URL reputation (URLhaus + OpenPhish + heuristics) API

Returns a malicious/suspicious/clean verdict and 0-100 risk score for a URL by joining abuse.ch URLhaus and OpenPhish threat feeds with structural red flags (risky TLD, raw-IP host, punycode, '@' obfuscation, deep subdomains). Answers 'is this URL malicious', 'phishing check for this link', 'reputation of this URL', 'is this link safe to click'.

Price$0.01per request

MethodPOST

Route/v1/security/url-reputation

StatusLive

MIME typeapplication/json

Rate limit60/minute

Cache3600s public

securityurlreputationphishingmalwareurlhausopenphishthreat

API URLhttps://x402.hexl.dev/v1/security/url-reputation

Integration docs

Example request

{
  "url": "http://login-verify.example.tk/account"
}

Example response

{
  "url": "http://login-verify.example.tk/account",
  "host": "login-verify.example.tk",
  "tld": "tk",
  "score": 25,
  "verdict": "clean",
  "inUrlhaus": false,
  "inOpenphish": false,
  "signals": [
    "High-abuse TLD '.tk'.",
    "Phishing-associated keyword in path."
  ]
}

Input schema

{
  "type": "object",
  "required": [
    "url"
  ],
  "properties": {
    "url": {
      "type": "string",
      "examples": [
        "http://login-verify.example.tk/account"
      ]
    }
  }
}

Output schema

{
  "type": "object",
  "additionalProperties": true
}