ToolAssay

Check a URL against URLhaus malware database and heuristic phishing pattern anal

Check a URL against URLhaus malware database and heuristic phishing pattern analysis — returns threat classification, malware family if known, threat confidence, and risk score so agents can screen links before following them or sharing them in automated workflows.

Answeringour last check, 2026-09-24
1 of 1checks answered this week
905 msmedian answer time
$0.01listed price per call
$0.01price it asked us

Paid test badge: not yet. The checks above are free: we call the tool without paying and read the payment request it sends back. The Verified badge needs paid calls whose answers match the promised output, and nobody can buy a badge.

Endpoint

GET https://netintel.dev/url-safety/check

CategoryEverything else
Provider hostnetintel.dev
Networkseip155:8453, solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp
Payment schemesexact
Self-reported calls, 30 days2 from 1 payers (the provider's figure, not ours)

Our checks, last 30 days

DayResultHTTPAskedTime
2026-09-24 valid payment request 402$0.01 905 ms

Example input (from the provider)

{
  "method": "GET",
  "queryParams": {
    "url": "https://example.com/page"
  },
  "type": "http"
}

Promised output schema (from the provider)

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "properties": {
    "input": {
      "additionalProperties": false,
      "properties": {
        "method": {
          "enum": [
            "GET"
          ],
          "type": "string"
        },
        "queryParams": {
          "properties": {
            "url": {
              "description": "URL to check for malware and phishing indicators (e.g. https://example.com/page)",
              "type": "string"
            }
          },
          "required": [
            "url"
          ],
          "type": "object"
        },
        "type": {
          "const": "http",
          "type": "string"
        }
      },
      "required": [
        "type",
        "method"
      ],
      "type": "object"
    },
    "output": {
      "properties": {
        "example": {
          "properties": {
            "blacklisted_gsb": {
              "type": "boolean"
            },
            "blacklisted_surbl": {
              "type": "boolean"
            },
            "confidence": {
              "type": "string"
            },
            "findings": {
              "type": "array"
            },
            "grade": {
              "type": "string"
            },
            "heuristic_flags": {
              "items": {
                "type": "string"
              },
              "type": "array"
            },
            "in_urlhaus": {
              "type": "boolean"
            },
            "malware_families": {
              "items": {
                "type": "string"
              },
              "type": "array"
            },
            "score": {
              "type": "number"
            },
            "threat_classification": {
              "type": "string"
            },
            "threat_type": {
              "type": [
                "string",
                "null"
              ]
            },
            "url": {
              "type": "string"
            },
            "urlhaus_reference": {
              "description": "URLhaus entry link when the URL is listed",
              "type": [
                "string",
                "null"
              ]
            },
            "urlhaus_status": {
              "type": [
                "string",
                "null"
              ]
            }
          },
          "type": "object"
        },
        "type": {
          "type": "string"
        }
      },
      "required": [
        "type"
      ],
      "type": "object"
    }
  },
  "required": [
    "input"
  ],
  "type": "object"
}

This page as JSON