Phishing URL Risk Scorer — Multi-Signal URL Safety & Security Analysis Engine

Phishing URL Risk Scorer — Multi-Signal URL Safety & Security Analysis Engine

Phishing URL Risk Scorer analyzes any URL for phishing, fraud, and security risks using 14+ independent detection signals and produces a normalized 0-100 risk score with per-signal breakdown. Each signal shows exactly what was found, how much it contributed to the score, and why.

---

What does it do?

Phishing URL Risk Scorer analyzes any URL for phishing, fraud, and security risks using 14+ independent detection signals and produces a normalized 0-100 risk score with per-signal breakdown. Each signal shows exactly what was found, how much it contributed to the score, and why.

Whether you're triaging suspicious emails, monitoring for brand impersonation, or building automated phishing detection into your SOC pipeline — this engine handles the heavy lifting in one API call.

Features

1. 14+ Detection Signals — URL pattern analysis, domain reputation, TLD blacklists, brand impersonation detection, scam language patterns, raw IP detection, hex domain detection, typo-squatting, excessive subdomains, SSL validity, redirect chain analysis, security header audit, page content inspection, and credential harvesting detection
2. Normalized Risk Scoring (0-100) — Every signal contributes to a calibrated score. 0-15 safe, 16-30 low, 31-55 medium, 56-75 high, 76-100 critical
3. SSL/TLS Certificate Validation — Checks certificate validity, issuer, expiry date, days remaining, and issues warnings for expired, self-signed, or excessively long-lived certificates
4. Redirect Chain Analysis — Tracks every hop in the redirect chain, flags excessive redirects (>3 hops), and reports the final destination URL
5. Deep Scan Mode — Extended analysis with security header checking (HSTS, CSP, X-Frame-Options, X-Content-Type-Options), HTML content analysis for login forms, password fields, external form submissions, and suspicious JavaScript patterns
6. Batch Processing — Score up to 100 URLs in a single run with independent per-URL analysis
7. Side-by-Side Comparison — Compare two URLs with score difference, shared signal analysis, and risk level comparison
8. Webhook Alert Integration — Configure a callback URL for automated high-risk notifications

Who is it for?

Persona	What they use it for
SOC Analyst	Triage suspicious URLs reported by users — get an immediate risk score and evidence without manual investigation
Security Engineer	Automate phishing URL detection in SIEM/SOAR pipelines via API integration
Brand Protection Team	Monitor for phishing sites impersonating your domains — batch scan hundreds of reported URLs daily
Threat Intelligence Analyst	Enrich IOCs with multi-factor risk scoring and SSL/domain evidence for threat reports
DevSecOps Engineer	Incorporate URL scanning into CI/CD pipelines, webhook handlers, and email security gateways
Incident Responder	Rapidly assess phishing URLs during active incidents — compare malicious vs benign URLs side-by-side
Compliance Team	Document URL risk assessments for security audits and regulatory reporting

Why use this?

• Comprehensive signal coverage — 14+ detection signals covering URL structure, domain characteristics, SSL/TLS, network behavior, and page content. Competitors typically check 3-5 signals. This engine covers the full attack surface.
• Transparent scoring — Every signal includes evidence and explanation. You don't get a black-box score — you see exactly why a URL was flagged and what was found. Critical for SOC escalation reports and audit trails.
• Production-ready API — cURL, Python, and any HTTP client can call it. Drop it into your existing automation without SDK dependencies. Response times under 2 seconds for standard mode.
• SSL intelligence — Most URL checkers stop at "has SSL". This engine validates the certificate chain, checks issuer reputation, days to expiry, and flags expired or misconfigured certificates — critical for detecting advanced phishing sites with valid-but-suspicious certificates.
• No training data needed — All detection is based on deterministic pattern analysis and real-time SSL/network verification. Zero false-positive drift over time.

Input Parameters

Field	Type	Required	Default	Description
urls	string	yes (or batchData)	—	One or more URLs (separate with new lines). Each URL is independently analyzed.
mode	string	no	standard	Analysis mode: standard (URL + domain + SSL) or deep (adds headers, content, redirects)
batchMode	boolean	no	false	When true, processes batchData array instead of urls text
batchData	array	no	—	Structured JSON array of URLs: [{"url": "https://..."}]
compareUrl	string	no	—	A second URL for side-by-side risk comparison
alertWebhook	string	no	—	Webhook URL called with risk report when score exceeds threshold

Example Input

Standard single URL analysis

{
  "urls": "https://suspicious-site.xyz/login?redirect=banking.com",
  "mode": "standard"
}

Deep scan mode

{
  "urls": "https://phishing-attempt.com/verify-account",
  "mode": "deep"
}

Batch processing

{
  "urls": "https://example.com\nhttps://example.org/login\nhttps://example.net",
  "mode": "standard"
}

Side-by-side comparison

{
  "urls": "https://google.com",
  "compareUrl": "https://google.com.secure-login.xyz"
}

