# URL Safety Checker – Phishing & Malware (`sfoln/url-safety-check`)

Check URLs for phishing, malware and unwanted software against Google Web Risk, plus offline red flags such as IP hosts, look-alike punycode domains, risky TLDs and link shorteners. One record per URL with an isSafe verdict. $2 per 1,000 URLs; invalid URLs are free.

- Family: Web toolkit for agents
- Categories: Developer tools, SEO tools, Automation
- Availability: on request (private on Apify). Email contact@sfoln.com with subject "Access request: URL Safety Checker – Phishing & Malware (sfoln/url-safety-check)" before calling; calls fail until it is public.
- JSON: https://www.sfoln.com/actors/url-safety-check.json
- MCP: https://mcp.apify.com?tools=sfoln/url-safety-check
- REST (sync): POST https://api.apify.com/v2/actors/sfoln~url-safety-check/run-sync-get-dataset-items
- REST (async): POST https://api.apify.com/v2/actors/sfoln~url-safety-check/runs

URL Safety Checker – Phishing & Malware checks any list of URLs against Google Web Risk (the commercial threat-intelligence lists behind Safe Browsing) for malware, social engineering (phishing) and unwanted software, and adds offline red-flag heuristics on top: raw or obfuscated IP hosts, look-alike punycode domains, high-abuse TLDs, deep subdomain chains, user@host tricks, link shorteners and more. Built for link moderation in chats and forums, email security pipelines, lead-list hygiene and AI agents that must not follow dangerous links.

## Price per delivered record

| Event | Price | Per 1,000 | Charged for |
| --- | --- | --- | --- |
| URL safety check (`url-safety-check`) | $0.002 | $2 / 1,000 | Charged once per URL checked against Google Web Risk, whether a threat was found or not. |

Pay-per-event, USD, billed by Apify; no platform usage charge. Only records with status `ok` are charged. Cap a run with `maxTotalChargeUsd`. Apify free plan: up to 10 per run.

## Run

```bash
curl -X POST "https://api.apify.com/v2/actors/sfoln~url-safety-check/run-sync-get-dataset-items" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"urls":["https://apify.com","http://testsafebrowsing.appspot.com/s/malware.html"]}'
```

MCP client configuration:

```json
{
  "mcpServers": {
    "apify": {
      "type": "http",
      "url": "https://mcp.apify.com?tools=sfoln/url-safety-check"
    }
  }
}
```

Example prompt: Check whether these links are safe to open and explain any red flags: https://apify.com and http://testsafebrowsing.appspot.com/s/malware.html

## Input

Paste URLs (one per line). Each URL produces one dataset record with the Web Risk verdict and local heuristics.

| Field | Type | Default | Meaning |
| --- | --- | --- | --- |
| `urls` (required) | array | — | URLs: URLs or bare domains to check, one per line (http:// is assumed when no scheme is given). Objects with a `url` key are accepted too. Accounts on the Apify free plan can process up to 10 URLs per run. |
| `threatTypes` | array | `[]` | Threat lists: Web Risk lists to check. Default: MALWARE, SOCIAL_ENGINEERING, UNWANTED_SOFTWARE. SOCIAL_ENGINEERING_EXTENDED_COVERAGE adds more aggressive phishing coverage. |
| `maxUrls` | integer | `1000` | Max URLs: Safety cap on how many URLs are processed in this run. |
| `concurrency` | integer | `5` | Concurrency: How many URLs are checked in parallel. |
| `includeRaw` | boolean | `false` | Include raw upstream response: Attach the unmodified Web Risk payload to each record. |

Example input:

```json
{
  "urls": [
    "https://apify.com",
    "http://testsafebrowsing.appspot.com/s/malware.html"
  ]
}
```

## Output

One record per input item with `status` (`ok` is charged; `not_found`, `error`, `skipped_*` are free) and `charged`. The run stores an `OUTPUT` summary record.

| Field | Type | Meaning |
| --- | --- | --- |
| `input` | string | object | Input: The URL as given. |
| `url` | string | URL: Normalized URL that was checked. |
| `isSafe` | boolean | null | Safe: true = on none of the checked Web Risk lists. |
| `verdict` | string | null | Verdict: no_threat_found \| threat_found |
| `threatTypes` | array | Threat types: Matched lists, e.g. MALWARE, SOCIAL_ENGINEERING. |
| `expireTime` | string | null | Match expires: Until when a positive match may be cached. |
| `checkedAt` | string | null | Checked at |
| `threatTypesChecked` | array | Lists checked |
| `heuristics` | array | Heuristic warnings: Offline red flags: { code, severity, message }. |
| `heuristicRisk` | string | null | Heuristic risk: none \| low \| medium \| high (from heuristics only). |
| `status` | string | Status: ok \| error \| skipped_invalid \| skipped_budget \| skipped_free_plan |
| `charged` | boolean | Charged: Whether this record incurred a pay-per-event charge. |
| `source` | string | Source: webrisk |
| `fetchedAt` | string | Fetched at: ISO timestamp. |

Example record:

```json
{
  "input": "http://testsafebrowsing.appspot.com/s/malware.html",
  "url": "http://testsafebrowsing.appspot.com/s/malware.html",
  "isSafe": false,
  "verdict": "threat_found",
  "threatTypes": [
    "MALWARE"
  ],
  "expireTime": "2026-10-14T15:01:23.045123456Z",
  "checkedAt": "2026-10-14T10:00:00.000Z",
  "threatTypesChecked": [
    "MALWARE",
    "SOCIAL_ENGINEERING",
    "UNWANTED_SOFTWARE"
  ],
  "heuristics": [
    {
      "code": "no_tls",
      "severity": "info",
      "message": "Plain HTTP (no TLS)"
    }
  ],
  "heuristicRisk": "low",
  "status": "ok",
  "charged": true,
  "chargedEvent": "url-safety-check",
  "source": "webrisk",
  "fetchedAt": "2026-10-14T10:00:00.000Z"
}
```

## Related

- [URL Metadata & Open Graph Extractor](https://www.sfoln.com/actors/url-metadata.md) (`sfoln/url-metadata`)
- [Domain WHOIS & DNS Lookup](https://www.sfoln.com/actors/domain-intelligence.md) (`sfoln/domain-intelligence`)
- [URL to Markdown & Article Extractor](https://www.sfoln.com/actors/url-to-markdown-summary.md) (`sfoln/url-to-markdown-summary`)

Publisher: SFOLN LLC, contact@sfoln.com. Catalogue: https://www.sfoln.com/catalog.json. Agent guide: https://www.sfoln.com/agents.md.