{"uid":"cap_1KpbN2l3PAo_z4yN5nK1U","slug":"moneytools-idn-look-alike-domain-checker-2069d952","name":"MoneyTools IDN / Look-alike Domain Checker","description":"Look-alike domain (homograph) check: Decode punycode, detect mixed scripts and look-alike characters (Cyrillic а vs Latin a) and one-letter typos of major brands/wallets. Anti-phishing for agents. Free tier 10/day; then $0.001 via x402 (HTTP 402 + PAYMENT-REQUIRED) or X-API-Key credits. Not charged on failure. $0.001 USDC per call via x402 on Base. Run by MoneyTools.","url":"https://tools.moneytools.dev/v1/idn?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"const":"http"},"method":{"const":"GET"},"queryParams":{"type":"object","required":["domain"],"properties":{"domain":{"type":"string","examples":["xn--pple-43d.com"],"description":"domain or URL"}}}}},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string","const":"json"},"example":{"type":"object","properties":{"payment":{"type":"object","properties":{"charged":{"type":"boolean"},"network":{"type":"string"},"amountUsd":{"type":"string"},"transaction":{"type":["string","null"]}}},"freeTier":{"type":"object"},"_moneytools":{"type":"object","description":"optional plan / partner hints"}},"description":"Tool-specific JSON result (see llms.txt / openapi.json). Always includes payment info.","additionalProperties":true}}}}},"responseSchema":{"type":"json"},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_QtOsWB-21eRs-wCnBOPw2","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Detects homograph and look-alike domain attacks by decoding punycode, identifying mixed scripts, Cyrillic/Latin substitutions, and one-letter typos of major brands or crypto wallets.","exampleAgentPrompt":"Can you check if 'xn--pple-43d.com' is a look-alike or homograph phishing domain — does it use Cyrillic or unicode tricks to impersonate a known brand?","exampleUseCases":[{"title":"Crypto wallet phishing detection","prompt":"Before I send funds, check whether 'cоinbase.com' (the one that just appeared in that email) is a lookalike phishing domain using Cyrillic or unicode substitutions — I want to know if it's really Coinbase."},{"title":"Brand protection for e-commerce","prompt":"Someone is sending emails from 'amаzon-support.com' — can you check if that domain uses any mixed-script or look-alike characters to impersonate Amazon?"},{"title":"Agent pipeline URL safety check","prompt":"My agent received a redirect to 'paypаl.com' — run a homograph and IDN lookalike check on it to see if any characters are Cyrillic substitutes or one-letter typo-squats of PayPal."}],"resultDescription":"A JSON object indicating whether the domain is a suspected homograph or lookalike attack, with details on punycode decoding, mixed script detection, specific look-alike character substitutions found (e.g., Cyrillic 'а' vs Latin 'a'), one-letter typo proximity to known brands/wallets, and payment metadata (whether the free tier was used or a $0.001 USDC charge was made).","failureModes":["Missing 'domain' query parameter returns a 400 error — not charged","Invalid or malformed domain/URL input may return an error — not charged","Free tier exhausted (10/day) with no payment method results in HTTP 402 Payment Required","Network issues or service unavailability return 5xx errors — not charged","Ambiguous IDN input that cannot be decoded returns partial results"],"whenToPreferThis":"Use this endpoint when an AI agent needs to verify whether a domain or URL is a homograph phishing attempt before taking action (e.g., visiting a link, sending crypto, or trusting an email sender). It is specifically designed for IDN/punycode attacks, Cyrillic-Latin character substitution, and typosquatting of major brands and crypto wallets — capabilities not typically found in generic WHOIS or DNS lookup services. Prefer it over general-purpose URL scanners when the concern is visual spoofing rather than malware content.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-11-05T12:42:52.041Z","isFirstParty":false,"canonicalSlug":"moneytools-idn-look-alike-domain-checker-2069d952"}