api.relayshield.net

Scan a URL for phishing or malware using heuristic signals (Google Safe Browsing, RDAP domain age, known IOC corpus) plus VirusTotal multi-engine analysis. Returns an async analysis ID to poll. Call before an agent clicks, fetches, or shares a link from an untrusted source.

Look up passive DNS resolution history and reputation for a domain or IP address. For a domain: which IPs it has resolved to over time. For an IP: which hostnames have resolved to it, plus malicious/suspicious vendor detection counts. Call to pivot from an indicator to its infrastructure history during an investigation.

Check whether a phone number appears in criminal marketplace infrastructure or pivots to known scam wallets, kits, or actors via RelayShield's threat-intelligence corpus, and whether its SIM/eSIM was recently swapped (Twilio Lookup v2, cached 24h). Returns a high/medium/unknown verdict with timestamped evidence reasons. Call before your agent trusts an unknown caller or smishing sender.