URL Safety Checker – Phishing & Malware

sfoln/url-safety-check · Developer tools, SEO tools, Automation On request

Check URLs for phishing, malware and unwanted software against Google Web Risk, plus offline red flags such as IP hosts, look-alike punycode domains, risky TLDs and link shorteners. One record per URL with an isSafe verdict. $2 per 1,000 URLs; invalid URLs are free.

Request access Run it$2 / 1,000 url safety check

About

What it does

URL Safety Checker – Phishing & Malware checks any list of URLs against Google Web Risk (the commercial threat-intelligence lists behind Safe Browsing) for malware, social engineering (phishing) and unwanted software, and adds offline red-flag heuristics on top: raw or obfuscated IP hosts, look-alike punycode domains, high-abuse TLDs, deep subdomain chains, user@host tricks, link shorteners and more. Built for link moderation in chats and forums, email security pipelines, lead-list hygiene and AI agents that must not follow dangerous links.

Price

Price per delivered record

Event	Price	Per 1,000	Charged for
URL safety check `url-safety-check`	$0.002	$2 / 1,000	Charged once per URL checked against Google Web Risk, whether a threat was found or not.

Apify free plan: up to 10 items per run. Paid plans have no per-run cap; set maxTotalChargeUsd to cap spend.

Run

Call it from code, an agent or the Console

This API is private on Apify for now. Email us and we will publish it for you, usually within two working days. The calls below work once it is public. contact@sfoln.com

curl · synchronous run, rows in the response

curl -X POST "https://api.apify.com/v2/actors/sfoln~url-safety-check/run-sync-get-dataset-items" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"urls":["https://apify.com","http://testsafebrowsing.appspot.com/s/malware.html"]}'

mcp.json · hosted Apify MCP server

{
  "mcpServers": {
    "apify": {
      "type": "http",
      "url": "https://mcp.apify.com?tools=sfoln/url-safety-check"
    }
  }
}

asynchronous run · for large batches

POST https://api.apify.com/v2/actors/sfoln~url-safety-check/runs?maxTotalChargeUsd=1
GET  https://api.apify.com/v2/actor-runs/{runId}            # until status is SUCCEEDED
GET  https://api.apify.com/v2/datasets/{defaultDatasetId}/items?format=json

Authenticate with an Apify API token. MCP clients can instead sign in with OAuth when prompted. Example prompt for an agent: Check whether these links are safe to open and explain any red flags: https://apify.com and http://testsafebrowsing.appspot.com/s/malware.html

Input

Input fields

Paste URLs (one per line). Each URL produces one dataset record with the Web Risk verdict and local heuristics.

Field	Type	Default	Meaning
`urls` *	`array`	required	URLs URLs or bare domains to check, one per line (http:// is assumed when no scheme is given). Objects with a `url` key are accepted too. Accounts on the Apify free plan can process up to 10 URLs per run.
`threatTypes`	`array`	`[]`	Threat lists Web Risk lists to check. Default: MALWARE, SOCIAL_ENGINEERING, UNWANTED_SOFTWARE. SOCIAL_ENGINEERING_EXTENDED_COVERAGE adds more aggressive phishing coverage.
`maxUrls`	`integer`	`1000`	Max URLs Safety cap on how many URLs are processed in this run. Range 1–100000.
`concurrency`	`integer`	`5`	Concurrency How many URLs are checked in parallel. Range 1–10.
`includeRaw`	`boolean`	`false`	Include raw upstream response Attach the unmodified Web Risk payload to each record.

Example input

{
  "urls": [
    "https://apify.com",
    "http://testsafebrowsing.appspot.com/s/malware.html"
  ]
}

Output

One record per input item

Records land in the run's dataset; a synchronous call returns them directly. Each has a status (ok is charged; everything else is free) and a charged flag. The run's OUTPUT record totals items and charges.

Field	Type	Meaning
`input`	`string \| object`	Input The URL as given.
`url`	`string`	URL Normalized URL that was checked.
`isSafe`	`boolean \| null`	Safe true = on none of the checked Web Risk lists.
`verdict`	`string \| null`	Verdict no_threat_found \| threat_found
`threatTypes`	`array`	Threat types Matched lists, e.g. MALWARE, SOCIAL_ENGINEERING.
`expireTime`	`string \| null`	Match expires Until when a positive match may be cached.
`checkedAt`	`string \| null`	Checked at
`threatTypesChecked`	`array`	Lists checked
`heuristics`	`array`	Heuristic warnings Offline red flags: { code, severity, message }.
`heuristicRisk`	`string \| null`	Heuristic risk none \| low \| medium \| high (from heuristics only).
`status`	`string`	Status ok \| error \| skipped_invalid \| skipped_budget \| skipped_free_plan e.g. `"ok"`
`charged`	`boolean`	Charged Whether this record incurred a pay-per-event charge.
`source`	`string`	Source webrisk
`fetchedAt`	`string`	Fetched at ISO timestamp.

Example record

{
  "input": "http://testsafebrowsing.appspot.com/s/malware.html",
  "url": "http://testsafebrowsing.appspot.com/s/malware.html",
  "isSafe": false,
  "verdict": "threat_found",
  "threatTypes": [
    "MALWARE"
  ],
  "expireTime": "2026-10-14T15:01:23.045123456Z",
  "checkedAt": "2026-10-14T10:00:00.000Z",
  "threatTypesChecked": [
    "MALWARE",
    "SOCIAL_ENGINEERING",
    "UNWANTED_SOFTWARE"
  ],
  "heuristics": [
    {
      "code": "no_tls",
      "severity": "info",
      "message": "Plain HTTP (no TLS)"
    }
  ],
  "heuristicRisk": "low",
  "status": "ok",
  "charged": true,
  "chargedEvent": "url-safety-check",
  "source": "webrisk",
  "fetchedAt": "2026-10-14T10:00:00.000Z"
}

Machine-readable

This page for agents

/actors/url-safety-check.json — this API as JSON
/actors/url-safety-check.md — this API as Markdown
/catalog.json — the whole catalogue