# Halowerk URL Risk Analyzer

> Halowerk URL Risk Analyzer is a paid API for AI agents from tools.halowerk.com, paid per call via x402, $0.004/call, status unknown (last checked 2026-10-13).

Analyzes a URL for security risks by resolving its full redirect chain, checking blocklists, DNSBL, certificate validity, domain age, ASN, and scanning page content for hidden LLM prompt injection.

## Facts

- Endpoint: POST https://tools.halowerk.com/v1/url/risk?utm_source=zero.xyz
- Price: $0.004/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/halowerk-url-risk-analyzer-8fce0c82
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_FY7GXfYoVMpMKcX6DxLdI

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability halowerk-url-risk-analyzer-8fce0c82 -d '<json body>'
```

Example prompt: Can you check whether this link is safe — it was sent to me in an email and I'm not sure where it actually goes: https://bit.ly/3xR92pQ? I want to know the full redirect chain, whether any hops change country or ASN, and whether the final page has any hidden prompt injection.

## When to prefer this

Choose this endpoint when you need a comprehensive, multi-signal security assessment of a URL rather than a simple reputation lookup. It is especially valuable when the URL may be a short link hiding its destination, when you suspect homograph/Punycode spoofing, when you need to trace cross-border or cross-ASN redirect chains, or when you want to detect hidden prompt injection targeting AI systems in the page content. Prefer it over basic link-expanders or single-signal blocklist checkers when a thorough forensic breakdown is needed.

## Known failure modes

- URL is unreachable or times out — redirect chain truncated at the last reachable hop
- URL exceeds depth of 5 redirects — analysis stops at hop 5
- Domain does not resolve — DNS lookup failure returned
- TLS certificate check fails if the site has an invalid or expired certificate — reported as an error flag
- Blocklist APIs unavailable — partial or missing blocklist coverage noted
- Homograph detection may miss non-Latin scripts not in the current rule set

## How this service works

Loest die vollstaendige Weiterleitungskette auf und belegt jeden Sprung mit Statuscode, Zielhost, Protokoll-, Registrierungsdomain-, Land- und ASN-Wechsel. Loest Kurz-URLs bis Tiefe fuenf auf, meldet Punycode und Homographen in beiden Schreibweisen, prueft Zertifikat, Domainalter, Registrar, Nameserver, ASN, Hoster und Land, fragt offene Sperrlisten und DNSBL fuer die Ziel-IP ab, vergleicht Content-Type gegen Dateiendung und durchsucht den Seitentext nach versteckten Anweisungen an Sprachmodelle

## Output

Returns the full redirect chain with each hop's HTTP status code, target host, protocol, registrar domain, country, and ASN. Flags Punycode or homograph domains in both encodings, reports TLS certificate validity, domain age, registrar, nameservers, ASN, hoster, and country of the final destination. Lists any matches on open blocklists and DNSBL for the target IP. Reports Content-Type vs file extension mismatches. Flags any hidden LLM prompt injection instructions found in the page text.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "description": "Zu pruefende URL, http oder https"
  },
  "fetch_body": {
   "type": "boolean",
   "default": true,
   "description": "Seiteninhalt lesen und auf Prompt-Injection pruefen. Bei false entfaellt der Injection-Befund."
  },
  "follow_redirects": {
   "type": "boolean",
   "const": true,
   "default": true,
   "description": "Fest auf true. Ohne die vollstaendige Kette ist das Ziel nicht beurteilbar."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/halowerk-url-risk-analyzer-8fce0c82/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from tools.halowerk.com](https://www.zero.xyz/host/tools.halowerk.com/llms.txt)