FishFish API
Free FishFish API with no key: a community-curated list of phishing and scam domains targeting gaming and chat platforms, updated continuously. Plain JSON array of domains.
Endpoint tested and returned HTTP 200 on 2026-08-21
What is the FishFish API?
The FishFish API is a free, key-free service publishing a community-curated blocklist of phishing and scam domains. The public read endpoint returns a plain JSON array of domain names, focused on scams impersonating gaming and chat platforms such as Discord, Steam and Roblox.
FishFish grew out of the Discord anti-scam community, where the same handful of attack patterns repeat endlessly: typosquatted brand names, fake Nitro giveaways, counterfeit Steam trade sites. Its list reflects that specialisation and the sample bears it out — `steamcrommunity.com`, `dlscord-to.xyz`, `robloox.cfd` and hundreds more homoglyph and typo variants. For anyone moderating a community platform this is far more targeted than a general phishing feed.
The read endpoint is deliberately trivial: no key, no pagination, just an array of strings you can load into a set. Write access — submitting or reviewing domains — requires a token and a trusted role, which is what keeps the list curated rather than crowdsourced chaos. As with any blocklist, expect the coverage to be narrow by design and the entries to churn as scam domains are registered and burned within days. Refresh regularly, match on the registrable domain rather than the full hostname, and treat it as one layer rather than a complete defence.
Quick facts
- Base URL
https://api.fishfish.gg/v1- Authentication
- No API key or account for read endpoints. Submitting domains requires a token and a trusted role. The list is a community project offered for anti-abuse use.
- Rate limit
- No published limit on the read endpoints. The list changes continuously but not by the second — refreshing every few minutes is ample.
- Pricing
- Free, with no registration for reading.
- CORS
- Not enabled — call it from your server
- Official docs
- Read the docs
How to use the FishFish API
Every request below was executed against the live API on 2026-08-21, and the response shown is the real body it returned — not an illustration.
1. Fetch the full phishing domain blocklist
GET https://api.fishfish.gg/v1/domains
curl 'https://api.fishfish.gg/v1/domains' \
-H 'Accept: application/json'const res = await fetch("https://api.fishfish.gg/v1/domains", {
headers: {
"Accept": "application/json",
},
});
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);import requests
headers = {
"Accept": "application/json",
}
res = requests.get("https://api.fishfish.gg/v1/domains", headers=headers, timeout=20)
res.raise_for_status()
print(res.json())[
"coinjeto.com",
"betacsgo2.me",
"tinytaskdapp.vercel.app",
"stemcomnnmunnity.com",
"disc-ogifts.gq",
"robloox.cfd",
"hoavax.com",
"moderator-registration.com",
"com-eng.eu",
"steanmcomnmunity.com",
"faze1.xyz",
"counter-strike2023.com",
"jobcordcompany.com",
"join-formulary-moderator-test.com",
"steamcrommunity.com",
"academy-connects-moderetors.com",
"app-discord-nitro.ru",
"steamcommunicty.ru",
"slreamcumnnunytl.com",
"rbxbots.com",
"zuki-bots.vercel.app",
"dlscord-to.xyz",
"nitrosteamf.com",
"staemconmnuity.com",
"track-addpkg.com",
"vulcan-security.xyz",
"cs2-sourse.com",
"rustgiveaway.online",
"web3whales.website",
"blockdexsystems.pages.dev",
"sttreamcommunity.ru",
"official-form-hypesquad-events.com",
"roblox.sh",
"mysteryclick31g.vercel.app",
"shortd.xyz",
"s.teamdk.world",
"go-1win.bet",
"dirscod-drop.gq",
"steemcommunyty.ru",
"no15249880013.asia",
"added-hypesquad.com",
"gifltdilscorw.com",
"mee6web3.com",
"steaemcommunuity.com",
"steamcommuhitiy.ru",
"webkava.com",
"tv-bonus.pro",
"foloke.top",
"steamcommuniqy.ru",
"easydropper.ru",
"join-the-formulary-hypesquad.cf",
"freelisskins.ru",
"dlscord-app.site",
"steamcommunityid.ru",
"pubggift.top",
"steanncommuniti.store",
"steacmcommunilty.com",
"elon-giveaway.info",
"role-management.com",
"dicsord-q.ru",
"enter-hypesquad-resgistration.gq",
"opensea-click28-two.vercel.app",
"steancommiuniliy.ru.com",
"ravoxbet.com",
"stearncomnunlty.shop",
"steamcomuniltty.com",
"steam-gifts.sbs",Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
(endpoint) /domains | path | Optional | The full blocklist as a JSON array of domain strings. /v1/domains |
full | query | Optional | Return full domain objects with category, description and timestamps instead of bare strings. true |
category | query | Optional | Filter by classification, such as `phishing` or `malware`. phishing |
(endpoint) /domains/{domain} | path | Optional | Check a single domain and get its record if listed. /v1/domains/example.com |
(endpoint) /urls | path | Optional | The companion list of specific malicious URLs rather than whole domains. /v1/urls |
Response fields
(array of strings)array- The default response is a bare JSON array of domain names, ready to load into a set.
namestring- With `full=true`, the domain name.
categorystring- Classification such as `phishing` or `malware`.
descriptionstring- Reviewer's note on what the domain does.
added / checkedinteger- Unix timestamps for when the domain was listed and last verified.
targetstring- Which brand or platform the scam impersonates, where recorded.
What you can build with the FishFish API
- Block scam links in a chat platform or community server
- Warn users before they follow a known phishing link
- Enrich moderation tooling with a targeted blocklist
- Feed a DNS sinkhole aimed at gaming-related scams
- Cross-check a reported domain against a curated list
Common errors and how to fix them
Very large response
The full list is thousands of domains in one array.
Fix: Fetch periodically and cache in a set. There is no pagination because the payload is only a few hundred kilobytes.
Domain not listed
Coverage is narrow and deliberately so.
Fix: The list targets gaming and chat platform scams. Combine it with broader phishing feeds for general web protection.
Stale matches
Scam domains are registered and abandoned within days.
Fix: Refresh regularly. An old cached copy will both miss new domains and block ones long since dead.
Subdomain mismatch
Entries are registrable domains, not full hostnames.
Fix: Normalise a URL to its registrable domain before matching, or you will miss `login.scam-domain.tld` style variants.
FishFish API — frequently asked questions
Is the FishFish API free?
Yes, reading the blocklist is free with no key or account. Submitting domains requires a token and a trusted reviewer role, which is what keeps the list curated.
What kinds of domains does it list?
Phishing and scam domains targeting gaming and chat communities — typosquats of Discord, Steam and Roblox, fake giveaway sites, counterfeit trading platforms and crypto scams aimed at the same audience.
Is this a general-purpose phishing blocklist?
No, and it does not claim to be. Its value is depth in a specific niche. For general web protection you want it alongside broader feeds rather than instead of them.
How often should I refresh the list?
Every few minutes is more than enough. Scam domains are registered and burned within days, so a stale copy misses new threats while carrying dead entries.
Tools that pair with this API
IP Blocklist Generator
Turn a list of IPs and CIDR ranges into nginx, Apache, iptables, ufw, netsh or plain CIDR rules, with duplicates removed and ranges merged.
URL Parser
Parse a URL into protocol, host, port, path, query parameters and hash. Handles relative URLs with a base and shows query params in a table. Free and private.
Extract URLs
Extract all URLs and links from any text online. Detect http, https and www addresses, remove duplicates, sort them, and export one per line or comma-separated.
FishFish is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-21; always check the official documentation before relying on this API in production, as terms and limits can change.