# NetIntel URL Safety Check

> NetIntel URL Safety Check is a paid API for AI agents from netintel.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-11).

Checks a URL for malware, phishing, and threat indicators using blacklist lookups and heuristic analysis, returning a safety grade and detailed findings.

## Facts

- Endpoint: GET https://netintel.dev/url-safety/check?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/netintel-url-safety-check-4121d96f
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_VKNIKMGtW2xw8ShI0T4am

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability netintel-url-safety-check-4121d96f
```

Example prompt: Can you check if this URL is safe to visit — https://suspicious-promo.xyz/offer/click — and tell me the safety grade, threat type, and whether it's blacklisted anywhere?

## When to prefer this

Use this endpoint when you need a fast, multi-signal URL safety verdict combining blacklist lookups (Google Safe Browsing, SURBL, URLhaus) with heuristic analysis in a single call. Prefer it over raw DNS or WHOIS lookups when you need a structured threat classification and grade rather than raw domain data. It is especially useful in agentic workflows where a user shares a suspicious link and you need a quick risk assessment before allowing interaction.

## Known failure modes

- Missing 'url' query parameter returns a validation error
- Malformed or non-HTTP/HTTPS URL may return an error or low-confidence result
- Payment failure via x402 (insufficient USDC balance) results in 402 Payment Required
- Timeout or unavailability of upstream threat intelligence sources may reduce confidence
- Newly registered malicious domains may not yet appear in blacklists, yielding false clean results

## How this service works

Check a URL against URLhaus malware database and heuristic phishing pattern analysis — returns threat classification, malware family if known, threat confidence, and risk score so agents can screen links before following them or sharing them in automated workflows.

## Output

Returns a JSON object containing: the checked URL, a letter grade (e.g. A for clean), a numeric safety score (0-100), a threat classification (e.g. 'clean', 'phishing', 'malware'), threat type, confidence level, boolean flags for Google Safe Browsing and SURBL blacklist status, URLhaus lookup result and reference, detected malware families, and an array of heuristic flags indicating suspicious patterns.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "url"
     ],
     "properties": {
      "url": {
       "type": "string",
       "description": "URL to check for malware and phishing indicators (e.g. https://example.com/page)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "url": {
       "type": "string"
      },
      "grade": {
       "type": "string"
      },
      "score": {
       "type": "number"
      },
      "findings": {
       "type": "array"
      },
      "confidence": {
       "type": "string"
      },
      "in_urlhaus": {
       "type": "boolean"
      },
      "threat_type": {
       "type": [
        "string",
        "null"
       ]
      },
      "urlhaus_status": {
       "type": [
        "string",
        "null"
       ]
      },
      "blacklisted_gsb": {
       "type": "boolean"
      },
      "heuristic_flags": {
       "type": "array",
       "items": {
        "type": "string"
       }
      },
      "malware_families": {
       "type": "array",
       "items": {
        "type": "string"
       }
      },
      "blacklisted_surbl": {
       "type": "boolean"
      },
      "urlhaus_reference": {
       "type": [
        "string",
        "null"
       ],
       "description": "URLhaus entry link when the URL is listed"
      },
      "threat_classification": {
       "type": "string"
      }
     }
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "url": "https://example.com/page",
  "grade": "A",
  "score": 100,
  "findings": [],
  "confidence": "none",
  "in_urlhaus": false,
  "threat_type": null,
  "urlhaus_status": null,
  "blacklisted_gsb": false,
  "heuristic_flags": [],
  "malware_families": [],
  "blacklisted_surbl": false,
  "urlhaus_reference": null,
  "threat_classification": "clean"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/netintel-url-safety-check-4121d96f/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from netintel.dev](https://www.zero.xyz/host/netintel.dev/llms.txt)