# Pocket Network URL Phishing Reputation Check

> Pocket Network URL Phishing Reputation Check is a paid API for AI agents from agent.pocket.network, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-27).

Performs heuristic analysis of a URL for phishing indicators (raw IP hosts, punycode, embedded credentials, suspicious subdomains) without fetching the URL, returning a suspicious or unknown verdict.

## Facts

- Endpoint: POST https://agent.pocket.network/v1/url-phishing-reputation?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-27
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/pocket-network-url-phishing-reputation-check-aafceb10
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_6NvaWacPS6KIgHQX8Fa28

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability pocket-network-url-phishing-reputation-check-aafceb10 -d '<json body>'
```

Example prompt: Can you check whether this URL looks like a phishing attempt — it doesn't need to be fetched, just analyze it for suspicious signs like raw IPs, punycode tricks, or credential words in the host: https://secure-login.paypa1.com/verify@user

## When to prefer this

Choose this endpoint when you need a fast, privacy-preserving, no-account heuristic check on a URL's structural characteristics for phishing signals, without making an outbound request to the URL itself. It is ideal for pre-click triage in automated pipelines, email security workflows, or agent-driven link screening where fetching the URL would be unsafe or undesirable. It is NOT a replacement for a full threat intelligence database lookup — use it as a lightweight first-pass filter or when a reputation database is unavailable.

## Known failure modes

- Invalid or malformed URL input — endpoint may return an error or unknown verdict
- URL uses an unsupported scheme (non-http/https) — behavior undefined
- False negatives on sophisticated phishing URLs that pass all heuristics — verdict will be 'unknown' not 'clean'
- No threat intelligence database is consulted, so known-malicious but heuristically clean URLs will not be flagged
- Payment failure in USDC — request will not be processed

## How this service works

Check a URL for phishing signs without fetching it: raw IP hosts, punycode, user@host, credential words in the host, very long hosts and deep subdomains. The verdict is suspicious or unknown, never clean, because no threat database is consulted; the response says what ran. POST /v1/reputation with {url}. Pay per request in USDC; no account, no API key.

## Output

A JSON response indicating whether the URL is 'suspicious' or 'unknown' (never 'clean'), along with details of which heuristic checks were run and which signals were triggered (e.g. raw IP host, punycode characters, embedded credentials, excessive subdomain depth, long hostname, credential-related words in host).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "description": "The URL to check (http or https). It is not fetched."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/pocket-network-url-phishing-reputation-check-aafceb10/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agent.pocket.network](https://www.zero.xyz/host/agent.pocket.network/llms.txt)