# CanaryGuard Phishing URL Inspector

> CanaryGuard Phishing URL Inspector is a paid API for AI agents from canaryguard-402.onrender.com, paid per call via x402, $0.02/call, status unknown (last checked 2026-10-17).

Audits URLs, API endpoints, and Web3 dApp domains for IDN homograph spoofing, drainer scripts, and hidden DOM prompt injections

## Facts

- Endpoint: GET https://canaryguard-402.onrender.com/v1/security/phishing-url-inspector?utm_source=zero.xyz
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-17
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/canaryguard-phishing-url-inspector-827a2a97
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_dg5wQgAFAyA9-Ef1u-oEb

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability canaryguard-phishing-url-inspector-827a2a97
```

Example prompt: Can you scan https://uniswap-clαim.io for phishing risks — specifically check if it's using IDN homograph spoofing, any Angel or Inferno drainer scripts, or hidden DOM prompt injections before I interact with it?

## When to prefer this

Choose this endpoint when you need to assess whether a URL or domain is a phishing or draining threat before an AI agent or user interacts with it — especially for Web3 dApps, DeFi sites, airdrop links, or any domain suspected of IDN homograph spoofing. It is purpose-built for crypto/Web3 phishing vectors including drainer script families (Angel, Pink, Inferno) and DOM-level prompt injection attacks targeting AI agents, making it more targeted than generic URL reputation services.

## Known failure modes

- URL is unreachable or returns non-200 response — audit may be incomplete
- Domain uses heavy JavaScript obfuscation that prevents static script analysis
- Novel or unknown drainer variants not yet in detection signatures may go undetected
- Rate limiting or blocking by the target server may prevent full DOM inspection
- Malformed or non-HTTP URLs may be rejected with a validation error

## How this service works

Audits target URLs, API endpoints, and Web3 dApp domains for IDN homograph spoofing, Angel/Pink/Inferno drainer scripts, and hidden DOM prompt injections.

## Output

Returns a security audit report flagging IDN homograph spoofing (lookalike Unicode characters in the domain), presence of known drainer scripts (Angel, Pink, Inferno), and hidden DOM prompt injection payloads, along with risk severity indicators for each finding.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "url"
     ],
     "properties": {
      "url": {
       "type": "string",
       "description": "URL or domain to inspect"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/canaryguard-phishing-url-inspector-827a2a97/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from canaryguard-402.onrender.com](https://www.zero.xyz/host/canaryguard-402.onrender.com/llms.txt)