Suspicious Link Checker API

Check a link for phishing red flags without visiting it: lookalike and punycode domains, brand names in subdomains, IP hosts, shorteners, risky TLDs and schemes, credentials in URLs. Returns a 0–100 score and a verdict. Offline heuristics, not a blocklist lookup.

POST /api/v1/tools/url-safety-checkerMCP url_safety_checkerSecurity & Privacy

Paste a link or a whole message to spot phishing tricks: lookalike domains, hidden @ addresses, raw IPs, shorteners and fake file types. Never opens the link.

Input

Send these as a JSON object. Unknown fields are rejected.

input: A URL, or (with mode message) any text such as an email or SMS; every link in it is checked. (string, up to 50000 characters, required)
mode: url: check input as one link. message: extract and check up to 50 links found in the text. (string, one of url, message, default "url")

Try it in the browser JSON Schema Get an API key

curl https://pithlab.com/api/v1/tools/url-safety-checker \n  -H "Authorization: Bearer $PITHLAB_KEY" \n  -H "Content-Type: application/json" \n  -d '{"input":"https://paypal.com.account-verify.example.xyz/login?session=1"}'

Example response

{
  "ok": true,
  "result": {
    "input": "https://paypal.com.account-verify.example.xyz/login?session=1",
    "ok": true,
    "href": "https://paypal.com.account-verify.example.xyz/login?session=1",
    "host": "paypal.com.account-verify.example.xyz",
    "hostUnicode": "paypal.com.account-verify.example.xyz",
    "registrableDomain": "example.xyz",
    "looksLike": null,
    "verdict": "dangerous",
    "verdictLabel": "Likely dangerous",
    "score": 50,
    "flags": [
      {
        "id": "brand-subdomain",
        "level": "high",
        "title": "\"paypal\" appears in front of another site's domain",
        "detail": "The site is really example.xyz. Putting paypal in the subdomain is a common trick to make a link look official."
      },
      {
        "id": "many-subdomains",
        "level": "low",
        "title": "Several levels of subdomain",
        "detail": "The real domain is example.xyz; the rest is chosen by whoever owns it."
      },
      {
        "id": "suspicious-tld",
        "level": "low",
        "title": "Often-abused ending: .xyz",
        "detail": "Domains ending in .xyz are cheap and frequently used for spam and phishing. Many are legitimate, so treat this as a weak signal."
      },
      {
        "id": "login-words",
        "level": "low",
        "title": "Uses urgent account words",
        "detail": "Words like login, verify or account next to other red flags are typical of credential-phishing pages."
      }
    ]
  }
}