# RelayShield Scamkit Fingerprint API

> RelayShield Scamkit Fingerprint API is a paid API for AI agents from api.relayshield.net, paid per call via x402, $0.5/call, status unknown (last checked 2026-10-31).

Fingerprints a phishing or scam kit by URL or HTML, returning a verdict, confidence score, kit family, and sighting count against a threat intelligence database of 725K+ indicators.

## Facts

- Endpoint: POST https://api.relayshield.net/v1/payg/scamkit-fingerprint?utm_source=zero.xyz
- Price: $0.5/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-31
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/relayshield-scamkit-fingerprint-api-afe01a23
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_A0jReHthNtPxZUPWtdxCs

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability relayshield-scamkit-fingerprint-api-afe01a23 -d '<json body>'
```

Example prompt: Can you fingerprint this suspicious URL — https://track-parcel-update.eu/verify — to check if it's a known phishing or smishing kit, and tell me what kit family it belongs to and how many times it's been spotted?

## When to prefer this

Use this endpoint when you need to classify a specific URL or HTML blob as a known phishing or scam kit with a confidence score and family attribution. It is purpose-built for scam kit fingerprinting backed by 725K+ threat indicators across 129 marketplaces, making it more specialized than generic URL reputation or safe-browsing APIs. Prefer this over domain reputation lookups when you need kit-level attribution (family name, sighting count, fingerprint ID) rather than just a malicious/benign verdict.

## Known failure modes

- URL is unreachable or returns non-HTML content — static fetch only, no JS rendering in v1
- JS-heavy kits may not be fully analyzed via URL fetch; caller should submit rendered HTML instead
- Unknown or novel kits return low confidence scores with no kit_family match
- Invalid or malformed URL/HTML input returns a 400 error
- Rate limits or payment failures via x402 protocol return 402 errors

## How this service works

Identity security, threat monitoring and intelligence for the agentic AI era. TAP verifier for agentic commerce, MCP Proxy Firewall for AI agents, and threat intelligence APIs backed by 725K indicators across 129 monitored marketplaces.

## Output

Returns a JSON object with: ok (boolean), verdict (e.g. 'known_kit', 'unknown'), confidence score (0–1), kit_family name, family_status (e.g. 'suggested'), a unique fingerprint_id, and sightings_count indicating how many times the kit has been observed across monitored marketplaces.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "description": "Live URL to fingerprint (static HTML fetch only in v1 — no JS rendering)"
  },
  "html": {
   "type": "string",
   "description": "Caller-supplied kit HTML (alternative to url; submit rendered HTML for JS-heavy kits)"
  },
  "source": {
   "type": "string",
   "description": "Optional caller tag for the sighting"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "data": {
   "verdict": "known_kit",
   "confidence": 0.92,
   "kit_family": "parcel-smish-eu-04",
   "family_status": "suggested",
   "fingerprint_id": "kit_9f2c4a1b3d5e6f708192a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e7f8",
   "sightings_count": 7
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/relayshield-scamkit-fingerprint-api-afe01a23/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.relayshield.net](https://www.zero.xyz/host/api.relayshield.net/llms.txt)