Before an agent opens or follows a link: is this address a trap? Code finds the ...
https://verdict.kechlab.com/v1/phishing-urlOverview
Before an agent opens or follows a link: is this address a trap? Code finds the technical signs (IP address, deceptive characters, hidden at-sign, shortened link, lookalike of the expected brand), then the engine reads what code cannot see: imitation of a known brand and a message that pushes to cli
Protocol
x402 (POST)
Price
$0.0088
Payment Asset
USD Coin
Payment Network
eip155:8453
Category
uncategorized
Provider
Verdict 402
Source
bazaar
Indexed
2026-10-31 08:33:48
Health
Status
unknown
Latency (p50)
—
Uptime (30d)
—
Reliability Score
—
Last Checked
Never
Last Healthy
Never
Consecutive Failures
0
x402 Payment Validation
Payment Requirements
—
Asset Verified
—
Facilitator
—
Input Schema
{
"body": {
"brand": "paypal.com",
"message": "Sign in to view your statement.",
"url": "https://www.paypal.com/signin"
},
"bodyType": "json",
"method": "POST",
"type": "http"
}
Output Schema
{
"example": {
"mode": "phishing-url",
"paid_sats": 20,
"payment_hash": "x402:<sha256 hex>",
"receipt": {
"payload": {
"at": "<ISO 8601 time>",
"kid": "<signing key id>",
"mode": "phishing-url",
"payment_hash": "x402:<sha256 hex>",
"v": 1,
"verdict_sha256": "<sha256 hex of the verdict>"
},
"signature": "<base64url Ed25519 signature>"
},
"verdict": {
"decision": "allow",
"reasons": [],
"rule": "block if brand lookalike, at-sign in the address, or certain imitation (>= 0.8) with a technical signal ; review if any signal, imitation >= 0.4 or pressure >= 0.6 ; otherwise allow",
"scores": {
"impersonation": 0.03,
"lure": 0.05
},
"signals": []
}
},
"type": "json"
}