{"uid":"cap_FY7GXfYoVMpMKcX6DxLdI","slug":"halowerk-url-risk-analyzer-8fce0c82","name":"Halowerk URL Risk Analyzer","description":"Loest die vollstaendige Weiterleitungskette auf und belegt jeden Sprung mit Statuscode, Zielhost, Protokoll-, Registrierungsdomain-, Land- und ASN-Wechsel. Loest Kurz-URLs bis Tiefe fuenf auf, meldet Punycode und Homographen in beiden Schreibweisen, prueft Zertifikat, Domainalter, Registrar, Nameserver, ASN, Hoster und Land, fragt offene Sperrlisten und DNSBL fuer die Ziel-IP ab, vergleicht Content-Type gegen Dateiendung und durchsucht den Seitentext nach versteckten Anweisungen an Sprachmodelle","url":"https://tools.halowerk.com/v1/url/risk?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"url":{"type":"string","description":"Zu pruefende URL, http oder https"},"fetch_body":{"type":"boolean","default":true,"description":"Seiteninhalt lesen und auf Prompt-Injection pruefen. Bei false entfaellt der Injection-Befund."},"follow_redirects":{"type":"boolean","const":true,"default":true,"description":"Fest auf true. Ohne die vollstaendige Kette ist das Ziel nicht beurteilbar."}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.004","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.004/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.004","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.004","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_QbvJnWrwX6amBQJPRGbK5","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.004","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Analyzes a URL for security risks by resolving its full redirect chain, checking blocklists, DNSBL, certificate validity, domain age, ASN, and scanning page content for hidden LLM prompt injection.","exampleAgentPrompt":"Can you check whether this link is safe — it was sent to me in an email and I'm not sure where it actually goes: https://bit.ly/3xR92pQ? I want to know the full redirect chain, whether any hops change country or ASN, and whether the final page has any hidden prompt injection.","exampleUseCases":[{"title":"Phishing link triage for security team","prompt":"We got a suspicious link in a phishing report — can you analyze https://secure-login.paypa1.com/verify for me? I want to see the redirect chain, any Punycode or homograph tricks, certificate status, domain age, and whether it's on any blocklists."},{"title":"Short URL safety check before sharing","prompt":"Before I forward this bit.ly link to my team, can you resolve it and tell me every hop it goes through, whether any hop changes the hosting country or ASN, and whether the final page contains hidden instructions targeting AI assistants?"},{"title":"LLM prompt injection audit of inbound URL","prompt":"A user submitted this URL to our platform: https://example-data-source.io/feed — can you scan the page for hidden prompt injection or LLM manipulation instructions, and also check the domain's registrar, nameservers, and DNSBL reputation of its IP?"}],"resultDescription":"Returns the full redirect chain with each hop's HTTP status code, target host, protocol, registrar domain, country, and ASN. Flags Punycode or homograph domains in both encodings, reports TLS certificate validity, domain age, registrar, nameservers, ASN, hoster, and country of the final destination. Lists any matches on open blocklists and DNSBL for the target IP. Reports Content-Type vs file extension mismatches. Flags any hidden LLM prompt injection instructions found in the page text.","failureModes":["URL is unreachable or times out — redirect chain truncated at the last reachable hop","URL exceeds depth of 5 redirects — analysis stops at hop 5","Domain does not resolve — DNS lookup failure returned","TLS certificate check fails if the site has an invalid or expired certificate — reported as an error flag","Blocklist APIs unavailable — partial or missing blocklist coverage noted","Homograph detection may miss non-Latin scripts not in the current rule set"],"whenToPreferThis":"Choose this endpoint when you need a comprehensive, multi-signal security assessment of a URL rather than a simple reputation lookup. It is especially valuable when the URL may be a short link hiding its destination, when you suspect homograph/Punycode spoofing, when you need to trace cross-border or cross-ASN redirect chains, or when you want to detect hidden prompt injection targeting AI systems in the page content. Prefer it over basic link-expanders or single-signal blocklist checkers when a thorough forensic breakdown is needed.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-13T06:48:33.249Z","isFirstParty":false,"canonicalSlug":"halowerk-url-risk-analyzer-8fce0c82"}