# RelayShield Campaign Scan

> RelayShield Campaign Scan is a paid API for AI agents from api.relayshield.net, paid per call via x402, $5.5/call, status unknown (last checked 2026-10-27).

Scans a batch of URLs, emails, phones, domains, wallets, and file URLs against 725K threat indicators to assess phishing/smishing campaign risk and identify kit families

## Facts

- Endpoint: POST https://api.relayshield.net/v1/payg/campaign-scan?utm_source=zero.xyz
- Price: $5.5/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-27
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/relayshield-campaign-scan-3b261a4d
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_en76DiTNfLcDM6_lKSZmt

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability relayshield-campaign-scan-3b261a4d -d '<json body>'
```

Example prompt: Can you scan these indicators for me — URLs like https://parcel-track.eu/xyz, the email alerts@parcel-notif.com, phone +441234567890, and domain parcel-notif.com — and tell me if they belong to any known phishing kit family and what the aggregate risk score is? Label it 'EU Parcel Smishing Check'.

## When to prefer this

Use this endpoint when you need to scan multiple heterogeneous indicators (URLs, emails, phones, domains, wallets) as a unified campaign in a single call and get a risk score plus kit family attribution. Prefer this over single-indicator lookups when assessing coordinated phishing or smishing campaigns, or when you need dark web marketplace-backed threat intelligence across 129 monitored sources.

## Known failure modes

- Empty or invalid indicator arrays may return a scan with zero indicators and no kit families
- Unresolvable file URLs may be skipped or return partial results
- Malformed email/phone/domain formats may not match against indicators
- Rate limits or payment failures return non-200 HTTP errors
- Indicators not in the 725K database return low/zero risk scores even if malicious

## How this service works

Identity security, threat monitoring and intelligence for the agentic AI era. TAP verifier for agentic commerce, MCP Proxy Firewall for AI agents, and threat intelligence APIs backed by 725K indicators across 129 monitored marketplaces.

## Output

Returns a JSON object with a campaign ID, a list of identified phishing/smishing kit family names, an aggregate risk score (0-100), and the count of indicators scanned. A higher aggregate risk score indicates greater threat likelihood.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "urls": {
   "type": "array",
   "items": {
    "type": "string"
   }
  },
  "emails": {
   "type": "array",
   "items": {
    "type": "string"
   }
  },
  "phones": {
   "type": "array",
   "items": {
    "type": "string"
   }
  },
  "domains": {
   "type": "array",
   "items": {
    "type": "string"
   }
  },
  "wallets": {
   "type": "array",
   "items": {
    "type": "string"
   }
  },
  "file_urls": {
   "type": "array",
   "items": {
    "type": "string"
   }
  },
  "campaign_name": {
   "type": "string",
   "description": "Optional label for the campaign"
  },
  "fingerprint_ids": {
   "type": "array",
   "items": {
    "type": "string"
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "data": {
   "campaign_id": "cmp_1a2b3c4d5e6f708192a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e7f8",
   "kit_families": [
    "parcel-smish-eu-04"
   ],
   "aggregate_risk": 72,
   "indicators_scanned": 2
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/relayshield-campaign-scan-3b261a4d/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.relayshield.net](https://www.zero.xyz/host/api.relayshield.net/llms.txt)