# URL Safety Check

> URL Safety Check is a paid API for AI agents from safe.cyberwarex.com, paid per call via x402, $0.003/call, status unknown (last checked 2026-09-14).

Scores a URL for phishing risk using deterministic heuristics, returning a 0-100 risk score, a SAFE/SUSPICIOUS/DANGEROUS verdict, and labelled reasons — no API key required.

## Facts

- Endpoint: GET https://safe.cyberwarex.com/check
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/url-safety-check-f074652c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_H60U21K9NIUHRjem67-n6

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability url-safety-check-f074652c
```

Example prompt: Before I open this link someone sent me — https://paypa1-secure.login-now.xyz/verify — can you check it for phishing risk and tell me if it's safe, suspicious, or dangerous?

## When to prefer this

Choose this endpoint when you need a fast, keyless, no-LLM phishing risk assessment of a URL before an agent or user opens it. Ideal for pre-flight link checks in agentic workflows, email triage, browser automation, or user-submitted URL validation. Prefer over general web-reputation APIs when you need deterministic, labelled heuristic signals (typosquatting, homoglyphs, punycode, credentials-in-URL, suspicious TLDs, domain age) without managing API credentials or paying per-seat subscription fees.

## Known failure modes

- Missing or malformed 'url' query parameter returns an error
- RDAP domain age lookup may fail for some TLDs, returning null for domain_age_days
- Heuristics may produce false positives for legitimate domains using unconventional naming
- Very new or obscure TLDs may not be recognized in suspicious-TLD lists
- Private/intranet URLs or bare IPs may yield incomplete signal coverage

## How this service works

Score a URL for phishing risk before an agent opens or trusts it. Keyless, deterministic heuristics - typosquat / homoglyph of a known brand, punycode / mixed-script hosts, credentials-in-URL, raw-IP hosts, suspicious TLDs, over-deep subdomains - plus a best-effort domain-age check (young domains are a top phishing signal). Returns a 0-100 risk score, a SAFE / SUSPICIOUS / DANGEROUS verdict, and labelled reasons. No API keys, no LLM.

## Output

Returns a JSON object containing: risk_score (0-100 integer, 0=clean), verdict (SAFE, SUSPICIOUS, or DANGEROUS), host, registrable_domain, labels (array of signal names), reasons (human-readable explanations), signals (raw signal object), and domain_age_days (integer or null from best-effort RDAP lookup).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "url"
     ],
     "properties": {
      "url": {
       "type": "string",
       "description": "The URL to check (a bare domain is accepted too)."
      }
     },
     "additionalProperties": false
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "url": {
       "type": "string"
      },
      "host": {
       "type": "string"
      },
      "labels": {
       "type": "array",
       "items": {
        "type": "string"
       }
      },
      "reasons": {
       "type": "array",
       "items": {
        "type": "string"
       }
      },
      "signals": {
       "type": "object"
      },
      "verdict": {
       "type": "string",
       "description": "SAFE | SUSPICIOUS | DANGEROUS."
      },
      "risk_score": {
       "type": "integer",
       "description": "0 (clean) to 100."
      },
      "domain_age_days": {
       "type": [
        "integer",
        "null"
       ],
       "description": "best-effort via RDAP."
      },
      "registrable_domain": {
       "type": "string"
      }
     }
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/url-safety-check-f074652c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from safe.cyberwarex.com](https://www.zero.xyz/host/safe.cyberwarex.com/llms.txt)