 0, "harmless": 70,
      "undetected": 10, "timeout": 0, "total_engines": 80
    },
    "reputation": 100,
    "last_modification_date": 1735689600,
    "engines": [
      { "engine": "Fortinet", "category": "harmless", "result": "clean", "method": "blacklist" }
    ]
  },
  "meta": { "name": "Malware Scanner API", "version": "v0.0.2", "docs": "https://..." }
}

Special states

`status`	Meaning
`pending`	URL was not in VirusTotal's DB — it was auto-submitted for analysis. Re-check later.
`unknown`	(n/a for URLs)
`error`	Key invalid/quota exceeded/network failure. `reason` explains why.

Errors

Status	Condition
`401`	Missing `x-apikey` header
`400`	Missing or invalid `url`
`200` + `analysis.status = error`	Provider-level failure (invalid key, quota, timeout)

Notes

Results are cached for 90 days. Use /scan for a composite verdict instead.

Source contract imported from malware scanner/app.py. Handler: vt_url_endpoint. Reference: docs/endpoints/vt-url.md.

PARAMETERS

Name	In	Type	Required	Description
`url`	query	string	Yes	URL to analyze with VirusTotal.
`x-apikey`	header	string	Yes	VirusTotal API key required for this endpoint (BYOK).
`x-virustotal-apikey`	header	string	No	Accepted alias for the VirusTotal API key.

QUICK CURL

curl -X GET https://api.dakidarts.com/malware-url-scanner/vt/url -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'x-apikey: YOUR_X_APIKEY' -H 'x-virustotal-apikey: YOUR_X_VIRUSTOTAL_APIKEY'

POST /vt/url Vt Url Endpoint SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Looks up a URL in VirusTotal and returns its analysis.

Snapshot from docs/endpoints/vt-url.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

`/vt/url` — VirusTotal URL analysis

Added in v0.0.2. BYOK required.

Methods

GET / POST

Required header

Header	Description
`x-apikey`	Your VirusTotal API key

Parameters

Param	Type	Required	Description
`url`	string	yes	URL to analyze (scheme auto-added if missing)

Example

curl "https://<host>/vt/url?url=example.com" -H "x-apikey: YOUR_VIRUSTOTAL_KEY"

Response `200`

{
  "success": true,
  "input": "https://example.com",
  "analysis": {
    "provider": "virustotal",
    "url": "https://example.com",
    "status": "safe",
    "reason": "No engines flagged",
    "detection_stats": {
      "malicious": 0, "suspicious": 0, "harmless": 70,
      "undetected": 10, "timeout": 0, "total_engines": 80
    },
    "reputation": 100,
    "last_modification_date": 1735689600,
    "engines": [
      { "engine": "Fortinet", "category": "harmless", "result": "clean", "method": "blacklist" }
    ]
  },
  "meta": { "name": "Malware Scanner API", "version": "v0.0.2", "docs": "https://..." }
}

Special states

`status`	Meaning
`pending`	URL was not in VirusTotal's DB — it was auto-submitted for analysis. Re-check later.
`unknown`	(n/a for URLs)
`error`	Key invalid/quota exceeded/network failure. `reason` explains why.

Errors

Status	Condition
`401`	Missing `x-apikey` header
`400`	Missing or invalid `url`
`200` + `analysis.status = error`	Provider-level failure (invalid key, quota, timeout)

Notes

Results are cached for 90 days. Use /scan for a composite verdict instead.

Source contract imported from malware scanner/app.py. Handler: vt_url_endpoint. Reference: docs/endpoints/vt-url.md.

PARAMETERS

Name	In	Type	Required	Description
`url`	body	string	Yes	URL to analyze with VirusTotal.
`x-apikey`	header	string	Yes	VirusTotal API key required for this endpoint (BYOK).
`x-virustotal-apikey`	header	string	No	Accepted alias for the VirusTotal API key.

SAMPLE RESPONSE

{
  "meta": {
    "docs": "https://...",
    "name": "Malware Scanner API",
    "version": "v0.0.2"
  },
  "input": "https://example.com",
  "success": true,
  "analysis": {
    "url": "https://example.com",
    "reason": "No engines flagged",
    "status": "safe",
    "engines": [
      {
        "engine": "Fortinet",
        "method": "blacklist",
        "result": "clean",
        "category": "harmless"
      }
    ],
    "provider": "virustotal",
    "reputation": 100,
    "detection_stats": {
      "timeout": 0,
      "harmless": 70,
      "malicious": 0,
      "suspicious": 0,
      "undetected": 10,
      "total_engines": 80
    },
    "last_modification_date": 1735689600
  }
}

QUICK CURL

curl -X POST https://api.dakidarts.com/malware-url-scanner/vt/url -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'x-apikey: YOUR_X_APIKEY' -H 'x-virustotal-apikey: YOUR_X_VIRUSTOTAL_APIKEY' -H 'Content-Type: application/json' -d '{"url": "example"}'

GET /vt/hash Vt Hash Endpoint SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Looks up an MD5, SHA-1, or SHA-256 file hash in VirusTotal.

Snapshot from docs/endpoints/vt-hash.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

`/vt/hash` — VirusTotal file-hash analysis

Added in v0.0.2. BYOK required.

