{"uid":"cap_loVXWgJEXlL7nHfyQr3Al","slug":"urltrust-lexical-url-risk-analyzer-f93704e9","name":"URLTrust Lexical URL Risk Analyzer","description":"Score how likely a URL is to be phishing or untrustworthy using offline lexical and structural heuristics (no network lookups). Checks raw-IP hosts, embedded credentials, punycode/homoglyph labels, brand typosquatting, brand-in-subdomain, abused TLDs, shorteners, random hostnames, odd ports, plaintext http and executable paths. Returns a 0-100 risk score, a verdict and the reasons.","url":"https://urltrust.openverbs.com/v1/analyze","method":"POST","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","bodyType","body"],"properties":{"body":{"type":"object","required":["url"],"properties":{"url":{"type":"string","maxLength":2048,"minLength":1,"description":"Absolute http(s) URL to analyze."}},"additionalProperties":false},"type":{"type":"string","const":"http"},"method":{"enum":["POST"],"type":"string"},"bodyType":{"enum":["json","form-data","text"],"type":"string"}},"additionalProperties":false}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.004","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.004/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.004","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.004","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_k2Ni9VbSF4X0ZuQrgUPPV","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.004","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Scores a URL from 0–100 for phishing/trustworthiness risk using offline lexical and structural heuristics, returning a verdict and detailed reasons.","exampleAgentPrompt":"Can you check whether this URL looks like a phishing or spoofing attempt — https://paypa1-secure.login.tk/verify — and give me a risk score and the reasons it flagged?","exampleUseCases":[{"title":"Pre-click phishing link check","prompt":"Before I forward this link to my team, can you run it through a phishing check and tell me the risk score and any suspicious patterns? The URL is https://micros0ft-support.click/reset-password.exe"},{"title":"Brand typosquatting detection in user submissions","prompt":"A user just submitted this URL in our form: https://amaz0n.shop-deals.top/prime — can you score it for phishing risk and tell me if it's impersonating a known brand?"},{"title":"Automated URL triage in security pipeline","prompt":"We're scanning a batch of URLs from email logs — can you analyze https://bit.ly/3xR9qZp and tell me its phishing risk score, verdict, and the specific heuristics that triggered?"}],"resultDescription":"Returns a 0–100 integer risk score (higher = riskier), a human-readable verdict (e.g. 'suspicious', 'likely phishing', 'low risk'), and an array of reasons explaining which heuristics triggered — such as raw-IP host, embedded credentials, punycode labels, brand typosquatting, abused TLD, URL shortener, random hostname, odd port, plaintext HTTP, or executable file path.","failureModes":["Missing or empty URL field returns a validation error","URL exceeding 2048 characters is rejected","Non-HTTP(S) URLs (e.g. ftp://, file://) may be unsupported","Malformed URL strings may return an error or low-confidence score","Service does not perform live network lookups so newly registered safe domains may still score risky based on lexical patterns alone"],"whenToPreferThis":"Choose this endpoint when you need fast, privacy-safe, offline URL risk assessment with no network side-effects — ideal for high-volume triage, pre-click safety checks, or pipelines where making outbound requests to the target URL is undesirable. Prefer it over live-lookup alternatives when latency and privacy matter, or when scanning URLs that must not be contacted. Not suitable when you need WHOIS age, DNS reputation, or live content scanning.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-13T12:33:30.285Z","isFirstParty":false}