{"api":"url-screen","description":"Phishing / malicious-URL screening: a bundled URLhaus blocklist snapshot plus deterministic live heuristics. Verdicts are signals, never a safety guarantee.","checks":[{"id":"urlhaus_match","description":"Exact-URL match against the URLhaus snapshot, or a match on the URL's host. A host match on curated shared hosting (GitHub, Google Drive, IPFS gateways) is reported as information and never as a malicious verdict."},{"id":"punycode_homograph","description":"Punycode (xn--) labels and mixed-script hosts that can impersonate a Latin brand."},{"id":"brand_lookalike","description":"Typosquat/lookalike of ~150 high-value brands: embedded domain, the brand label as a hyphen token (login-paypal.com), the exact brand label on another TLD, hyphenation, character substitution, edit-distance."},{"id":"url_shape","description":"Structural red flags: IP-literal host, embedded credentials, @-obfuscation, deep subdomains, abused TLDs, URL shorteners. Graded — a deliberately-constructed flag lifts the verdict alone; a weak one needs corroboration."},{"id":"redirect_chain","description":"Optional (?follow=1): follows up to 5 SSRF-guarded redirects, re-screening each hop."}],"verdicts":["MALICIOUS_LISTED","SUSPICIOUS_PATTERNS","NO_KNOWN_SIGNALS"],"urlhaus_snapshot":{"source":"abuse.ch URLhaus (online URLs), CC0","generated_at":"2026-10-03T04:06:18.180Z","count":13401,"age_days":0,"status":"ok"},"blocklist_checked":true,"heuristics":["punycode/homograph","brand lookalike / typosquat","url shape","redirect chain (opt-in)"],"limitations":["The URLhaus snapshot is NOT realtime — freshly-registered phishing may be absent.","Google Safe Browsing and OpenPhish are intentionally NOT consulted (their ToS forbid this kind of resale).","Domain age / WHOIS is not checked here — see the /domain-intel API.","No live page-content or malware analysis; nothing is rendered or downloaded (except opt-in redirect HEADs).","NO_KNOWN_SIGNALS is NOT a statement that a URL is safe.","URLhaus publishes URLs; the host index is derived by us. A host match therefore means a NEIGHBOUR was listed, and on shared hosting it says nothing about the URL you asked about — check evidence[].data.code, not just the verdict.","If the blocklist snapshot cannot be loaded, /screen returns an unsettled 503 rather than a verdict — an unscreened URL is never reported as carrying no known signals."],"pricing":"Quoted in this endpoint's 402 challenge; GET /.well-known/x402 prices the whole origin in one free call."}