Phish Radar
Real-time phishing detection and brand monitoring MCP server. Analyzes URLs and domains for typosquatting, homoglyph attacks, suspicious TLS certificates, and DNS anomalies. Monitors for lookalike domains targeting your brand.
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
url |
string | ❌ | URL to analyze for phishing indicators |
brand_domain |
string | ❌ | Your domain to monitor for lookalikes |
check_certificate |
boolean | ❌ | Analyze TLS certificate (default: true) |
scan_dns |
boolean | ❌ | Check DNS anomalies (default: true) |
Example Response
{
"target": "arnazon-secure-signin.net",
"phishing_score": 96,
"verdict": "HIGH_RISK",
"indicators": {
"typosquatting": {"detected": true, "target_brand": "amazon.com", "technique": "insertion"},
"domain_age_days": 1,
"certificate": {"issuer": "Let's Encrypt", "age_days": 0, "subject_mismatch": true},
"dns": {"has_mx": false, "fast_flux": false},
"blocklists": ["PhishTank", "Google Safe Browsing"]
}
}
Use Cases
- Brand protection automated domain monitoring
- Email security gateway URL pre-screening
- Fraud operations team phishing takedown workflow
Access
# x402 endpoint — pay $0.01 USDC per call (Base mainnet)
POST https://x402.ntriq.co.kr/phish-radar
# Service catalog
curl https://x402.ntriq.co.kr/services
x402 micropayments — USDC on Base, gasless EIP-3009