Phishing URL Heuristics
Score a URL for phishing patterns: homoglyph/IDN look-alikes, brand tokens in subdomains, IP-literal hosts, @-tricks, excessive length/hyphens/depth, high-abuse TLDs, punycode and non-standard ports. Pure analysis of the string itself — the pre-click check for links from emails, QR codes or chat.
Worked examples
Classic brand-impersonation
GET /api/v1/security/phishing-heuristics?url=http%3A%2F%2Fsecure-paypal.login-verify.tk%2Faccount%2Fupdate
Result: 55/100 — SUSPICIOUS — multiple phishing indicators
@-trick + IP host
GET /api/v1/security/phishing-heuristics?url=http%3A%2F%2Fgithub.com%40203.0.113.5%3A8443%2Flogin
Result: 80/100 — HIGH RISK — almost certainly phishing
A legitimate site
GET /api/v1/security/phishing-heuristics?url=https%3A%2F%2Fgithub.com%2Fagents
Result: 0/100 — CLEAN — no phishing heuristics matched
Machine API (x402)
$0.01 / callThis tool is also a JSON API for AI agents. Requests without payment receive 402 Payment Required plus instructions; agents pay USDC on Base via the x402 protocol — no accounts, no API keys.
GET /api/v1/security/phishing-heuristics?url=http%3A%2F%2Fsecure-paypal.login-verify.tk%2Faccount%2Fupdate HTTP/1.1
Host: agentstoolshub.com
→ 402 (payment required, instructions in headers)
→ 200 (after X-PAYMENT header; JSON body below)
{
"tool": "security/phishing-heuristics",
"input": {"url":"http://secure-paypal.login-verify.tk/account/update"},
"result": { "value": 55, "answer": "55/100 — SUSPICIOUS — multiple phishing indicators" }
}Agent docs: /llms.txt · OpenAPI spec · integration guide
About this tool
Weights a URL against the phishing patterns that actually fool people: Cyrillic homoglyphs, brand names hiding in subdomains, @-tricks, raw-IP hosts, punycode, high-abuse TLDs and credential-bait keywords — scored 0–100 with every trigger explained. Pure string analysis, instant, no lookup needed.
Frequently asked questions
Can this prove a URL is safe?
No — it's a pre-click filter, not a verdict. A clean score means no known pattern matched; pair it with ssl-inspector and whois-lookup for high-stakes decisions, and treat new domains with extra suspicion.
Why does github.com.evil.tk score higher than evil.github.com?
Only the registrable domain (the last two labels) is controlled by the owner. Brand tokens elsewhere in the host are the classic impersonation trick — that's the single strongest signal here.