Check Phishing URLs in Sheets
Formula
Screen domains by the row. =VERVE("phishingcheck", A2) flags known phishing sites down a column — Google Sheets or Excel.
=VERVE("phishingcheck", A2)=VERVE.CALL("phishingcheck", A2)A2 holds the domain you're looking up. Drag the formula down and each row resolves on its own.
With literal values
Nothing has to come from a cell — typed values work the same way.
=VERVE("phishingcheck", "centruldepiele.ro")Inputs
Required inputs are positional, in the order below. Everything else is passed as a "name", value pair after them — the same shape as SUMIFS.
| Input | Type | Where it goes | Description |
|---|---|---|---|
domainRequired | string | argument 2 | The domain to check (e.g., example.com) (e.g. centruldepiele.ro) |
What lands in your sheet
With no "field" pair the formula spills the whole response as two columns — field name on the left, value on the right — starting at the cell you typed in. Make sure the cells below and to the right are empty.
Pulling one value
Add a "field" pair to get a single cell back instead of a table. The field name is the dot-path from the table below.
=VERVE("phishingcheck", A2, "field", "domain")=VERVE.CALL("phishingcheck", A2, "field", "domain")Available fields
#PREMIUM(field) rather than a value, so a locked field never looks like a real answer.| Use as "field" | Type | Example cell value | Description |
|---|---|---|---|
domain | string | secure-banking-login.suspicious-domain.com | The domain that was checked for phishing threats |
isPhishing | boolean | true | Whether the domain is a known phishing site |
matchedDomainPremium | string | suspicious-domain.com | The matched phishing domain from threat database |
inputType | string | url | Type of input checked - domain or URL format |
originalInput | string | https://secure-banking-login.suspicious-domain.com/auth | The original input provided by the user |
isPunycodePremium | boolean | false | Whether the domain uses punycode/IDN encoding (xn--), the vector for homograph attacks that impersonate brands with lookalike characters |
isIpAddressPremium | boolean | false | Whether a raw IP address was used in place of a domain, a common trait of malicious links |
riskScorePremium | number | 85 | Composite 0-100 risk score combining the blocklist match with structural phishing indicators — a heuristic supplement to isPhishing, not a verdict (higher is riskier) |
riskLevelPremium | string | high | Risk band derived from the score: low, medium or high |
Filling a whole column
Hand the first argument a range instead of a cell and the add-in makes one batched call for the lot, then spills the answers down. That is faster than dragging the formula and costs the same credits — one per row looked up.
=VERVE("phishingcheck", A2:A100, "field", "domain")=VERVE.CALL("phishingcheck", A2:A100, "field", "domain")A2:A100 is the column of domain values. The result spills down alongside it, one row per input, blanks skipped.
When a cell doesn't fill
A failed lookup returns readable text starting with #ERR rather than a spreadsheet error, because Excel cannot show a custom message on a real error — you would get a bare #VALUE! with no reason. The trade-off is that IFERROR() won't catch it; test with LEFT(cell, 4) = "#ERR" instead.
| Cell reads | What happened |
|---|---|
#ERR Not connected | No API key saved. Open the side panel and connect your account. |
#ERR Replace <name> with a cell or value | The preview formula was copied as-is. Swap the placeholder for a cell reference. |
#ERR No "x" in phishingcheck | An option name that this source doesn't take. The message lists the ones it does. |
#ERR No data point "…" | The "field" path isn't in the response. Check the dot-path against the table above. |
#PREMIUM(field) | The field exists but your plan doesn't include it. |
#ERR Out of credits | The month's credits are spent. Usage resets on your billing date. |
Before the formula works
The add-in reads the API key you saved once in the side panel — the key never goes in the formula, so a shared sheet doesn't leak it and a collaborator without access simply sees the last calculated values.
- Install the add-in for Google Sheets or Excel.
- Open the side panel and sign in, or paste a key from your dashboard.
- Type the formula above into any cell.
Other ways to use Check Phishing URLs in Sheets
Set up Check Phishing URLs in Sheets on VerveSheets, or reach the same source a different way. Your VerveSheets account and credits work on all of them — one key, one balance.
Frequently asked questions
Does Check Phishing URLs in Sheets work in both Google Sheets and Excel?
Yes — the same source, the same arguments. Sheets calls it =VERVE("phishingcheck", …) and Excel calls it =VERVE.CALL("phishingcheck", …); that function name is the only difference.
Do the cells recalculate on their own?
They recalculate when the sheet does — on edit, on open, or on a manual recalc. Each recalculation is a fresh call and spends credits, so for a large static column it's worth copying the results and pasting them as values.
How many credits does a filled column cost?
1 credit per row looked up, whether you drag the formula or pass a range. The range form is one HTTP call instead of many, but the credit count is the same.
Can I share the sheet without sharing my key?
Yes. The key is stored against your account, not in the file. Collaborators see the values already in the cells; formulas only recalculate for someone who has connected their own account.
Why is a cell showing #ERR instead of an error?
So you can read the reason. Excel can't display a custom message on a real spreadsheet error, so the add-in returns the explanation as text on both platforms instead.