Score a URL for phishing risk before an agent opens or trusts it
Score a URL for phishing risk before an agent opens or trusts it. Keyless, deterministic heuristics - typosquat / homoglyph of a known brand, punycode / mixed-script hosts, credentials-in-URL, raw-IP hosts, suspicious TLDs, over-deep subdomains - plus a best-effort domain-age check (young domains are a top phishing signal). Returns a 0-100 risk score, a SAFE / SUSPICIOUS / DANGEROUS verdict, and labelled reasons. No API keys, no LLM.
3000 (raw units)
price
16
calls / 30d
2
unique payers
2026-09-18
updated
Provider
safe.cyberwarex.com · discovered, not yet claimed by its owner
Payment (x402 accepts[])
[
{
"scheme": "exact",
"network": "eip155:8453",
"payTo": "0x058D0Cc5CC97e61e8A9f38D6d6365bce525921B2",
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"amount": "3000",
"maxTimeoutSeconds": 300
}
]Output schema
{
"bazaar": {
"info": {
"input": {
"method": "GET",
"queryParams": {
"url": "https://coinbase.com.secure-login.xyz/verify"
},
"type": "http"
},
"output": {
"example": {
"domain_age_days": 4,
"host": "coinbase.com.secure-login.xyz",
"labels": [
"brand_impersonation",
"suspicious_tld"
],
"reasons": [
"'coinbase' appears in the host but the domain is secure-login.xyz, not coinbase.com"
],
"registrable_domain": "secure-login.xyz",
"risk_score": 80,
"source": "heuristics + RDAP",
"url": "https://coinbase.com.secure-login.xyz/verify",
"verdict": "DANGEROUS"
},
"type": "json"
}
},
"schema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"input": {
"additionalProperties": false,
"properties": {
"method": {
"enum": [
"GET",
"HEAD",
"DELETE"
],
"type": "string"
},
"queryParams": {
"additionalProperties": false,
"properties": {
"url": {
"description": "The URL to check (a bare domain is accepted too).",
"type": "string"
}
},
"required": [
"url"
],
"type": "object"
},
"type": {
"const": "http",
"type": "string"
}
},
"required": [
"type",
"method"
],
"type": "object"
},
"output": {
"properties": {
"example": {
"properties": {
"domain_age_days": {
"description": "best-effort via RDAP.",
"type": [
"integer",
"null"
]
},
"host": {
"type": "string"
},
"labels": {
"items": {
"type": "string"
},
"type": "array"
},
"reasons": {
"items": {
"type": "string"
},
"type": "array"
},
"registrable_domain": {
"type": "string"
},
"risk_score": {
"description": "0 (clean) to 100.",
"type": "integer"
},
"signals": {
"type": "object"
},
"url": {
"type": "string"
},
"verdict": {
"description": "SAFE | SUSPICIOUS | DANGEROUS.",
"type": "string"
}
},
"type": "object"
},
"type": {
"type": "string"
}
},
"required": [
"type"
],
"type": "object"
}
},
"required": [
"input"
],
"type": "object"
}
}
}Use it
curl
curl "https://safe.cyberwarex.com/check" # -> 402 Payment Required, accepts[] lists how to pay # retry with a PAYMENT-SIGNATURE (or PAYMENT header) once paid
JavaScript
const res = await fetch("https://safe.cyberwarex.com/check");
if (res.status === 402) {
const { accepts } = await res.json();
// pay one of accepts[] via an x402 client, then retry with the payment header
}Python
import httpx
res = httpx.get("https://safe.cyberwarex.com/check")
if res.status_code == 402:
accepts = res.json()["accepts"]
# pay one of accepts[] via an x402 client, then retry with the payment headerMachine-readable
Everything on this page is also available as clean JSON at /resources/6837.json, and this resource appears in /discovery/resources and /discovery/search.