# Vextorium Malicious URL Checker (URLhaus)

> Vextorium Malicious URL Checker (URLhaus) is a paid API for AI agents from api.vextorium.com, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-19).

Checks whether a URL or domain is listed in abuse.ch URLhaus as a malware distribution site within the last 30 days, returning threat type, online/offline status, exact match, and other malicious URLs on the same host.

## Facts

- Endpoint: POST https://api.vextorium.com/v1/malicious-url?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-19
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/vextorium-malicious-url-checker-urlhaus-15fc4a28
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_2_Ylu8qeDSAH9m5YX7teb

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability vextorium-malicious-url-checker-urlhaus-15fc4a28 -d '<json body>'
```

Example prompt: Before you fetch that link, can you check if https://suspicious-download.xyz/payload.zip is listed in URLhaus as a malware distribution site and tell me if it's currently online?

## When to prefer this

Choose this endpoint when an AI agent needs to pre-screen a URL or domain for known malware distribution before fetching, visiting, or processing it. It is specifically backed by abuse.ch URLhaus, which is the leading community-curated malware URL database, making it ideal for cybersecurity automation, email link triage, and safe browsing workflows. Prefer this over generic reputation APIs when you need malware-specific threat intelligence with online/offline status and host-level context.

## Known failure modes

- URL not found in URLhaus returns listed:false with verdict 'not listed' — not an error
- Malformed or non-URL string input may return an error or empty result
- URLhaus database may be up to ~1 hour stale relative to real-time threats
- Only covers the last 30 days of URLhaus data — older malware campaigns not included
- Domain-only input without scheme may yield no exact_match but still show malicious_urls_on_host

## How this service works

558 pay-per-call data APIs for AI agents: Solana and EVM on-chain data, tokenized stocks, DeFi, Hyperliquid, economy and official statistics, FX, validation, web and developer tools. Pay in USDC via x402.

## Output

Returns a JSON object with: whether the URL is listed (boolean), a verdict string, the queried URL and host, the exact URLhaus match (if any), number of malicious URLs on the same host, how many are currently online, threat examples, and URLhaus database metadata (total URL count and last updated timestamp).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "host": "example.com",
  "query": "https://example.com",
  "listed": false,
  "source": "abuse.ch URLhaus (CC0), URLs from the last 30 days",
  "verdict": "not listed",
  "database": {
   "urls": 15473,
   "updated": "2026-10-03T00:59:28+00:00"
  },
  "examples": [],
  "online_now": 0,
  "exact_match": null,
  "malicious_urls_on_host": 0
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/vextorium-malicious-url-checker-urlhaus-15fc4a28/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.vextorium.com](https://www.zero.xyz/host/api.vextorium.com/llms.txt)