{"api":"v1","generated_at":"2026-09-15T22:57:20.273Z","licence":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/","attribution":"TOLL, with a link to the page cited"},"page":"https://tollindex.com/e/agentbit-app-v1-security-url-threat-3f0867","pinned_page":"https://tollindex.com/e/agentbit-app-v1-security-url-threat-3f0867/at/2026-09-15T21-20Z","pinned":false,"method":"https://tollindex.com/ledger/method","snapshot_at":"2026-09-15T21:20:12.737Z","snapshot_stamp":"2026-09-15T21-20Z","endpoint":{"slug":"agentbit-app-v1-security-url-threat-3f0867","canonical_url":"https://agentbit.app/v1/security/url-threat","resource":"https://agentbit.app/v1/security/url-threat","http_method":"POST","type":"http","x402_version":2,"registries":["cdp"],"primary_registry":"cdp","curated_by_coinbase":false,"description":"Screen a URL before your agent follows it: phishing-pattern heuristics (IP-literal hosts, punycode, credentials in the URL, shorteners, deep subdomain nesting), a safe server-side redirect trace with cross-host detection, and an optional URLhaus malware-database lookup. Returns a 0-100 risk score with named flags. Honest scope: heuristics + public threat data, not a sandbox.","service_name":null,"declared_category":null,"declared_tags":[],"route_template":null,"registry_updated":"2026-09-06T13:16:27.120Z"},"derived":{"note":"fields no registry supplies; TOLL derives them and marks them derived on the page","title":"security url threat","category":"compute","first_observed_by_toll":"2026-09-10T19:08:24.178Z","last_observed_by_toll":"2026-09-15T21:20:12.737Z","observation_began":"2026-09-10"},"presence":{"listed_now":true,"first_absent_at":null,"delisting_confirmed_at":null,"events":[{"registry":"cdp","at":"2026-09-10T19:08:24.178Z","event":"listed"}]},"accepts":[{"registry":"cdp","ordinal":0,"network":"eip155:8453","asset":"0x833589fcd6edb6e08f4c7c32d4f71b54bda02913","asset_name":"USD Coin","symbol":"USDC","decimals":6,"amount_display":"0.01 USDC","amount_units":0.01,"decimals_known":true,"pay_to":"0x4395C7e383b7e05665aad7f36ed77c01923Dd965","scheme":"exact"}],"counters":{"observed_at":"2026-09-15T21:20:12.737Z","calls_30d":1,"unique_payers_30d":1,"last_called_at":"2026-09-06T13:16:26.622Z"},"validation":{"latest":{"observed_at":"2026-09-15T04:32:04.361Z","state":"pass","failed_checks":[],"endpoint_http_status":402,"run_id":"daily-2026-09-15"},"uptime":[{"days":7,"observed":5,"passed":5,"ratio":1},{"days":30,"observed":5,"passed":5,"ratio":1},{"days":90,"observed":5,"passed":5,"ratio":1}],"history_90d":[{"observed_at":"2026-09-15T04:32:04.361Z","state":"pass","failed_checks":[],"run_id":"daily-2026-09-15","state_changed":false},{"observed_at":"2026-09-14T04:28:25.222Z","state":"pass","failed_checks":[],"run_id":"daily-2026-09-14","state_changed":false},{"observed_at":"2026-09-13T04:27:04.481Z","state":"pass","failed_checks":[],"run_id":"daily-2026-09-13","state_changed":false},{"observed_at":"2026-09-12T06:42:47.362Z","state":"pass","failed_checks":[],"run_id":"daily-2026-09-12","state_changed":false},{"observed_at":"2026-09-11T10:14:46.680Z","state":"pass","failed_checks":[],"run_id":"daily-2026-09-11","state_changed":true}]},"seller":{"wallet":"0x4395C7e383b7e05665aad7f36ed77c01923Dd965","page":"https://tollindex.com/seller/0x4395C7e383b7e05665aad7f36ed77c01923Dd965","endpoints":36,"hosts":1},"reports":0,"registry_record":{"cdp":[{"type":"http","accepts":[{"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"name":"USD Coin","version":"2"},"payTo":"0x4395C7e383b7e05665aad7f36ed77c01923Dd965","amount":"10000","scheme":"exact","network":"eip155:8453","maxTimeoutSeconds":300}],"quality":{"lastCalledAt":"2026-09-06T13:16:26.622Z","l30DaysTotalCalls":1,"l30DaysUniquePayers":1},"resource":"https://agentbit.app/v1/security/url-threat","extensions":{"bazaar":{"info":{"input":{"body":{"url":"https://bit.ly/3example"},"type":"http","method":"POST","bodyType":"json"},"errors":[{"code":"PAYMENT_REQUIRED","status":402,"retryable":true,"description":"Missing or invalid payment — retry with a valid PAYMENT-SIGNATURE header"},{"code":"VALIDATION_ERROR","status":422,"retryable":false,"description":"Request body does not match the input schema"},{"code":"RATE_LIMITED","status":429,"retryable":true,"description":"Too many requests from this client"},{"code":"UPSTREAM_TIMEOUT","status":502,"retryable":true,"description":"Upstream data source unavailable — safe to retry"}],"output":{"type":"json","example":{"url":"https://bit.ly/3example","host":"bit.ly","risk":"clear","flags":["URL_SHORTENER"],"urlhaus":{"note":"Set