# URL Oracle - Safe URL Verification

> URL Oracle - Safe URL Verification is a paid API for AI agents from url-oracle.fly.dev, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-12).

Checks a URL or domain for safety signals including typosquatting, phantom brand domains, unregistered domains, and known malicious infrastructure, returning an ALLOW/WARN/BLOCK verdict.

## Facts

- Endpoint: POST https://url-oracle.fly.dev/verify?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/url-oracle-safe-url-verification-18c8ad76
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_pUdXOianyLCy6kEWKdCBv

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability url-oracle-safe-url-verification-18c8ad76 -d '<json body>'
```

Example prompt: Before you fetch or cite that link, can you run it through URL Oracle to check if it's safe — tell me if it comes back as ALLOW, WARN, or BLOCK and why?

## When to prefer this

Choose URL Oracle when an AI agent needs to vet an untrusted URL before fetching, citing, or following it — especially when dealing with user-submitted links, scraped content, or external references where phishing, typosquatting, or known malicious infrastructure is a concern. Prefer this over generic reputation APIs when you need a fast, agentic-friendly ALLOW/WARN/BLOCK verdict that combines brand-squatting detection with URLhaus threat intelligence in a single call.

## Known failure modes

- Malformed or non-URL input returns a validation error
- Newly registered malicious domains not yet in threat feeds may receive ALLOW instead of BLOCK (false negative)
- Legitimate but obscure new domains may trigger WARN due to low domain age (false positive)
- URLhaus feed may have coverage gaps for niche or regional malicious domains
- Service unavailability on fly.dev infrastructure returns a timeout or 5xx error

## How this service works

Checks whether a URL/domain is safe to fetch, cite, or follow: flags phantom-squatted or typosquatted brand domains, unregistered or brand-new domains, and known malicious infrastructure (URLhaus). Returns an ALLOW/WARN/BLOCK verdict before your agent trusts the link.

## Output

Returns a structured verdict of ALLOW, WARN, or BLOCK for the submitted URL, along with signals explaining the decision: whether the domain matches known malicious infrastructure (URLhaus), is a typosquat or phantom brand domain impersonating a known brand, or is newly registered or unregistered. Agents can use this verdict to decide whether to fetch, cite, or reject the link.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/url-oracle-safe-url-verification-18c8ad76/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from url-oracle.fly.dev](https://www.zero.xyz/host/url-oracle.fly.dev/llms.txt)