# SiteCheck Web Intel – OpenPhish Feed Lookup

> SiteCheck Web Intel – OpenPhish Feed Lookup is a paid API for AI agents from api.webintel-api.workers.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-25).

Checks whether a given URL or hostname appears in the OpenPhish public phishing feed

## Facts

- Endpoint: GET https://api.webintel-api.workers.dev/api/security/openphish-feed?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-25
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitecheck-web-intel-openphish-feed-lookup-008cef2e
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_7nPZdCHvOZKKHXyOpeP35

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitecheck-web-intel-openphish-feed-lookup-008cef2e
```

Example prompt: Can you check if https://suspicious-login.example.com is listed in the OpenPhish phishing feed?

## When to prefer this

Use this endpoint when you need a fast, no-signup, pay-per-call check against the OpenPhish public phishing feed for a specific URL or hostname. It is ideal for lightweight phishing triage in automated pipelines, email security bots, or incident response workflows where you want to cross-reference a suspect URL without setting up an API key. Prefer this over full-featured threat intel platforms when cost-per-call simplicity and x402 micropayment support matter, and when OpenPhish feed coverage is sufficient for your use case.

## Known failure modes

- Missing or invalid 'url' query parameter returns an error
- Non-HTTP/HTTPS URL schemes may be rejected
- Feed may be temporarily unavailable if GitHub raw content is unreachable
- Very new phishing URLs may not yet be in the feed (feed update latency)
- Subdomain vs root domain matching may affect results if the exact URL path differs

## How this service works

Checks a URL or host against the OpenPhish public phishing feed (about 300 currently active phishing URLs, updated continuously). Returns whether the exact URL or any URL on the same host is listed, the feed size and up to 5 example URLs. Not listed does not mean safe; the feed is short and changes fast.

## Output

Returns a JSON object indicating whether the queried URL or host was found in the OpenPhish feed, including: listed (boolean), exactMatch (boolean), host extracted from the query, urlsOnHost (array of matching phishing URLs on that host), feedSize (total number of URLs in the feed), sampleUrls (a few example phishing URLs from the feed for reference), source URL of the feed, and a checkedAt timestamp.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "url"
     ],
     "properties": {
      "url": {
       "type": "string",
       "description": "A full http or https URL, or a host name such as example.com (required)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "host": "xunqelo-mpt-favzari-h4d8me63.pages.dev",
  "query": "http://xunqelo-mpt-favzari-h4d8me63.pages.dev/",
  "listed": false,
  "source": "https://raw.githubusercontent.com/openphish/public_feed/refs/heads/main/feed.txt",
  "feedSize": 300,
  "checkedAt": "2026-10-23T09:38:36.495Z",
  "exactMatch": false,
  "sampleUrls": [
   "https://system-update-account-ilpro.vercel.app/account-center-support",
   "https://www.roblox.com.et/users/1654175985/profile"
  ],
  "urlsOnHost": []
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitecheck-web-intel-openphish-feed-lookup-008cef2e/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.webintel-api.workers.dev](https://www.zero.xyz/host/api.webintel-api.workers.dev/llms.txt)