# Tanod chainpeek URL Phishing/Scam Screener

> Tanod chainpeek URL Phishing/Scam Screener is a paid API for AI agents from tanod.dev, paid per call via x402, $0.001/call, status unknown (last checked 2026-10-13).

Screens a URL, host, or domain against public phishing and scam domain blocklists without fetching the target URL.

## Facts

- Endpoint: POST https://tanod.dev/v1/check/url?utm_source=zero.xyz
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/tanod-chainpeek-url-phishing-scam-screener-5a852756
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_M5GCcVoJmRW-ZzWH5F1YR

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability tanod-chainpeek-url-phishing-scam-screener-5a852756 -d '<json body>'
```

Example prompt: Can you check if 'https://login-paypa1.example/verify' is on any phishing or scam blocklists? I received it in an email and want to know if it's been reported as malicious before I click anything.

## When to prefer this

Use this endpoint when you need a fast, passive blocklist lookup for a URL or domain without fetching the target — ideal for high-volume screening pipelines, phishing triage in email/chat workflows, or pre-click safety checks. Prefer this over active scanning endpoints when you must not contact the suspicious site. Best for catching known, publicly reported phishing domains rather than zero-day or targeted attacks.

## Known failure modes

- Neither url nor domain provided — returns error or null result
- URL exceeds 2048 character limit — rejected by schema validation
- Domain is too new to appear on any blocklist (false negative — not listed but still malicious)
- Stale list entry — domain may no longer be active phishing but still appears as listed
- Private/intranet hostnames may return no meaningful result

## How this service works

One MCP server and HTTP API with 193 pay-per-call tools for AI agents (security checks, chain data, finance, aviation, documents), plus free uptime and MikroTik monitoring and 130+ free browser tools. No signup; free daily tier. Operated by an AI.

## Output

Returns a JSON object indicating whether the host is listed on public phishing/scam blocklists, which sources flagged it, the matched domain, when the lists were last updated, a shared_platform flag, and a disclaimer explaining the limitations of blocklist-based screening. If not listed, sources is an empty array and matched_domain is null.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "anyOf": [
    {
     "type": "string",
     "maxLength": 2048,
     "minLength": 1
    },
    {
     "type": "null"
    }
   ],
   "default": null,
   "description": "URL, host or domain to screen (at most 2,048 characters); only parsed, never fetched."
  },
  "domain": {
   "anyOf": [
    {
     "type": "string",
     "maxLength": 2048,
     "minLength": 1
    },
    {
     "type": "null"
    }
   ],
   "default": null,
   "description": "Alternative to url: a domain or host name."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "host": "login-paypa1.example",
  "input": "https://login-paypa1.example/verify",
  "listed": false,
  "sources": [],
  "disclaimer": "Screening aid only: checks the host against public phishing/scam domain lists (see sources). Absence from these lists is not proof that a site is safe: new, targeted or unreported phishing is not on any list yet. Presence means the domain was reported/verified as phishing by the listed source at some point; lists can contain stale or mistaken entries. Combine with other checks; not legal or security advice.",
  "matched_domain": null,
  "list_updated_at": "2026-10-08T03:16:46Z",
  "shared_platform": false
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/tanod-chainpeek-url-phishing-scam-screener-5a852756/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from tanod.dev](https://www.zero.xyz/host/tanod.dev/llms.txt)