# Malicious URL Screen

> Malicious URL Screen is a paid API for AI agents from x402.professorsausages.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-09-15).

Screens a URL for phishing and malicious content using the URLhaus blocklist snapshot combined with live heuristics including punycode/homograph detection, brand lookalike analysis, URL shape analysis, and optional redirect chain following

## Facts

- Endpoint: POST https://x402.professorsausages.com/url-screen/screen
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/malicious-url-screen-8151080a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_hBKA3XTor7ZyS2NsXQTJT

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability malicious-url-screen-8151080a -d '<json body>'
```

Example prompt: Can you check whether this link is safe or a phishing attempt before I click it: http://paypa1-secure-login.xyz/account/verify — specifically flag any brand lookalike, punycode tricks, or blocklist hits?

## When to prefer this

Choose this endpoint when you need a fast, low-cost phishing and malicious URL check combining blocklist coverage (URLhaus) with deterministic heuristics — especially useful for detecting brand impersonation, punycode/homograph domain tricks, and suspicious URL shapes that pure blocklists miss. Prefer this over a pure blocklist lookup when the URL is newly registered or not yet indexed. Prefer over full threat intelligence platforms when cost and latency matter more than deep behavioral analysis.

## Known failure modes

- URL not provided or malformed input results in validation error
- URLhaus blocklist snapshot may be slightly stale between refresh cycles, missing very recently added entries
- Heuristic brand lookalike detection limited to known major brand patterns
- Redirect chain following only available opt-in and may time out for long chains
- Legitimate internationalized domain names using punycode may produce false positives

## Output

Returns a safety verdict for the submitted URL including: whether the URL appears on the URLhaus blocklist snapshot, deterministic heuristic flags for punycode/homograph attacks, brand lookalike patterns, suspicious URL shape signals, and optionally the result of following the redirect chain to detect forwarding to malicious destinations.

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/malicious-url-screen-8151080a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402.professorsausages.com](https://www.zero.xyz/host/x402.professorsausages.com/llms.txt)