Safebrowsing API v4 check for WP Antivirus by Pluginkollektiv (NOT WORKING)

wpantivirus.php

<?php

// API: https://developers.google.com/safe-browsing/v4/lookup-api
// Testlinks: https://testsafebrowsing.appspot.com/

/* 
Possible inspirations:
https://stackoverflow.com/questions/42348760/google-safe-browsing-api-is-not-responding-sending-back-response-status
http://www.queryadmin.com/1512/google-safebrowsing-v4-php-example/
https://github.com/web2all/safebrowsingv4
https://github.com/googleapis/google-api-php-client-services/blob/master/src/Google/Service/Safebrowsing.php
https://stackoverflow.com/questions/37410849/safe-browsing-lookup-api-v4-invalid-json-payload-received
*/

$url    = 'https://testsafebrowsing.appspot.com/s/malware.html';
$apiKey = 'AIzaSyALNYwuy-Pidn7vx3-In-hU0zgMH5Wr42U';
$apiUrl = 'https://safebrowsing.googleapis.com/v4/threatMatches:find?key=' . $apiKey;

$params = [
		'client' => [
				'clientId' => 'foobar',
				'clientVersion' => '1.2.3',
		],
		'threatInfo' => [
					"threatTypes"      => [ "MALWARE", "SOCIAL_ENGINEERING" ],
					"platformTypes"    => [ "WINDOWS" ],
					'threatEntryTypes' => [ 'URL' ],
				  'threatEntries'    => [
						[ 'url' => $url ]
				]
		]
];

$ch = curl_init( $apiUrl );
curl_setopt_array( $ch, [
		CURLOPT_POST           => 1,
		CURLOPT_RETURNTRANSFER => 1,
		CURLOPT_HEADER         => 1,
		CURLOPT_POSTFIELDS     => json_encode( $params ),
		CURLOPT_HTTPHEADER     => [
				'Content-Type: text/json'
		]
]);

// $res = curl_exec($ch);

$response = (array) json_decode( curl_exec( $ch ), true );
curl_close ($ch);

var_dump($response);

$is_unsafe = ( $response['matches'][0]['threatType'] ) ? true : false;

?> 
<pre>
	<?php 
	echo 'Host ' . $url . ' is ';
	if ( $is_unsafe ) {
		echo 'unsafe.';
	} else {
		echo 'clean';
	}
	?>
		
</pre>