Methods

GET / POST

Required header

Header	Description
`x-apikey`	Your VirusTotal API key

Parameters

Param	Type	Required	Description
`hash`	string	yes	MD5 (32 hex), SHA-1 (40 hex), or SHA-256 (64 hex)

Example

curl "https://<host>/vt/hash?hash=44d88612fea8a8f36de82e1278abb02f" \
     -H "x-apikey: YOUR_VIRUSTOTAL_KEY"

Response `200`

{
  "success": true,
  "input": "44d88612fea8a8f36de82e1278abb02f",
  "hash_type": "md5",
  "analysis": {
    "provider": "virustotal",
    "hash": "44d88612fea8a8f36de82e1278abb02f",
    "status": "malicious",
    "reason": "Flagged by 57 engines",
    "detection_stats": {
      "malicious": 57, "suspicious": 0, "harmless": 0,
      "undetected": 13, "timeout": 0, "total_engines": 70
    },
    "sha256": "8d0e...",
    "sha1": "d2d2...",
    "md5": "44d88612fea8a8f36de82e1278abb02f",
    "file_size_bytes": 214,
    "file_type": "exe",
    "magic": "PE32 executable",
    "known_names": ["evil.exe"],
    "reputation": -800,
    "last_modification_date": 1735689600,
    "engines": [
      { "engine": "McAfee", "category": "malicious", "result": "EICAR", "method": "blacklist" }
    ]
  },
  "meta": { "name": "Malware Scanner API", "version": "v0.0.2", "docs": "https://..." }
}

Special states

`status`	Meaning
`unknown`	Hash not in the VirusTotal database
`error`	Key invalid/quota exceeded/network failure

Errors

Status	Condition
`401`	Missing `x-apikey` header
`400`	Missing `hash`, or hash is not valid MD5/SHA-1/SHA-256 hex

Notes

VirusTotal hashes are case-insensitive; input is normalized to lowercase.
Results are cached for 90 days.

Source contract imported from malware scanner/app.py. Handler: vt_hash_endpoint. Reference: docs/endpoints/vt-hash.md.

PARAMETERS

Name	In	Type	Required	Description
`hash`	query	string	Yes	MD5, SHA-1, or SHA-256 file hash to analyze.
`x-apikey`	header	string	Yes	VirusTotal API key required for this endpoint (BYOK).
`x-virustotal-apikey`	header	string	No	Accepted alias for the VirusTotal API key.

QUICK CURL

curl -X GET https://api.dakidarts.com/malware-url-scanner/vt/hash -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'x-apikey: YOUR_X_APIKEY' -H 'x-virustotal-apikey: YOUR_X_VIRUSTOTAL_APIKEY'

POST /vt/hash Vt Hash Endpoint SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Looks up an MD5, SHA-1, or SHA-256 file hash in VirusTotal.

Snapshot from docs/endpoints/vt-hash.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

`/vt/hash` — VirusTotal file-hash analysis

Added in v0.0.2. BYOK required.

Methods

GET / POST

Required header

Header	Description
`x-apikey`	Your VirusTotal API key

Parameters

Param	Type	Required	Description
`hash`	string	yes	MD5 (32 hex), SHA-1 (40 hex), or SHA-256 (64 hex)

Example

curl "https://<host>/vt/hash?hash=44d88612fea8a8f36de82e1278abb02f" \
     -H "x-apikey: YOUR_VIRUSTOTAL_KEY"

Response `200`

{
  "success": true,
  "input": "44d88612fea8a8f36de82e1278abb02f",
  "hash_type": "md5",
  "analysis": {
    "provider": "virustotal",
    "hash": "44d88612fea8a8f36de82e1278abb02f",
    "status": "malicious",
    "reason": "Flagged by 57 engines",
    "detection_stats": {
      "malicious": 57, "suspicious": 0, "harmless": 0,
      "undetected": 13, "timeout": 0, "total_engines": 70
    },
    "sha256": "8d0e...",
    "sha1": "d2d2...",
    "md5": "44d88612fea8a8f36de82e1278abb02f",
    "file_size_bytes": 214,
    "file_type": "exe",
    "magic": "PE32 executable",
    "known_names": ["evil.exe"],
    "reputation": -800,
    "last_modification_date": 1735689600,
    "engines": [
      { "engine": "McAfee", "category": "malicious", "result": "EICAR", "method": "blacklist" }
    ]
  },
  "meta": { "name": "Malware Scanner API", "version": "v0.0.2", "docs": "https://..." }
}

Special states

`status`	Meaning
`unknown`	Hash not in the VirusTotal database
`error`	Key invalid/quota exceeded/network failure

Errors

Status	Condition
`401`	Missing `x-apikey` header
`400`	Missing `hash`, or hash is not valid MD5/SHA-1/SHA-256 hex

Notes

VirusTotal hashes are case-insensitive; input is normalized to lowercase.
Results are cached for 90 days.

Source contract imported from malware scanner/app.py. Handler: vt_hash_endpoint. Reference: docs/endpoints/vt-hash.md.

PARAMETERS

Name	In	Type	Required	Description
`hash`	body	string	Yes	MD5, SHA-1, or SHA-256 file hash to analyze.
`x-apikey`	header	string	Yes	VirusTotal API key required for this endpoint (BYOK).
`x-virustotal-apikey`	header	string	No	Accepted alias for the VirusTotal API key.

SAMPLE RESPONSE

{
  "meta": {
    "docs": "https://...",
    "name": "Malware Scanner API",
    "version": "v0.0.2"
  },
  "input": "44d88612fea8a8f36de82e1278abb02f",
  "success": true,
  "analysis": {
    "md5": "44d88612fea8a8f36de82e1278abb02f",
    "hash": "44d88612fea8a8f36de82e1278abb02f",
    "sha1": "d2d2...",
    "magic": "PE32 executable",
    "reason": "Flagged by 57 engines",
    "sha256": "8d0e...",
    "status": "malicious",
    "engines": [
      {
        "engine": "McAfee",
        "method": "blacklist",
        "result": "EICAR",
        "category": "malicious"
      }
    ],
    "provider": "virustotal",
    "file_type": "exe",
    "reputation": -800,
    "known_names": [
      "evil.exe"
    ],
    "detection_stats": {
      "timeout": 0,
      "harmless": 0,
      "malicious": 57,
      "suspicious": 0,
      "undetected": 13,
      "total_engines": 70
    },
    "file_size_bytes": 214,
    "last_modification_date": 1735689600
  },
  "hash_type": "md5"
}

QUICK CURL

curl -X POST https://api.dakidarts.com/malware-url-scanner/vt/hash -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'x-apikey: YOUR_X_APIKEY' -H 'x-virustotal-apikey: YOUR_X_VIRUSTOTAL_APIKEY' -H 'Content-Type: application/json' -d '{"hash": "example"}'

GET /vt/ip Vt Ip Endpoint SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Looks up an IPv4 or IPv6 address in VirusTotal.

