{"uid":"cap_VKNIKMGtW2xw8ShI0T4am","slug":"netintel-url-safety-check-4121d96f","name":"NetIntel URL Safety Check","description":"Check a URL against URLhaus malware database and heuristic phishing pattern analysis — returns threat classification, malware family if known, threat confidence, and risk score so agents can screen links before following them or sharing them in automated workflows.","url":"https://netintel.dev/url-safety/check?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["url"],"properties":{"url":{"type":"string","description":"URL to check for malware and phishing indicators (e.g. https://example.com/page)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","properties":{"url":{"type":"string"},"grade":{"type":"string"},"score":{"type":"number"},"findings":{"type":"array"},"confidence":{"type":"string"},"in_urlhaus":{"type":"boolean"},"threat_type":{"type":["string","null"]},"urlhaus_status":{"type":["string","null"]},"blacklisted_gsb":{"type":"boolean"},"heuristic_flags":{"type":"array","items":{"type":"string"}},"malware_families":{"type":"array","items":{"type":"string"}},"blacklisted_surbl":{"type":"boolean"},"urlhaus_reference":{"type":["string","null"],"description":"URLhaus entry link when the URL is listed"},"threat_classification":{"type":"string"}}}}}}},"responseSchema":{"type":"json","example":{"url":"https://example.com/page","grade":"A","score":100,"findings":[],"confidence":"none","in_urlhaus":false,"threat_type":null,"urlhaus_status":null,"blacklisted_gsb":false,"heuristic_flags":[],"malware_families":[],"blacklisted_surbl":false,"urlhaus_reference":null,"threat_classification":"clean"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_1vYh25JKaB4Zm7q9coiAr","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks a URL for malware, phishing, and threat indicators using blacklist lookups and heuristic analysis, returning a safety grade and detailed findings.","exampleAgentPrompt":"Can you check if this URL is safe to visit — https://suspicious-promo.xyz/offer/click — and tell me the safety grade, threat type, and whether it's blacklisted anywhere?","exampleUseCases":null,"resultDescription":"Returns a JSON object containing: the checked URL, a letter grade (e.g. A for clean), a numeric safety score (0-100), a threat classification (e.g. 'clean', 'phishing', 'malware'), threat type, confidence level, boolean flags for Google Safe Browsing and SURBL blacklist status, URLhaus lookup result and reference, detected malware families, and an array of heuristic flags indicating suspicious patterns.","failureModes":["Missing 'url' query parameter returns a validation error","Malformed or non-HTTP/HTTPS URL may return an error or low-confidence result","Payment failure via x402 (insufficient USDC balance) results in 402 Payment Required","Timeout or unavailability of upstream threat intelligence sources may reduce confidence","Newly registered malicious domains may not yet appear in blacklists, yielding false clean results"],"whenToPreferThis":"Use this endpoint when you need a fast, multi-signal URL safety verdict combining blacklist lookups (Google Safe Browsing, SURBL, URLhaus) with heuristic analysis in a single call. Prefer it over raw DNS or WHOIS lookups when you need a structured threat classification and grade rather than raw domain data. It is especially useful in agentic workflows where a user shares a suspicious link and you need a quick risk assessment before allowing interaction.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-11T00:43:12.226Z","isFirstParty":false,"canonicalSlug":"netintel-url-safety-check-4121d96f"}