a free abuse.ch Auth-Key in Settings to enable the URLhaus lookup.","checked":false},"disclaimer":"Heuristic and public-threat-data screening, not a sandbox detonation.","risk_score":15,"redirect_trace":{"hops":[{"url":"https://bit.ly/3example","status":301},{"url":"https://example.com/","status":200}],"final_url":"https://example.com/","reachable":true,"final_status":200,"cross_host_redirect":true}}},"pricing":{"model":"per-call","amount":0.01,"currency":"USDC","quoteHint":"Send your wallet address in an X-BUYER-WALLET header on the unpaid request to receive your personalized (volume-discounted) quote.","firstCallFree":true,"volumeDiscounts":[{"percent":10,"minCalls30d":100},{"percent":20,"minCalls30d":1000}]},"networks":["eip155:8453"],"description":"URL threat screening for agents that click links. Layer 1 — structural heuristics that catch most commodity phishing: IP-literal hosts, punycode/homoglyph hosts (xn--), embedded credentials (user@host tricks), plain-http, known URL shorteners, deep subdomain nesting, excessive length or percent-encoding. Layer 2 — a safe server-side redirect trace: the URL is followed hop by hop (max 5) with SSRF protection at every step and no body execution, reporting each hop's status and flagging redirects that land on a different host than they started (URLs whose redirect chain dives into private network space are flagged hard). Layer 3 — when a free abuse.ch Auth-Key is configured, the URL is checked against URLhaus, the live malware-distribution database; a listing raises the score to high with the threat type and reference link. Output is a 0-100 risk score, clear/review/high verdict and named flags. Honest scope: this is heuristic and public-threat-data screening, not sandbox detonation — a clear result is not proof of safety.","reliability":{"measuredAt":"2026-09-06T13:16:27+00:00","sampleSize":1,"windowDays":30,"p50LatencyMs":297,"p95LatencyMs":297,"successRatePercent":100}},"schema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","bodyType","body"],"properties":{"body":{"type":"object","required":["url"],"properties":{"url":{"type":"string","description":"Absolute http(s) URL to screen"}},"description":"URL Threat Check input. Screen a URL before your agent follows it: phishing-pattern heuristics (IP-literal hosts, punycode, credentials in the URL, shorteners, deep subdomain nesting), a safe server-side redirect trace with cross-host detection, and an optional URLhaus malware-database lookup. Returns a 0-100 risk score with named flags. Honest scope: heuristics + public threat data, not a sandbox."},"type":{"type":"string","const":"http"},"method":{"enum":["POST","PUT","PATCH"],"type":"string"},"headers":{"type":"object","additionalProperties":{"type":"string"}},"bodyType":{"enum":["json","form-data","text"],"type":"string"},"queryParams":{"type":"object","additionalProperties":{"type":"string"}}},"additionalProperties":false},"errors":{"type":"array","items":{"type":"object","required":["status","code"],"properties":{"code":{"type":"string"},"status":{"type":"integer"},"retryable":{"type":"boolean"},"description":{"type":"string"}}}},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}},"pricing":{"type":"object","properties":{"model":{"type":"string"},"amount":{"type":["number","null"]},"currency":{"type":"string"},"maxAmount":{"type":"number"},"quoteHint":{"type":"string"},"firstCallFree":{"type":"boolean"},"volumeDiscounts":{"type":"array","items":{"type":"object","required":["minCalls30d","percent"],"properties":{"percent":{"type":"number"},"minCalls30d":{"type":"integer"}}}}}},"networks":{"type":"array","items":{"type":"string"}},"description":{"type":"string"},"reliability":{"type":"object","required":["successRatePercent","sampleSize","windowDays"],"properties":{"measuredAt":{"type":"string"},"sampleSize":{"type":"integer"},"windowDays":{"type":"integer"},"p50LatencyMs":{"type":["integer","null"]},"p95LatencyMs":{"type":["integer","null"]},"successRatePercent":{"type":"number"}}}}}}},"description":"Screen a URL before your agent follows it: phishing-pattern heuristics (IP-literal hosts, punycode, credentials in the URL, shorteners, deep subdomain nesting), a safe server-side redirect trace with cross-host detection, and an optional URLhaus malware-database lookup. Returns a 0-100 risk score with named flags. Honest scope: heuristics + public threat data, not a sandbox.","lastUpdated":"2026-09-06T13:16:27.12Z","x402Version":2}]}}