{"uid":"cap_knrMWbzY-xB9_-JSkHkGd","slug":"url-risk-heuristic-analyzer-f9958c24","name":"URL Risk Heuristic Analyzer","description":"Heuristic URL risk: scheme, IP hosts, deep subdomains, credential-themed labels, sensitive paths/params, optional brand= lookalike. Returns reasons + GO/HOLD/STOP. Not a malware or Safe Browsing scan.","url":"https://402.com.tr/api/x402/url-risk","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"pathParams":{"type":"object"},"queryParams":{"type":"object","required":["url"],"properties":{"url":{"type":"string","description":"URL"},"brand":{"type":"string","description":"Expected brand host (optional)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_elLatchyOC5Kub865JN0G","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Performs heuristic risk analysis on a URL and returns a GO/HOLD/STOP verdict with reasons based on structural signals like scheme, IP hosts, deep subdomains, credential-themed labels, and sensitive paths.","exampleAgentPrompt":"Can you check if this URL looks risky — https://secure-login.paypa1.accounts.verify-now.com/reset?token=abc123 — and flag it against the expected brand paypal.com?","exampleUseCases":[{"title":"Pre-click phishing link check","prompt":"Before I forward this link to my team, can you run a risk check on https://docs-shared.microsoft-office365.com.phishing.xyz/view?file=report.pdf and tell me if it looks suspicious?"},{"title":"Brand lookalike detection for fraud team","prompt":"We keep seeing links pretending to be our site. Can you assess https://secure.acme-login.support/credentials/reset for risk and check it against our expected brand acme.com?"},{"title":"Automated URL safety gate in onboarding flow","prompt":"A user submitted this callback URL during registration: https://192.168.1.1/webhook?secret=token123 — can you score it for structural red flags and tell me if it's safe to whitelist?"}],"resultDescription":"Returns a structured object containing a risk verdict (GO, HOLD, or STOP), a list of human-readable reasons explaining which heuristic signals were triggered (e.g. IP-based host, deep subdomains, credential-themed path segments, suspicious query parameter names), and optional brand lookalike analysis if a brand host was provided.","failureModes":["Missing required 'url' query parameter returns validation error","Malformed or non-parseable URL may return HOLD or error","No malware or Safe Browsing database is consulted — a clean verdict does not guarantee the URL is safe","Brand lookalike check only fires when 'brand' parameter is supplied","Does not perform DNS resolution or live content fetching — purely structural analysis"],"whenToPreferThis":"Use this endpoint when you need a fast, cheap, structural pre-screen of a URL before exposing it to users, redirecting traffic, or whitelisting it in a system — especially when you want explainable reasons rather than a black-box score. Prefer this over Safe Browsing or malware scanning APIs when you need real-time heuristics without external network calls, or when you want to detect phishing by URL shape (credential labels, deep subdomains, IP hosts) rather than known blocklists. Ideal for agent pipelines that process untrusted user-submitted URLs at scale.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T12:58:15.214Z","isFirstParty":false}