# agent402.tools Fraud Signals

> agent402.tools Fraud Signals is a paid API for AI agents from agent402.tools, paid per call via x402, $0.027/call, status unknown (last checked 2026-09-14).

Evaluates a domain's trustworthiness by pulling fraud reputation signals including domain age, certificate history, and hosting reputation to detect phishing, typosquats, and scams.

## Facts

- Endpoint: POST https://agent402.tools/api/skill/fraud-signals
- Price: $0.027/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/agent402-tools-fraud-signals-10dc2e59
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Vv1NSQTZ09z54JW9AXFJp

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability agent402-tools-fraud-signals-10dc2e59 -d '<json body>'
```

Example prompt: Can you check whether 'secure-bankofamerica-login.com' is trustworthy or if it looks like a phishing site or typosquat — pull the fraud signals including domain age and hosting reputation?

## When to prefer this

Use this endpoint when you need a bundled, pre-packaged fraud signal check for a domain and don't want to aggregate multiple threat intelligence sources manually. Ideal for quick trust assessments before a user clicks a link or when screening domains in a workflow. Prefer over raw WHOIS or cert-only lookups because it combines multiple reputation dimensions in a single call.

## Known failure modes

- Domain not found or unresolvable — returns empty or error signal
- Invalid domain format input — returns validation error
- Payment not completed — 402 payment required before results returned
- Timeout if external reputation sources are slow to respond

## How this service works

Bundled execution of the Fraud signals workflow - Is this domain trustworthy, or is it a phishing site / typosquat / scam? Pull the reputation signals an analyst checks before clicking anything: domain age, cert issuance history, hosting reputation, DNS topology, tech-stack fingerprint, and page-content red flags. Different from a security audit - this is about whether the domain is what it claims to be.

## Output

Returns reputation signals for the queried domain including domain age, TLS certificate issuance history, hosting reputation scores, and indicators of whether the domain resembles a phishing site, typosquat, or scam operation.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "domain": {
   "type": "string",
   "description": "Domain to evaluate (e.g. example.com or suspicious-bank-login.com)"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "args": {
   "domain": "example.com"
  },
  "pack": "fraud-signals",
  "steps": [
   {
    "ok": true,
    "slug": "whois",
    "result": {}
   },
   {
    "ok": true,
    "slug": "cert-transparency",
    "result": {}
   },
   {
    "ok": true,
    "slug": "tls-cert",
    "result": {}
   },
   {
    "ok": true,
    "slug": "asn-info",
    "result": {}
   },
   {
    "ok": true,
    "slug": "dns-lookup",
    "result": {}
   },
   {
    "ok": true,
    "slug": "tech-stack",
    "result": {}
   },
   {
    "ok": true,
    "slug": "extract",
    "result": {}
   }
  ],
  "summary": "7/7 steps succeeded"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/agent402-tools-fraud-signals-10dc2e59/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agent402.tools](https://www.zero.xyz/host/agent402.tools/llms.txt)