---
name: gateway.apiosk.com
description: gateway.apiosk.com exposes a single endpoint that compares a submitted domain against a caller-supplied allowlist using edit distance, visual distance, and similarity scoring to flag lookalike or homograph-spoofed domains. It returns per-match scores and a best-match result along with a suspicious flag. No global threat database or reputation feed is involved.
host: gateway.apiosk.com
---

# gateway.apiosk.com

This host is a narrow, single-purpose domain similarity checker aimed at security pipelines that need to detect typosquatting, homograph attacks, or lookalike domains at the point of link validation, phishing triage, or email sender verification. It is distinct from reputation or blacklist services: the caller supplies the trusted allowlist, and the host performs the comparison math. It suits agents that already know which domains are legitimate and need to measure how close an unknown domain is to those trusted ones.

## When to use this host

Use this host when an agent needs to determine whether a specific domain is a lookalike or homograph spoof of one or more known-good domains — for example, during phishing link triage, inbound email sender validation, or OAuth redirect URI checks. Do not use it for bulk domain reputation lookups, blacklist or blocklist queries, or threat intelligence enrichment; those use cases require a global threat database service (e.g., VirusTotal, Cisco Umbrella, or similar). This host also cannot resolve DNS, check WHOIS, or validate TLS certificates — it only performs string-level similarity comparison against the allowlist you provide.

## Capabilities

### Domain Similarity Detection

Compares an unknown domain against a caller-supplied allowlist and returns edit distance, visual distance, and composite similarity scores to identify potential lookalike or spoofed domains.

- **`check-domain-similarity`** — Compares a domain against an allowlist to detect lookalike or spoofed domains, returning edit distance, visual distance, and similarity scores for each match.

## Skill reference

### `check-domain-similarity`

**Domain Similarity Check** — Compares a domain against an allowlist to detect lookalike or spoofed domains, returning edit distance, visual distance, and similarity scores for each match.

*Use when:* Use when an agent needs to determine whether a domain is a lookalike or homograph spoof of one or more trusted domains, such as during phishing detection, link validation, or email sender verification.

*Not for:* Do not use for bulk domain reputation lookups or blacklist checks; this endpoint only compares a single domain against a caller-supplied allowlist, not a global threat database.

**Inputs:**

- `domain` (string, required) — The domain to evaluate for similarity against the allowlist.
- `allowlist` (array, required) — Array of trusted domain strings to compare the input domain against.

**Returns:** Returns ok=true, suspicious=true, a best_match object with edit distance and visual similarity scores, and a ranked matches array covering every allowlist entry.

**Example:** `{"domain": "paypa1.com", "allowlist": ["paypal.com", "support.paypal.com", "paypalobjects.com"]}`

---