Snapshot from docs/endpoints/vt-ip.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

`/vt/ip` — VirusTotal IP reputation

Added in v0.0.2. BYOK required.

Methods

GET / POST

Required header

Header	Description
`x-apikey`	Your VirusTotal API key

Parameters

Param	Type	Required	Description
`ip`	string	yes	IPv4 or IPv6 address

Example

curl "https://<host>/vt/ip?ip=8.8.8.8" -H "x-apikey: YOUR_VIRUSTOTAL_KEY"

Response `200`

{
  "success": true,
  "input": "8.8.8.8",
  "analysis": {
    "provider": "virustotal",
    "ip": "8.8.8.8",
    "status": "safe",
    "reason": "No engines flagged",
    "detection_stats": {
      "malicious": 0, "suspicious": 0, "harmless": 20,
      "undetected": 60, "timeout": 0, "total_engines": 80
    },
    "country": "US",
    "asn": 15169,
    "as_owner": "GOOGLE",
    "network": "8.8.8.0/24",
    "regional_internet_registry": "ARIN",
    "reputation": 300,
    "last_modification_date": 1735689600,
    "engines": []
  },
  "meta": { "name": "Malware Scanner API", "version": "v0.0.2", "docs": "https://..." }
}

Special states

`status`	Meaning
`unknown`	IP not in the VirusTotal database
`error`	Key invalid/quota exceeded/network failure

Errors

Status	Condition
`401`	Missing `x-apikey` header
`400`	Missing `ip`, or IP address is malformed

Notes

Results are cached for 90 days.

Source contract imported from malware scanner/app.py. Handler: vt_ip_endpoint. Reference: docs/endpoints/vt-ip.md.

PARAMETERS

Name	In	Type	Required	Description
`ip`	query	string	Yes	IPv4 or IPv6 address to analyze.
`x-apikey`	header	string	Yes	VirusTotal API key required for this endpoint (BYOK).
`x-virustotal-apikey`	header	string	No	Accepted alias for the VirusTotal API key.

QUICK CURL

curl -X GET https://api.dakidarts.com/malware-url-scanner/vt/ip -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'x-apikey: YOUR_X_APIKEY' -H 'x-virustotal-apikey: YOUR_X_VIRUSTOTAL_APIKEY'

POST /vt/ip Vt Ip Endpoint SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Looks up an IPv4 or IPv6 address in VirusTotal.

Snapshot from docs/endpoints/vt-ip.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

`/vt/ip` — VirusTotal IP reputation

Added in v0.0.2. BYOK required.

Methods

GET / POST

Required header

Header	Description
`x-apikey`	Your VirusTotal API key

Parameters

Param	Type	Required	Description
`ip`	string	yes	IPv4 or IPv6 address

Example

curl "https://<host>/vt/ip?ip=8.8.8.8" -H "x-apikey: YOUR_VIRUSTOTAL_KEY"

Response `200`

{
  "success": true,
  "input": "8.8.8.8",
  "analysis": {
    "provider": "virustotal",
    "ip": "8.8.8.8",
    "status": "safe",
    "reason": "No engines flagged",
    "detection_stats": {
      "malicious": 0, "suspicious": 0, "harmless": 20,
      "undetected": 60, "timeout": 0, "total_engines": 80
    },
    "country": "US",
    "asn": 15169,
    "as_owner": "GOOGLE",
    "network": "8.8.8.0/24",
    "regional_internet_registry": "ARIN",
    "reputation": 300,
    "last_modification_date": 1735689600,
    "engines": []
  },
  "meta": { "name": "Malware Scanner API", "version": "v0.0.2", "docs": "https://..." }
}

Special states

`status`	Meaning
`unknown`	IP not in the VirusTotal database
`error`	Key invalid/quota exceeded/network failure

Errors

Status	Condition
`401`	Missing `x-apikey` header
`400`	Missing `ip`, or IP address is malformed

Notes

Results are cached for 90 days.

Source contract imported from malware scanner/app.py. Handler: vt_ip_endpoint. Reference: docs/endpoints/vt-ip.md.

PARAMETERS

Name	In	Type	Required	Description
`ip`	body	string	Yes	IPv4 or IPv6 address to analyze.
`x-apikey`	header	string	Yes	VirusTotal API key required for this endpoint (BYOK).
`x-virustotal-apikey`	header	string	No	Accepted alias for the VirusTotal API key.

