Google Safe Browsing vs NoPhishy

Google Safe Browsing lets clients check URLs against Google's continuously updated lists of malware, phishing, and unwanted-software sites via the v4 threatMatches:find endpoint, the same data that powers warnings in Chrome and Search. A live POST with a syntactically valid but bogus key returned a 400 "API key not valid" error from safebrowsing.googleapis.com, reconfirming API-key auth and HTTPS, and both that call and its OPTIONS preflight echoed the request Origin in Access-Control-Allow-Origin. The API is free for any Google Cloud project under its published quota.

NoPhishy (listed on RapidAPI as Exerra Phishing Check) queries a maintained database of 299,000+ known phishing domains, refreshed roughly every two hours, to flag whether a submitted URL or domain is a known phishing attempt. A live GET through the real RapidAPI gateway host with an invalid x-rapidapi-key returned a 403 rejection rather than a network-level block, reconfirming API-key auth over HTTPS, and Access-Control-Allow-Origin echoed the request's Origin on that same call. Like other RapidAPI-distributed APIs it offers a free Basic plan alongside paid tiers for higher request volumes.