{"uid":"cap_6NvaWacPS6KIgHQX8Fa28","slug":"pocket-network-url-phishing-reputation-check-aafceb10","name":"Pocket Network URL Phishing Reputation Check","description":"Check a URL for phishing signs without fetching it: raw IP hosts, punycode, user@host, credential words in the host, very long hosts and deep subdomains. The verdict is suspicious or unknown, never clean, because no threat database is consulted; the response says what ran. POST /v1/reputation with {url}. Pay per request in USDC; no account, no API key.","url":"https://agent.pocket.network/v1/url-phishing-reputation?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"url":{"type":"string","description":"The URL to check (http or https). It is not fetched."}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_60DD2Q4djRC3qDxobClW0","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Performs heuristic analysis of a URL for phishing indicators (raw IP hosts, punycode, embedded credentials, suspicious subdomains) without fetching the URL, returning a suspicious or unknown verdict.","exampleAgentPrompt":"Can you check whether this URL looks like a phishing attempt — it doesn't need to be fetched, just analyze it for suspicious signs like raw IPs, punycode tricks, or credential words in the host: https://secure-login.paypa1.com/verify@user","exampleUseCases":[{"title":"Screen links before clicking","prompt":"I just got an email with this link in it — can you check if it looks like phishing before I open it? The URL is http://192.168.1.1/login/verify-account."},{"title":"Detect brand impersonation in URL","prompt":"This URL was sent to our support team claiming to be from Microsoft: https://micrоsoft-support.xn--e1afmapc.com/reset — does it have any phishing signs like punycode or weird subdomains?"},{"title":"Automated phishing triage in workflow","prompt":"We're processing a batch of user-reported suspicious links. Can you run a heuristic phishing check on this one: https://update-your-account@secure.bankofamerica.login.phish.net/portal — flag anything that looks off."}],"resultDescription":"A JSON response indicating whether the URL is 'suspicious' or 'unknown' (never 'clean'), along with details of which heuristic checks were run and which signals were triggered (e.g. raw IP host, punycode characters, embedded credentials, excessive subdomain depth, long hostname, credential-related words in host).","failureModes":["Invalid or malformed URL input — endpoint may return an error or unknown verdict","URL uses an unsupported scheme (non-http/https) — behavior undefined","False negatives on sophisticated phishing URLs that pass all heuristics — verdict will be 'unknown' not 'clean'","No threat intelligence database is consulted, so known-malicious but heuristically clean URLs will not be flagged","Payment failure in USDC — request will not be processed"],"whenToPreferThis":"Choose this endpoint when you need a fast, privacy-preserving, no-account heuristic check on a URL's structural characteristics for phishing signals, without making an outbound request to the URL itself. It is ideal for pre-click triage in automated pipelines, email security workflows, or agent-driven link screening where fetching the URL would be unsafe or undesirable. It is NOT a replacement for a full threat intelligence database lookup — use it as a lightweight first-pass filter or when a reputation database is unavailable.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-27T12:58:15.036Z","isFirstParty":false,"canonicalSlug":"pocket-network-url-phishing-reputation-check-aafceb10"}