SAMPLE RESPONSE

{
  "meta": {
    "docs": "https://...",
    "name": "Malware Scanner API",
    "version": "v0.0.2"
  },
  "input": "8.8.8.8",
  "success": true,
  "analysis": {
    "ip": "8.8.8.8",
    "asn": 15169,
    "reason": "No engines flagged",
    "status": "safe",
    "country": "US",
    "engines": [],
    "network": "8.8.8.0/24",
    "as_owner": "GOOGLE",
    "provider": "virustotal",
    "reputation": 300,
    "detection_stats": {
      "timeout": 0,
      "harmless": 20,
      "malicious": 0,
      "suspicious": 0,
      "undetected": 60,
      "total_engines": 80
    },
    "last_modification_date": 1735689600,
    "regional_internet_registry": "ARIN"
  }
}

QUICK CURL

curl -X POST https://api.dakidarts.com/malware-url-scanner/vt/ip -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'x-apikey: YOUR_X_APIKEY' -H 'x-virustotal-apikey: YOUR_X_VIRUSTOTAL_APIKEY' -H 'Content-Type: application/json' -d '{"ip": "example"}'

GET /vt/domain Vt Domain Endpoint SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Looks up a domain in VirusTotal.

Snapshot from docs/endpoints/vt-domain.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

`/vt/domain` — VirusTotal domain reputation

Added in v0.0.2. BYOK required.

Methods

GET / POST

Required header

Header	Description
`x-apikey`	Your VirusTotal API key

Parameters

Param	Type	Required	Description
`domain`	string	yes	Registered domain (e.g. `example.com`)

Example

curl "https://<host>/vt/domain?domain=example.com" -H "x-apikey: YOUR_VIRUSTOTAL_KEY"

Response `200`

{
  "success": true,
  "input": "example.com",
  "analysis": {
    "provider": "virustotal",
    "domain": "example.com",
    "status": "safe",
    "reason": "No engines flagged",
    "detection_stats": {
      "malicious": 0, "suspicious": 0, "harmless": 10,
      "undetected": 70, "timeout": 0, "total_engines": 80
    },
    "registrar": "IANA",
    "creation_date": 808963200,
    "reputation": 100,
    "popularity": { "source": "alexa", "rank": 1 },
    "last_dns_records": [],
    "engines": []
  },
  "meta": { "name": "Malware Scanner API", "version": "v0.0.2", "docs": "https://..." }
}

Special states

`status`	Meaning
`unknown`	Domain not in the VirusTotal database
`error`	Key invalid/quota exceeded/network failure

Errors

Status	Condition
`401`	Missing `x-apikey` header
`400`	Missing `domain`, or domain format is invalid

Notes

Results are cached for 90 days.
popularity returns the best-known rank source available (alexa/majestic/statvoo/crowdsourced).

Source contract imported from malware scanner/app.py. Handler: vt_domain_endpoint. Reference: docs/endpoints/vt-domain.md.

PARAMETERS

Name	In	Type	Required	Description
`domain`	query	string	Yes	Domain name to analyze.
`x-apikey`	header	string	Yes	VirusTotal API key required for this endpoint (BYOK).
`x-virustotal-apikey`	header	string	No	Accepted alias for the VirusTotal API key.

QUICK CURL

curl -X GET https://api.dakidarts.com/malware-url-scanner/vt/domain -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'x-apikey: YOUR_X_APIKEY' -H 'x-virustotal-apikey: YOUR_X_VIRUSTOTAL_APIKEY'

POST /vt/domain Vt Domain Endpoint SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Looks up a domain in VirusTotal.

Snapshot from docs/endpoints/vt-domain.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

`/vt/domain` — VirusTotal domain reputation

Added in v0.0.2. BYOK required.

Methods

GET / POST

Required header

Header	Description
`x-apikey`	Your VirusTotal API key

Parameters

Param	Type	Required	Description
`domain`	string	yes	Registered domain (e.g. `example.com`)

Example

curl "https://<host>/vt/domain?domain=example.com" -H "x-apikey: YOUR_VIRUSTOTAL_KEY"

Response `200`

{
  "success": true,
  "input": "example.com",
  "analysis": {
    "provider": "virustotal",
    "domain": "example.com",
    "status": "safe",
    "reason": "No engines flagged",
    "detection_stats": {
      "malicious": 0, "suspicious": 0, "harmless": 10,
      "undetected": 70, "timeout": 0, "total_engines": 80
    },
    "registrar": "IANA",
    "creation_date": 808963200,
    "reputation": 100,
    "popularity": { "source": "alexa", "rank": 1 },
    "last_dns_records": [],
    "engines": []
  },
  "meta": { "name": "Malware Scanner API", "version": "v0.0.2", "docs": "https://..." }
}

Special states

`status`	Meaning
`unknown`	Domain not in the VirusTotal database
`error`	Key invalid/quota exceeded/network failure

Errors

Status	Condition
`401`	Missing `x-apikey` header
`400`	Missing `domain`, or domain format is invalid

Notes

Results are cached for 90 days.
popularity returns the best-known rank source available (alexa/majestic/statvoo/crowdsourced).

Source contract imported from malware scanner/app.py. Handler: vt_domain_endpoint. Reference: docs/endpoints/vt-domain.md.

PARAMETERS

Name	In	Type	Required	Description
`domain`	body	string	Yes	Domain name to analyze.
`x-apikey`	header	string	Yes	VirusTotal API key required for this endpoint (BYOK).
`x-virustotal-apikey`	header	string	No	Accepted alias for the VirusTotal API key.

SAMPLE RESPONSE

{
  "meta": {
    "docs": "https://...",
    "name": "Malware Scanner API",
    "version": "v0.0.2"
  },
  "input": "example.com",
  "success": true,
  "analysis": {
    "domain": "example.com",
    "reason": "No engines flagged",
    "status": "safe",
    "engines": [],
    "provider": "virustotal",
    "registrar": "IANA",
    "popularity": {
      "rank": 1,
      "source": "alexa"
    },
    "reputation": 100,
    "creation_date": 808963200,
    "detection_stats": {
      "timeout": 0,
      "harmless": 10,
      "malicious": 0,
      "suspicious": 0,
      "undetected": 70,
      "total_engines": 80
    },
    "last_dns_records": []
  }
}

QUICK CURL

curl -X POST https://api.dakidarts.com/malware-url-scanner/vt/domain -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'x-apikey: YOUR_X_APIKEY' -H 'x-virustotal-apikey: YOUR_X_VIRUSTOTAL_APIKEY' -H 'Content-Type: application/json' -d '{"domain": "example"}'

GROUP / 05

Whois

Whois endpoints sourced from the Malware & Phishing URL Scanner API implementation.

