TypeScript interface
Fields
The original URL that was submitted for analysis.
Aggregate threat score from 0 to 100. Scores from all active checkers are summed and capped at 100. A higher score means a greater likelihood of being malicious.
Threat verdict derived from the score:
"safe"— score is below 40"suspicious"— score is 40 to 69 (inclusive)"phishing"— score is 70 or above
Array of human-readable strings explaining why the score was assigned. The array is empty when no suspicious signals were detected. Each string corresponds to one triggered rule across any checker.
Optional map of checker name to execution time in milliseconds. Included on every live scan response. Each checker runs concurrently with a 2,500 ms timeout; if a checker times out or errors, its key still appears with the elapsed time.
Checker descriptions
Key in executionTimeMs | Description |
|---|---|
heuristics | Local rule-based analysis: URL length, suspicious keywords, HTTPS enforcement, DNS resolution, private IP detection, WHOIS domain age |
openphish | Checks the URL and hostname against the OpenPhish community phishing feed |
google_safe_browsing | Queries the Google Safe Browsing API v4 for threat matches |
urlhaus | Checks the URL against the URLHaus active malware URL feed |
phishtank | Checks the URL against the PhishTank community phishing database |
phishstats | Checks the URL and hostname against the PhishStats phishing intelligence feed |
Reason strings
The following table lists all reason strings that can appear in thereasons array and what triggers each one.
| Reason string | Trigger condition |
|---|---|
"URL very long" | URL exceeds 200 characters |
"Contains '@' (phishing trick)" | URL contains an @ sign |
"Contains suspicious keywords" | URL contains one or more of: verify, update, secure, login, support, account |
"Hyphens in domain" | The registered domain contains a hyphen |
"URL is not HTTPS" | Protocol is http: rather than https: |
"DNS failed or private network" | DNS resolution failed or resolved to a private IP address |
"Domain is recently created (<90 days)" | WHOIS creation date is within the last 90 days |
"Private/Internal network address" | Host resolves to a private IP (SSRF protection trigger) |
"Google Safe Browsing flagged this URL as dangerous" | Google Safe Browsing API returned a threat match |
"URL listed in URLHaus (Active Malware)" | Exact URL match found in the URLHaus feed |
"Exact URL match in PhishTank database" | Exact URL match found in the PhishTank feed |
"Listed in OpenPhish URL database" | Exact URL match found in the OpenPhish feed |
"Domain listed in OpenPhish intelligence" | Hostname match found in the OpenPhish feed |
"Listed in PhishStats database" | Exact URL match found in the PhishStats feed |
"Domain listed in PhishStats intelligence" | Hostname match found in the PhishStats feed |