Output Format

Field	Type	Description
url	string	The analyzed URL
risk_score	integer	Normalized risk score 0-100
risk_level	string	Classification: safe, low, medium, high, critical
signals	array	Full list of detected signals with evidence
signal_count	integer	Number of positive (risky) signals detected
has_ssl	boolean	Whether the server supports HTTPS
ssl_valid	boolean	Whether the SSL certificate passed verification
redirect_count	integer	Number of HTTP redirect hops
redirect_chain	array	Full chain of URLs through all redirects
final_url	string	Destination URL after all redirects
analysis_time_ms	number	Processing time in milliseconds
error	string	Error message if analysis failed

Example Output

{
  "url": "https://suspicious-site.xyz/login?redirect=banking.com",
  "risk_score": 78,
  "risk_level": "high",
  "signals": [
    {
      "name": "auth_keywords",
      "severity": "high",
      "score_delta": 15,
      "description": "Auth-related keywords (phishing bait)",
      "evidence": "/login?redirect=banking.com"
    },
    {
      "name": "suspicious_tld",
      "severity": "high",
      "score_delta": 18,
      "description": "Suspicious TLD: .xyz. Free TLDs are commonly used for phishing",
      "evidence": "suspicious-site.xyz"
    },
    {
      "name": "brand_impersonation",
      "severity": "high",
      "score_delta": 18,
      "description": "Known brand impersonation target",
      "evidence": "redirect=banking.com"
    }
  ],
  "signal_count": 3,
  "has_ssl": true,
  "ssl_valid": false,
  "redirect_count": 2,
  "final_url": "https://phishing-server.com/credentials.php",
  "analysis_time_ms": 1432.5
}

API Usage

cURL

# Analyze a single URL
curl -X POST "https://api.apify.com/v2/acts/perryay~phishing-url-risk-scorer/runs?token=YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "urls": "https://suspicious-site.xyz/login",
    "mode": "deep"
  }'

# Batch analyze multiple URLs
curl -X POST "https://api.apify.com/v2/acts/perryay~phishing-url-risk-scorer/runs?token=YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "urls": "https://example.com\nhttps://example.org",
    "mode": "standard"
  }'

# Compare two URLs
curl -X POST "https://api.apify.com/v2/acts/perryay~phishing-url-risk-scorer/runs?token=YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "urls": "https://google.com",
    "compareUrl": "https://google.com.phishing-site.xyz"
  }'

Python

import requests

API_TOKEN = "YOUR_API_TOKEN"
ACTOR_URL = "https://api.apify.com/v2/acts/perryay~phishing-url-risk-scorer/runs"

# Analyze single URL with deep mode
response = requests.post(
    ACTOR_URL,
    headers={"Content-Type": "application/json",
             "Authorization": f"Bearer {API_TOKEN}"},
    json={"urls": "https://suspicious-site.xyz", "mode": "deep"}
)
result = response.json()

if result["risk_level"] in ("high", "critical"):
    print(f"🚨 HIGH RISK: {result['risk_score']}/100")
    for signal in result["signals"]:
        print(f"  - {signal['description']}: {signal['evidence']}")
else:
    print(f"✅ Safe: {result['risk_score']}/100")

# Batch analyze and filter risky ones
response = requests.post(
    ACTOR_URL,
    headers={"Content-Type": "application/json",
             "Authorization": f"Bearer {API_TOKEN}"},
    json={
        "urls": "https://example.com\nhttps://phishing.xyz\nhttps://legit-site.com",
        "mode": "standard"
    }
)
results = response.json().get("results", [])

risky_urls = [r for r in results if r.get("risk_level") in ("high", "critical")]
print(f"Found {len(risky_urls)} risky URLs out of {len(results)}")

Use Cases

1. SOC Email Triage — Your SOC receives hundreds of reported phishing emails daily. Automate URL risk scoring to prioritise high-risk URLs for immediate analyst review. URLs scoring 56+ (high/critical) get escalated; safe URLs are automatically closed with a report.

2. Brand Protection Monitoring — Monitor hundreds of reported lookalike domains daily. Batch scan all of them through this engine and get risk-scored, evidence-backed reports. Auto-escalate domains that score critical with brand impersonation + invalid SSL signals.

3. Webhook Security Gateway — Deploy as a webhook endpoint that incoming URLs automatically route through before delivery to users. If the risk score exceeds a configurable threshold, the URL is blocked and the security team is alerted.

4. Incident Investigation — During an active phishing incident, quickly assess all IOCs (Indicator of Compromise) by running them through the engine. The side-by-side comparison mode helps distinguish genuine URLs from phishing URLs that closely mimic legitimate ones.

5. Compliance Documentation — Generate risk-scored URL assessments for security audits. Each output includes timestamps, signal evidence, and SSL validation details — suitable for inclusion in regulatory compliance reports (PCI-DSS, SOC2, ISO 27001).