2 endpoints

GET /whois Whois Endpoint SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Returns WHOIS registration information for a domain.

Snapshot from docs/endpoints/whois.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

`/whois` — WHOIS registration intelligence

Added in v0.0.2. No key required.

Methods

GET / POST

Parameters

Param	Type	Required	Description
`domain`	string	yes	Domain to look up

Example

curl "https://<host>/whois?domain=example.com"

Response `200`

{
  "success": true,
  "input": "example.com",
  "whois": {
    "domain": "example.com",
    "registrar": "IANA",
    "creation_date": "1995-08-14T00:00:00",
    "expiration_date": "2026-08-14T00:00:00",
    "updated_date": "2024-08-14T00:00:00",
    "status": ["clientDeleteProhibited"],
    "name_servers": ["a.iana-servers.net"],
    "emails": [],
    "org": "Internet Assigned Numbers Authority",
    "age_days": 11340,
    "is_new_domain": false
  },
  "meta": { "name": "Malware Scanner API", "version": "v0.0.2", "docs": "https://..." }
}

Key fields

Field	Description
`age_days`	Domain age in days
`is_new_domain`	`true` when age < 30 days (common phishing signal)
`registrar`, `creation_date`, `expiration_date`	Registration metadata
`name_servers`, `emails`, `status`	WHOIS records (may be empty)

Errors

Status	Condition
`400`	Missing or invalid `domain`

Notes

If the WHOIS server is unreachable or the domain has no record, the response includes an

"error" field instead of crashing — the endpoint still returns 200.

WHOIS results are not cached (they change infrequently but lookups are live).
Domains only, not bare IPs.

Source contract imported from malware scanner/app.py. Handler: whois_endpoint. Reference: docs/endpoints/whois.md.

PARAMETERS

Name	In	Type	Required	Description
`domain`	query	string	Yes	Domain to look up

QUICK CURL

curl -X GET https://api.dakidarts.com/malware-url-scanner/whois -H 'X-API-Key: dk_live_...' -H 'Accept: application/json'

POST /whois Whois Endpoint SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Returns WHOIS registration information for a domain.

Snapshot from docs/endpoints/whois.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

`/whois` — WHOIS registration intelligence

Added in v0.0.2. No key required.

Methods

GET / POST

Parameters

Param	Type	Required	Description
`domain`	string	yes	Domain to look up

Example

curl "https://<host>/whois?domain=example.com"

Response `200`

{
  "success": true,
  "input": "example.com",
  "whois": {
    "domain": "example.com",
    "registrar": "IANA",
    "creation_date": "1995-08-14T00:00:00",
    "expiration_date": "2026-08-14T00:00:00",
    "updated_date": "2024-08-14T00:00:00",
    "status": ["clientDeleteProhibited"],
    "name_servers": ["a.iana-servers.net"],
    "emails": [],
    "org": "Internet Assigned Numbers Authority",
    "age_days": 11340,
    "is_new_domain": false
  },
  "meta": { "name": "Malware Scanner API", "version": "v0.0.2", "docs": "https://..." }
}

Key fields

Field	Description
`age_days`	Domain age in days
`is_new_domain`	`true` when age < 30 days (common phishing signal)
`registrar`, `creation_date`, `expiration_date`	Registration metadata
`name_servers`, `emails`, `status`	WHOIS records (may be empty)

Errors

Status	Condition
`400`	Missing or invalid `domain`

Notes

If the WHOIS server is unreachable or the domain has no record, the response includes an

"error" field instead of crashing — the endpoint still returns 200.

WHOIS results are not cached (they change infrequently but lookups are live).
Domains only, not bare IPs.

Source contract imported from malware scanner/app.py. Handler: whois_endpoint. Reference: docs/endpoints/whois.md.

PARAMETERS

Name	In	Type	Required	Description
`domain`	body	string	Yes	Domain to look up

SAMPLE RESPONSE

{
  "meta": {
    "docs": "https://...",
    "name": "Malware Scanner API",
    "version": "v0.0.2"
  },
  "input": "example.com",
  "whois": {
    "org": "Internet Assigned Numbers Authority",
    "domain": "example.com",
    "emails": [],
    "status": [
      "clientDeleteProhibited"
    ],
    "age_days": 11340,
    "registrar": "IANA",
    "name_servers": [
      "a.iana-servers.net"
    ],
    "updated_date": "2024-08-14T00:00:00",
    "creation_date": "1995-08-14T00:00:00",
    "is_new_domain": false,
    "expiration_date": "2026-08-14T00:00:00"
  },
  "success": true
}

QUICK CURL

curl -X POST https://api.dakidarts.com/malware-url-scanner/whois -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'Content-Type: application/json' -d '{"domain": "example"}'

GROUP / 06

Ssl

Ssl endpoints sourced from the Malware & Phishing URL Scanner API implementation.

2 endpoints

GET /ssl Ssl Endpoint SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Inspects the live TLS certificate for a domain.

Snapshot from docs/endpoints/ssl.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

`/ssl` — SSL certificate inspection

Added in v0.0.2. No key required.

