# URL Risk Heuristic Analyzer

> URL Risk Heuristic Analyzer is a paid API for AI agents from 402.com.tr, paid per call via x402, $0.002/call, status unknown (last checked 2026-09-14).

Performs heuristic risk analysis on a URL and returns a GO/HOLD/STOP verdict with reasons based on structural signals like scheme, IP hosts, deep subdomains, credential-themed labels, and sensitive paths.

## Facts

- Endpoint: GET https://402.com.tr/api/x402/url-risk
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/url-risk-heuristic-analyzer-f9958c24
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_knrMWbzY-xB9_-JSkHkGd

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability url-risk-heuristic-analyzer-f9958c24
```

Example prompt: Can you check if this URL looks risky — https://secure-login.paypa1.accounts.verify-now.com/reset?token=abc123 — and flag it against the expected brand paypal.com?

## When to prefer this

Use this endpoint when you need a fast, cheap, structural pre-screen of a URL before exposing it to users, redirecting traffic, or whitelisting it in a system — especially when you want explainable reasons rather than a black-box score. Prefer this over Safe Browsing or malware scanning APIs when you need real-time heuristics without external network calls, or when you want to detect phishing by URL shape (credential labels, deep subdomains, IP hosts) rather than known blocklists. Ideal for agent pipelines that process untrusted user-submitted URLs at scale.

## Known failure modes

- Missing required 'url' query parameter returns validation error
- Malformed or non-parseable URL may return HOLD or error
- No malware or Safe Browsing database is consulted — a clean verdict does not guarantee the URL is safe
- Brand lookalike check only fires when 'brand' parameter is supplied
- Does not perform DNS resolution or live content fetching — purely structural analysis

## How this service works

Heuristic URL risk: scheme, IP hosts, deep subdomains, credential-themed labels, sensitive paths/params, optional brand= lookalike. Returns reasons + GO/HOLD/STOP. Not a malware or Safe Browsing scan.

## Output

Returns a structured object containing a risk verdict (GO, HOLD, or STOP), a list of human-readable reasons explaining which heuristic signals were triggered (e.g. IP-based host, deep subdomains, credential-themed path segments, suspicious query parameter names), and optional brand lookalike analysis if a brand host was provided.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "pathParams": {
     "type": "object"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "url"
     ],
     "properties": {
      "url": {
       "type": "string",
       "description": "URL"
      },
      "brand": {
       "type": "string",
       "description": "Expected brand host (optional)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/url-risk-heuristic-analyzer-f9958c24/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 402.com.tr](https://www.zero.xyz/host/402.com.tr/llms.txt)