kerberus.com APIwww.kerberus.com ↗
Scan Web3 domains against the Kerberus blocklist and whitelist. Returns safety classification, blacklist/whitelist status, and blocked flag for any domain.
curl -X POST 'https://api.parse.bot/scraper/e190f387-aef2-46e6-9d62-1464e9b69c9c/scan_domain' \
-H 'X-API-Key: $PARSE_API_KEY' \
-H 'Content-Type: application/json' \
-d '{}'Scan a Web3 site domain to check if it is flagged as a scam, phishing site, or is whitelisted as safe. Returns blocklist/whitelist status and an overall safety classification (green for safe, red for blocked).
| Param | Type | Description |
|---|---|---|
| domainrequired | string | The domain to scan for safety (e.g. 'uniswap.org', 'opensea.io'). May include or omit protocol prefix (https:// is stripped automatically). Should be a bare domain without path. |
{
"type": "object",
"fields": {
"domain": "string - the scanned domain",
"status": "string - overall safety classification: 'green' (safe) or 'red' (blocked)",
"is_blocked": "boolean - whether the domain is actively blocked by Kerberus",
"request_id": "string - unique identifier for this scan request",
"is_blacklisted": "boolean - whether the domain is on the Kerberus blacklist",
"is_whitelisted": "boolean - whether the domain is on the Kerberus whitelist",
"processed_time": "string - time taken to process the scan"
},
"sample": {
"domain": "uniswap.org",
"status": "green",
"is_blocked": false,
"request_id": "7e6b4429-ad39-403c-9ac2-a00f405f4d71",
"is_blacklisted": false,
"is_whitelisted": true,
"processed_time": "3ms"
}
}About the kerberus.com API
The Kerberus API exposes 1 endpoint — scan_domain — that checks any Web3 domain against the Kerberus detection engine and returns 6 structured fields including is_blacklisted, is_whitelisted, is_blocked, and an overall status of green or red. It covers crypto and DeFi domains such as DEX frontends, NFT marketplaces, and Web3 wallets, giving developers a fast programmatic way to flag phishing and scam sites before users interact with them.
What the API Returns
The single scan_domain endpoint accepts a domain string — with or without a protocol prefix — and returns a JSON object with six fields. The status field is the top-level verdict: green means the domain is considered safe, red means it is blocked. Three boolean fields (is_blocked, is_blacklisted, is_whitelisted) give finer-grained detail about exactly how the Kerberus engine classified the domain. A request_id string uniquely identifies the scan for tracing, and processed_time records how long the scan took.
Input Behavior
The only required input is domain. You can pass bare domains like uniswap.org or full URLs like https://opensea.io — the endpoint normalises both. There are no optional filter parameters; every call returns the full classification object for the submitted domain. Submissions are one domain per request, so batch checking requires multiple sequential or parallel calls.
Blocklist vs. Whitelist
The is_blacklisted and is_whitelisted fields are independent booleans drawn from separate Kerberus lists, so a domain could theoretically appear on neither list (unclassified) while still returning a status. The is_blocked field reflects whether the domain is actively suppressed by the Kerberus engine, which may differ from raw blacklist membership if the engine applies additional scoring logic. When building safety checks, consuming all three fields rather than relying solely on status gives the most complete picture.
- Block Web3 wallet UI from loading known phishing domains using the
is_blockedflag before connecting. - Warn DeFi app users before redirecting to an external DEX or bridge by checking
statusagainstred. - Build a browser extension that pre-screens NFT marketplace links using
is_blacklistedandis_whitelisted. - Log
request_idandprocessed_timeto audit a history of domain safety checks in a security dashboard. - Automate a CI step that rejects any newly added third-party Web3 domain that returns
is_blocked: true. - Cross-reference airdrop claim links against the Kerberus blacklist before distributing them to community members.
| Tier | Price | Credits/month | Rate limit |
|---|---|---|---|
| Free | $0/mo | 100 | 5 req/min |
| Hobby | $30/mo | 1,000 | 20 req/min |
| Developer | $100/mo | 5,000 | 250 req/min |
One credit = one API call regardless of which marketplace API you call. Exceeding the rate limit returns a 429 response. Authenticate with the X-API-Key header.
Does Kerberus have an official developer API?+
What is the difference between `is_blacklisted` and `is_blocked`?+
is_blacklisted indicates the domain appears on the Kerberus blacklist data set. is_blocked indicates the domain is actively blocked by the Kerberus engine, which may reflect additional scoring beyond raw list membership. A domain can be blacklisted without currently being blocked, or blocked through engine logic even if not yet formally listed. For the strictest safety gate, treat either true value as a signal to warn or halt.Can the API return a safety score or confidence level instead of just a binary `green`/`red` status?+
scan_domain endpoint returns a two-value status field (green or red) along with three boolean classification fields. There is no numeric risk score or confidence percentage in the response. You can fork this API on Parse and revise it to add a scoring layer or additional metadata endpoint if the source exposes that data.Can I scan multiple domains in a single request?+
scan_domain endpoint accepts one domain string per call. Checking a list of domains requires multiple requests. You can fork this API on Parse and revise it to add a batch endpoint if that capability becomes available.Does the API cover non-Web3 or traditional web domains?+
is_whitelisted and is_blacklisted fields will reflect whatever the Kerberus dataset contains for a given domain regardless of category.