Methods

GET / POST

Parameters

Param	Type	Required	Description
`domain`	string	yes	Domain whose live TLS certificate to inspect

Example

curl "https://<host>/ssl?domain=google.com"

Response `200`

{
  "success": true,
  "input": "google.com",
  "ssl": {
    "valid": true,
    "details": {
      "subject": "www.google.com",
      "issuer": "GTS CA 1C3",
      "valid_from": "May 27 00:00:00 2026 GMT",
      "valid_until": "Aug 25 23:59:59 2026 GMT",
      "expires_in_days": 66,
      "expired": false,
      "expiring_soon": false,
      "serial_number": "6A:8B:..."
    }
  },
  "meta": { "name": "Malware Scanner API", "version": "v0.0.2", "docs": "https://..." }
}

Key fields

Field	Description
`valid`	Whether a valid TLS certificate was presented
`expires_in_days`	Days until expiry (`null` if unknown)
`expired`	`true` when already past the expiry date
`expiring_soon`	`true` when expiring within 30 days
`issuer` / `subject`	Certificate authority / certificate owner

Errors

Status	Condition
`400`	Missing or invalid `domain`

Notes

On connection failure valid is false and details.error explains why.
Uses the system CA bundle via Python's ssl module.

Source contract imported from malware scanner/app.py. Handler: ssl_endpoint. Reference: docs/endpoints/ssl.md.

PARAMETERS

Name	In	Type	Required	Description
`domain`	query	string	Yes	Domain whose live TLS certificate to inspect

QUICK CURL

curl -X GET https://api.dakidarts.com/malware-url-scanner/ssl -H 'X-API-Key: dk_live_...' -H 'Accept: application/json'

POST /ssl Ssl Endpoint SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Inspects the live TLS certificate for a domain.

Snapshot from docs/endpoints/ssl.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

`/ssl` — SSL certificate inspection

Added in v0.0.2. No key required.

Methods

GET / POST

Parameters

Param	Type	Required	Description
`domain`	string	yes	Domain whose live TLS certificate to inspect

Example

curl "https://<host>/ssl?domain=google.com"

Response `200`

{
  "success": true,
  "input": "google.com",
  "ssl": {
    "valid": true,
    "details": {
      "subject": "www.google.com",
      "issuer": "GTS CA 1C3",
      "valid_from": "May 27 00:00:00 2026 GMT",
      "valid_until": "Aug 25 23:59:59 2026 GMT",
      "expires_in_days": 66,
      "expired": false,
      "expiring_soon": false,
      "serial_number": "6A:8B:..."
    }
  },
  "meta": { "name": "Malware Scanner API", "version": "v0.0.2", "docs": "https://..." }
}

Key fields

Field	Description
`valid`	Whether a valid TLS certificate was presented
`expires_in_days`	Days until expiry (`null` if unknown)
`expired`	`true` when already past the expiry date
`expiring_soon`	`true` when expiring within 30 days
`issuer` / `subject`	Certificate authority / certificate owner

Errors

Status	Condition
`400`	Missing or invalid `domain`

Notes

On connection failure valid is false and details.error explains why.
Uses the system CA bundle via Python's ssl module.

Source contract imported from malware scanner/app.py. Handler: ssl_endpoint. Reference: docs/endpoints/ssl.md.

PARAMETERS

Name	In	Type	Required	Description
`domain`	body	string	Yes	Domain whose live TLS certificate to inspect

SAMPLE RESPONSE

{
  "ssl": {
    "valid": true,
    "details": {
      "issuer": "GTS CA 1C3",
      "expired": false,
      "subject": "www.google.com",
      "valid_from": "May 27 00:00:00 2026 GMT",
      "valid_until": "Aug 25 23:59:59 2026 GMT",
      "expiring_soon": false,
      "serial_number": "6A:8B:...",
      "expires_in_days": 66
    }
  },
  "meta": {
    "docs": "https://...",
    "name": "Malware Scanner API",
    "version": "v0.0.2"
  },
  "input": "google.com",
  "success": true
}

QUICK CURL

curl -X POST https://api.dakidarts.com/malware-url-scanner/ssl -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'Content-Type: application/json' -d '{"domain": "example"}'

GROUP / 07

Patterns

Patterns endpoints sourced from the Malware & Phishing URL Scanner API implementation.

2 endpoints

GET /patterns Patterns Endpoint SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Returns domain-pattern and URL indicators used by the scanner.

Snapshot from docs/endpoints/patterns.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

`/patterns` — Suspicious domain pattern heuristics

Added in v0.0.2. No key required.

Methods

GET / POST

Parameters

Param	Type	Required	Description
`domain`	string	yes	Domain to inspect

Example

curl "https://<host>/patterns?domain=secure-login-bank.example"

Response `200`

{
  "success": true,
  "input": "secure-login-bank.example",
  "suspicious": true,
  "findings": [
    "Contains suspicious keyword(s): secure, login, bank"
  ],
  "details": {
    "domain": "secure-login-bank.example",
    "tld": "example",
    "keyword_matches": ["secure", "login", "bank"],
    "long_domain": false,
    "excessive_subdomains": false,
    "punycode": false,
    "hyphen_cluster": false,
    "suspicious_tld": false,
    "all_numeric": false
  },
  "meta": { "name": "Malware Scanner API", "version": "v0.0.2", "docs": "https://..." }
}

Detection signals

Signal	Description
`keyword_matches`	Phishing keywords: login, secure, verify, update, account, bank, confirm, signin, auth, billing, wallet, payment, password
`long_domain`	Domain longer than 40 characters
`excessive_subdomains`	More than 3 labels
`punycode`	Starts with `xn--` (internationalized)
`hyphen_cluster`	Contains `--`
`suspicious_tld`	TLD on the abuse list (tk, ml, ga, cf, gq, xyz, top, win, bid, loan, click, review, site, link, work, stream, download)
`all_numeric`	Domain made entirely of digits

Errors

Status	Condition
`400`	Missing or invalid `domain`

Notes

findings is empty (and suspicious is false) when nothing matched.

