canary

Check a domain

Scored from the hostname only
Nothing is fetched, logged or stored

examples:

HOW IT WORKS

A hostname has more to say than it looks.

Canary reads the name locally, weighs the things phishers tend to repeat, and shows its reasoning. It never visits the site.

  1. Put the name in context

    The private Public Suffix List distinguishes an owned domain from a shared-hosting namespace, so the rest of the score has the right frame of reference.

  2. Score the patterns that matter

    A compact NumPy model combines typos, Unicode lookalikes, lure words, suspicious structure, and brand impersonation.

APIGET / batch POST

Use the same scorer from your own tooling. A batch accepts up to 100 domains. 

curl /api/check?domain=paypa1-verify.top
curl -X POST /api/check \
  -H 'Content-Type: application/json' \
  -d '{"domains": ["paypa1-verify.top", "google.com"],
       "resolved_ips": {"paypa1-verify.top": ["1.2.3.4"]}}'