FAQ

Q: What makes this different from a simple URL blacklist check? A: Blacklists only catch known-bad URLs. This engine analyzes URL structure, domain characteristics, SSL validity, and page content — catching never-before-seen phishing URLs based on behavioural patterns. A brand-new phishing site on a .xyz domain with an invalid SSL and auth keywords in the URL will score high even if no security vendor has seen it before.

Q: Can I process more than 100 URLs? A: The per-run limit is 100 URLs. For larger workloads, split into batches and run them sequentially or in parallel (the Apify platform supports concurrent runs). Each run is independent.

Q: What is the difference between standard and deep mode? A: Standard mode analyzes URL patterns, domain characteristics, and SSL/TLS validity — completing in under 2 seconds per URL. Deep mode additionally fetches the page content to check for login forms, password fields submitting to external domains, suspicious JavaScript, and security HTTP headers — taking 3-8 seconds per URL. Use standard for bulk triage, deep for high-priority investigations.

Q: Are there any false positives? A: The deterministic (non-ML) engine avoids the false-positive drift common with AI-based detectors. Every signal has a specific, explainable trigger. URL shorteners and raw IP addresses in legitimate URLs will score slightly higher, which is by design — these are risk indicators, even if the specific URL happens to be benign.

Q: Can I integrate this with my SIEM? A: Yes. The structured JSON output is SIEM-friendly. Use the cURL or Python API to submit URLs and ingest results into Splunk, Elastic, QRadar, or any JSON-capable SIEM. The risk_score field can be used for correlation rules.

Q: Does this check against VirusTotal or other threat intelligence feeds? A: Not directly. This is a deterministic risk scoring engine — it doesn't query external threat intel feeds. For enrichment, pipe the output into your existing threat intel platform (TIP) which can correlate with VirusTotal, AlienVault OTX, or MISP.

Q: What happens if the target URL is down or times out? A: The engine still performs URL pattern analysis and domain analysis even if the server is unreachable. SSL and content checks are skipped gracefully with a note in the output. You still get a partial risk assessment based on what could be analyzed.

Q: How is SSL certificate validation performed? A: Using Python's built-in SSL context with certificate verification enabled (CERT_REQUIRED). The engine establishes a real TLS connection to the server, retrieves and validates the certificate chain, extracts issuer, subject, and expiry information, and checks for common issues like expired certificates, self-signed certs, and certificates valid for longer than 825 days (CA/Browser Forum baseline requirements).

Q: Does this support internationalized domain names (IDN)? A: Yes. IDN homograph attacks (using visually similar Unicode characters) are partially covered — the engine checks for mixed character classes and flags hex-like patterns.

Q: Does the redirect chain analysis slow down execution? A: Redirect analysis is lightweight by default (up to 3 hops). If a URL chain exceeds 3 redirects, the analysis stops and flags it. The redirect tracking adds at most 200-500ms per hop. In standard mode, this is included in the <2s typical per-URL time.

---

Usage & Billing

This actor uses Apify's PAY_PER_EVENT pricing model. You are charged only for successful runs based on the events your usage triggers.

Charge Events

Event	Trigger
apify-actor-start	Every run (base)
deep-scan	Single URL in deep mode (includes content fetching)
batch-check	Batch mode with 5+ URLs

Platform costs (Apify's infrastructure fee) are passed through to the customer.

---

MCP Integration

This actor can be used through the Apify MCP server. Once connected, your MCP client (Claude Desktop, Cursor, etc.) can discover and run this actor from the Apify Store.

Quick Start

1. Install the Apify connector in your MCP client:

   • Claude Desktop: Search for "Apify" in the connector directory, or use the remote server at https://mcp.apify.com
   • Other clients: See the Apify MCP server docs for setup instructions

2. Ask your AI assistant to analyze URLs for phishing risk. For example:

   "Analyze https://suspicious-site.xyz for phishing risk" "Compare https://google.com and https://google.com.phishing-site.xyz side by side"

Claude Desktop Configuration

Add the following to your claude_desktop_config.json:

{
  "mcpServers": {
    "apify": {
      "url": "https://mcp.apify.com"
    }
  }
}

On first connection, your browser opens to sign in to Apify and authorize access.

Bearer token alternative: For headless environments, CI/CD pipelines, or clients without browser-based OAuth, you can authenticate directly with your Apify API token:

{
  "mcpServers": {
    "apify": {
      "url": "https://mcp.apify.com",
      "headers": {
        "Authorization": "Bearer YOUR_APIFY_TOKEN"
      }
    }
  }
}

Get your API token from Apify Console → API & Integrations section.

---

Related Tools

• Domain Intel — WHOIS lookups, DNS enumeration, and SSL certificate validation for any domain
• SSL Certificate Checker — Check SSL/TLS certificate validity, issuer, and expiry details for any domain
• Link Quality Analyzer — Deep link health and quality scoring for SEO and content auditing
• URL Health Checker — URL availability, HTTP status, and SSL health monitoring with batch support
• Meta Mate — Extract Open Graph, Twitter Cards, and JSON-LD metadata from URLs
• Brand Monitor Lite — Track brand mentions across multiple URLs for brand protection