Source contract imported from malware scanner/app.py. Handler: patterns_endpoint. Reference: docs/endpoints/patterns.md.

PARAMETERS

Name	In	Type	Required	Description
`domain`	query	string	Yes	Domain to inspect

QUICK CURL

curl -X GET https://api.dakidarts.com/malware-url-scanner/patterns -H 'X-API-Key: dk_live_...' -H 'Accept: application/json'

POST /patterns Patterns Endpoint SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Returns domain-pattern and URL indicators used by the scanner.

Snapshot from docs/endpoints/patterns.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

`/patterns` — Suspicious domain pattern heuristics

Added in v0.0.2. No key required.

Methods

GET / POST

Parameters

Param	Type	Required	Description
`domain`	string	yes	Domain to inspect

Example

curl "https://<host>/patterns?domain=secure-login-bank.example"

Response `200`

{
  "success": true,
  "input": "secure-login-bank.example",
  "suspicious": true,
  "findings": [
    "Contains suspicious keyword(s): secure, login, bank"
  ],
  "details": {
    "domain": "secure-login-bank.example",
    "tld": "example",
    "keyword_matches": ["secure", "login", "bank"],
    "long_domain": false,
    "excessive_subdomains": false,
    "punycode": false,
    "hyphen_cluster": false,
    "suspicious_tld": false,
    "all_numeric": false
  },
  "meta": { "name": "Malware Scanner API", "version": "v0.0.2", "docs": "https://..." }
}

Detection signals

Signal	Description
`keyword_matches`	Phishing keywords: login, secure, verify, update, account, bank, confirm, signin, auth, billing, wallet, payment, password
`long_domain`	Domain longer than 40 characters
`excessive_subdomains`	More than 3 labels
`punycode`	Starts with `xn--` (internationalized)
`hyphen_cluster`	Contains `--`
`suspicious_tld`	TLD on the abuse list (tk, ml, ga, cf, gq, xyz, top, win, bid, loan, click, review, site, link, work, stream, download)
`all_numeric`	Domain made entirely of digits

Errors

Status	Condition
`400`	Missing or invalid `domain`

Notes

findings is empty (and suspicious is false) when nothing matched.

Source contract imported from malware scanner/app.py. Handler: patterns_endpoint. Reference: docs/endpoints/patterns.md.

PARAMETERS

Name	In	Type	Required	Description
`domain`	body	string	Yes	Domain to inspect

SAMPLE RESPONSE

{
  "meta": {
    "docs": "https://...",
    "name": "Malware Scanner API",
    "version": "v0.0.2"
  },
  "input": "secure-login-bank.example",
  "details": {
    "tld": "example",
    "domain": "secure-login-bank.example",
    "punycode": false,
    "all_numeric": false,
    "long_domain": false,
    "hyphen_cluster": false,
    "suspicious_tld": false,
    "keyword_matches": [
      "secure",
      "login",
      "bank"
    ],
    "excessive_subdomains": false
  },
  "success": true,
  "findings": [
    "Contains suspicious keyword(s): secure, login, bank"
  ],
  "suspicious": true
}

QUICK CURL

curl -X POST https://api.dakidarts.com/malware-url-scanner/patterns -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'Content-Type: application/json' -d '{"domain": "example"}'

GROUP / 08

Validate

Validate endpoints sourced from the Malware & Phishing URL Scanner API implementation.

2 endpoints

GET /validate Validate Endpoint SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Validates and normalizes a URL before scanning.

Snapshot from docs/endpoints/validate.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

`/validate` — URL validation & normalization

Added in v0.0.2. No key required.

Methods

GET / POST

Parameters

Param	Type	Required	Description
`url`	string	yes	URL to validate/normalize

Example

curl "https://<host>/validate?url=example.com"

Response `200`

{
  "success": true,
  "input": "example.com",
  "normalized": "https://example.com",
  "valid": true,
  "parts": {
    "scheme": "https",
    "netloc": "example.com",
    "hostname": "example.com",
    "port": null,
    "path": "",
    "query": "",
    "fragment": "",
    "has_credentials": false
  },
  "meta": { "name": "Malware Scanner API", "version": "v0.0.2", "docs": "https://..." }
}

Key fields

Field	Description
`normalized`	URL with a scheme prepended when missing (`https://` default)
`parts`	Parsed URL components
`has_credentials`	`true` if the URL embeds `user:pass@` (common in phishing links)

Errors

Status	Condition
`400`	Missing `url` or the URL is not valid

Notes

Useful as a pre-flight step before calling /scan.

Source contract imported from malware scanner/app.py. Handler: validate_endpoint. Reference: docs/endpoints/validate.md.

PARAMETERS

Name	In	Type	Required	Description
`url`	query	string	Yes	URL to validate/normalize

QUICK CURL

curl -X GET https://api.dakidarts.com/malware-url-scanner/validate -H 'X-API-Key: dk_live_...' -H 'Accept: application/json'

POST /validate Validate Endpoint SOURCE CONTRACT — UPSTREAM NEEDED $0.0050 / call / 120 rpm Upstream needed

Validates and normalizes a URL before scanning.

Snapshot from docs/endpoints/validate.md for source API version v0.0.2. This is source documentation, not evidence that an upstream is deployed.

`/validate` — URL validation & normalization

Added in v0.0.2. No key required.

