# SiteCheck Web Intel – PhishTank URL Check

> SiteCheck Web Intel – PhishTank URL Check is a paid API for AI agents from api.webintel-api.workers.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-24).

Looks up a URL in the PhishTank phishing database and returns whether it is a known phishing site, along with its phish ID, verification status, and validity if found.

## Facts

- Endpoint: GET https://api.webintel-api.workers.dev/api/security/phishtank-check?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-24
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitecheck-web-intel-phishtank-url-check-d71b4ba8
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_nU97NKIRNGxQzIJmJzEhI

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitecheck-web-intel-phishtank-url-check-d71b4ba8
```

Example prompt: Can you check if https://paypal-login-secure.example.com is a known phishing URL by looking it up in PhishTank?

## When to prefer this

Use this endpoint when you need a fast, real-time lookup of a specific URL against the PhishTank community-curated phishing database. Best for single-URL triage, pre-click safety checks, or enriching security workflows with phishing signals. Prefer this over full web scanning when you only need PhishTank's known-phishing verdict without broader threat intelligence.

## Known failure modes

- URL not found in PhishTank (does not indicate safety, just no record)
- Malformed or non-HTTP/HTTPS URL returns an error
- PhishTank API unavailability causes lookup failure
- Exact-match only — URL variations or subpaths are not matched
- Rate limits or upstream PhishTank outages may cause timeouts

## How this service works

Looks one http or https URL up in the PhishTank phishing database (live checkurl lookup, no key). Returns whether PhishTank has the URL and, if so, its phish id, verification flag and validity. Absence means PhishTank has no record of this exact URL, not that it is safe.

## Output

Returns whether PhishTank has a record of the exact URL, and if so: its phish ID, whether it has been verified by the community, and whether it is currently considered valid/active phishing. Absence of a record means PhishTank has no entry for that URL, not that the URL is safe.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "url"
     ],
     "properties": {
      "url": {
       "type": "string",
       "description": "Full http or https URL to check (required)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitecheck-web-intel-phishtank-url-check-d71b4ba8/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.webintel-api.workers.dev](https://www.zero.xyz/host/api.webintel-api.workers.dev/llms.txt)