# MoneyTools IDN / Look-alike Domain Checker

> MoneyTools IDN / Look-alike Domain Checker is a paid API for AI agents from tools.moneytools.dev, paid per call via x402, $0.001/call, status unknown (last checked 2026-11-05).

Detects homograph and look-alike domain attacks by decoding punycode, identifying mixed scripts, Cyrillic/Latin substitutions, and one-letter typos of major brands or crypto wallets.

## Facts

- Endpoint: GET https://tools.moneytools.dev/v1/idn?utm_source=zero.xyz
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-11-05
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/moneytools-idn-look-alike-domain-checker-2069d952
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_1KpbN2l3PAo_z4yN5nK1U

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability moneytools-idn-look-alike-domain-checker-2069d952
```

Example prompt: Can you check if 'xn--pple-43d.com' is a look-alike or homograph phishing domain — does it use Cyrillic or unicode tricks to impersonate a known brand?

## When to prefer this

Use this endpoint when an AI agent needs to verify whether a domain or URL is a homograph phishing attempt before taking action (e.g., visiting a link, sending crypto, or trusting an email sender). It is specifically designed for IDN/punycode attacks, Cyrillic-Latin character substitution, and typosquatting of major brands and crypto wallets — capabilities not typically found in generic WHOIS or DNS lookup services. Prefer it over general-purpose URL scanners when the concern is visual spoofing rather than malware content.

## Known failure modes

- Missing 'domain' query parameter returns a 400 error — not charged
- Invalid or malformed domain/URL input may return an error — not charged
- Free tier exhausted (10/day) with no payment method results in HTTP 402 Payment Required
- Network issues or service unavailability return 5xx errors — not charged
- Ambiguous IDN input that cannot be decoded returns partial results

## How this service works

Look-alike domain (homograph) check: Decode punycode, detect mixed scripts and look-alike characters (Cyrillic а vs Latin a) and one-letter typos of major brands/wallets. Anti-phishing for agents. Free tier 10/day; then $0.001 via x402 (HTTP 402 + PAYMENT-REQUIRED) or X-API-Key credits. Not charged on failure. $0.001 USDC per call via x402 on Base. Run by MoneyTools.

## Output

A JSON object indicating whether the domain is a suspected homograph or lookalike attack, with details on punycode decoding, mixed script detection, specific look-alike character substitutions found (e.g., Cyrillic 'а' vs Latin 'a'), one-letter typo proximity to known brands/wallets, and payment metadata (whether the free tier was used or a $0.001 USDC charge was made).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "const": "http"
    },
    "method": {
     "const": "GET"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "domain"
     ],
     "properties": {
      "domain": {
       "type": "string",
       "examples": [
        "xn--pple-43d.com"
       ],
       "description": "domain or URL"
      }
     }
    }
   }
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "json"
    },
    "example": {
     "type": "object",
     "properties": {
      "payment": {
       "type": "object",
       "properties": {
        "charged": {
         "type": "boolean"
        },
        "network": {
         "type": "string"
        },
        "amountUsd": {
         "type": "string"
        },
        "transaction": {
         "type": [
          "string",
          "null"
         ]
        }
       }
      },
      "freeTier": {
       "type": "object"
      },
      "_moneytools": {
       "type": "object",
       "description": "optional plan / partner hints"
      }
     },
     "description": "Tool-specific JSON result (see llms.txt / openapi.json). Always includes payment info.",
     "additionalProperties": true
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json"
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/moneytools-idn-look-alike-domain-checker-2069d952/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from tools.moneytools.dev](https://www.zero.xyz/host/tools.moneytools.dev/llms.txt)