Methods

GET / POST

Parameters

Param	Type	Required	Description
`url`	string	yes	URL to validate/normalize

Example

curl "https://<host>/validate?url=example.com"

Response `200`

{
  "success": true,
  "input": "example.com",
  "normalized": "https://example.com",
  "valid": true,
  "parts": {
    "scheme": "https",
    "netloc": "example.com",
    "hostname": "example.com",
    "port": null,
    "path": "",
    "query": "",
    "fragment": "",
    "has_credentials": false
  },
  "meta": { "name": "Malware Scanner API", "version": "v0.0.2", "docs": "https://..." }
}

Key fields

Field	Description
`normalized`	URL with a scheme prepended when missing (`https://` default)
`parts`	Parsed URL components
`has_credentials`	`true` if the URL embeds `user:pass@` (common in phishing links)

Errors

Status	Condition
`400`	Missing `url` or the URL is not valid

Notes

Useful as a pre-flight step before calling /scan.

Source contract imported from malware scanner/app.py. Handler: validate_endpoint. Reference: docs/endpoints/validate.md.

PARAMETERS

Name	In	Type	Required	Description
`url`	body	string	Yes	URL to validate/normalize

SAMPLE RESPONSE

{
  "meta": {
    "docs": "https://...",
    "name": "Malware Scanner API",
    "version": "v0.0.2"
  },
  "input": "example.com",
  "parts": {
    "path": "",
    "port": null,
    "query": "",
    "netloc": "example.com",
    "scheme": "https",
    "fragment": "",
    "hostname": "example.com",
    "has_credentials": false
  },
  "valid": true,
  "success": true,
  "normalized": "https://example.com"
}

QUICK CURL

curl -X POST https://api.dakidarts.com/malware-url-scanner/validate -H 'X-API-Key: dk_live_...' -H 'Accept: application/json' -H 'Content-Type: application/json' -d '{"url": "example"}'

INTERACTIVE SANDBOX

Explore a response before you integrate.

Edit a JSON request to validate its syntax and preview the published sample response. This stays in your browser; it never calls the live API or uses credits.

The preview checks JSON syntax and shows the saved example response; it does not execute request values.

MOCK RESPONSE

TYPESCRIPT CONTRACT

INTEGRATION SDK

Use the product where it lives.

These are integration templates, not runnable sample calls. Configure an endpoint upstream in API Studio, then replace the placeholder path. Saved samples stay preview-only.

REST/JSON

# Replace with a connected GET route and include any required parameters.
curl -X GET "https://api.dakidarts.com/malware-url-scanner/v1/your-connected-endpoint" \
  -H "X-API-Key: dk_live_..." \
  -H "Accept: application/json"

# Replace with a connected GET route and include any required parameters.
import requests

headers = {"X-API-Key": "dk_live_..."}
response = requests.get("https://api.dakidarts.com/malware-url-scanner/v1/your-connected-endpoint", headers=headers)
print(response.json())

// Replace with a connected GET route and include any required parameters.
const res = await fetch("https://api.dakidarts.com/malware-url-scanner/v1/your-connected-endpoint", {
  headers: { "X-API-Key": "dk_live_..." }
});
const data = await res.json();
console.log(data);

<?php
// Replace with a connected GET route and include any required parameters.
$ch = curl_init("https://api.dakidarts.com/malware-url-scanner/v1/your-connected-endpoint");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["X-API-Key: dk_live_..."]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);
$data = json_decode($response, true);

Explore more Security and adjacent APIs.

Full catalog

Malware & Phishing URL Scanner API

Call Malware & Phishing URL Scanner API through the Dakidarts gateway.

One key, one gateway

Metered by the call

Observable by default

Also available through RapidAPI.

Built to disappear into the product.

Normalize and validate URLs before scanning

Inspect cached scan reports and bulk results

Treat provider failures and unknown verdicts separately from safe results

The shape of the surface.

Answers before you integrate.

Choose a quota that matches the workload.

Pay-as-you-go access

From first request to production.

Create a Dakidarts key

Call the gateway

Watch usage

Endpoint reference & metered costs.

Operations

/status — Health check & API meta

Methods

Parameters

Example

Response 200

Notes

/status — Health check & API meta

Methods

Parameters

Example

Response 200

Notes

Analysis

/scan — Composite URL scan

Methods

Parameters

Optional header

Example

/scan — Composite URL scan

Methods

Parameters

Optional header

Example

/scan/report — Retrieve a cached scan

Methods

Parameters

Example

Response 200

Errors

Notes

/scan/report — Retrieve a cached scan

Methods

Parameters

Example

Response 200

Errors

Notes

Batch operations

/scan/bulk — Batch scan URLs

Methods

Parameters

Optional header

Example

Response 200

Behavior

Errors

Notes

Vt

/vt/url — VirusTotal URL analysis

Methods

Required header

Parameters

Example

Response 200

Special states

Errors

Notes

/vt/url — VirusTotal URL analysis

Methods

Required header

`/status` — Health check & API meta

Response `200`

`/status` — Health check & API meta

Response `200`

`/scan` — Composite URL scan

`/scan` — Composite URL scan

`/scan/report` — Retrieve a cached scan

Response `200`

`/scan/report` — Retrieve a cached scan

Response `200`

`/scan/bulk` — Batch scan URLs

Response `200`

`/vt/url` — VirusTotal URL analysis

Response `200`

`/vt/url` — VirusTotal URL analysis

Response `200`

`/vt/hash` — VirusTotal file-hash analysis

Response `200`

`/vt/hash` — VirusTotal file-hash analysis

Response `200`

`/vt/ip` — VirusTotal IP reputation

Response `200`

`/vt/ip` — VirusTotal IP reputation

Response `200`

`/vt/domain` — VirusTotal domain reputation

Response `200`

`/vt/domain` — VirusTotal domain reputation

Response `200`

`/whois` — WHOIS registration intelligence

Response `200`

`/whois` — WHOIS registration intelligence