{
  "ok": true,
  "q": "https://example.com",
  "url": "https://example.com/",
  "brief": {
    "score": 25,
    "band": "clear",
    "flags": [
      "openphish_not_listed",
      "offhost_links"
    ],
    "summary": "URL parsed (host: example.com). OpenPhish community feed checked (live; not a complete phishing corpus). Structural heuristics also applied. Always verify domains out-of-band before connecting a wallet. Page signals: 1 off-host link host(s).",
    "sources": [
      {
        "id": "url_parse",
        "label": "URL structure heuristics",
        "status": "heuristic",
        "detail": "host=example.com"
      },
      {
        "id": "upstream_openphish",
        "label": "OpenPhish community phishing feed",
        "status": "live",
        "detail": "Not on OpenPhish feed (265 hosts; fresh) — absence is not clearance",
        "url": "https://openphish.com/feed.txt"
      },
      {
        "id": "upstream_whois",
        "label": "Domain age / WHOIS (RDAP)",
        "status": "live",
        "detail": "registrar=RESERVED-Internet Assigned Numbers Authority · age_days=11354 · created=1995-08-14T04:00:00Z",
        "url": "https://rdap.verisign.com/com/v1/domain/example.com"
      },
      {
        "id": "upstream_hosting_asn",
        "label": "Hosting ASN / IP",
        "status": "live",
        "detail": "AS13335 CLOUDFLARENET - Cloudflare, Inc. · 104.20.23.154"
      }
    ]
  },
  "domain": {
    "host": "example.com",
    "registered": true,
    "registrar": "RESERVED-Internet Assigned Numbers Authority",
    "created": "1995-08-14T04:00:00Z",
    "age_days": 11354,
    "rdap": {
      "status": "live",
      "detail": null
    }
  },
  "hosting": {
    "ip": "104.20.23.154",
    "ips": [
      "104.20.23.154",
      "172.66.147.243"
    ],
    "asn": 13335,
    "as_org": "CLOUDFLARENET - Cloudflare, Inc.",
    "prefix": "104.20.16.0/20",
    "country": "US"
  },
  "infra": {
    "ips": [
      "104.20.23.154",
      "172.66.147.243"
    ],
    "asn": 13335,
    "as_org": "CLOUDFLARENET - Cloudflare, Inc.",
    "source": "doh+team-cymru"
  },
  "explain": {
    "checked": [
      "URL heuristics (scheme, host, bait keywords)",
      "OpenPhish community phishing feed",
      "RDAP/WHOIS (registrar + age)",
      "Page fetch (SSRF-safe markdown)",
      "Page risk heuristics (wallet/seed/claim/login signals)",
      "One-hop off-host fetch (1)",
      "Hosting IP + ASN"
    ],
    "not_checked": [
      "Screenshot / visual capture",
      "Paid diligence / entity filings / people OSINT",
      "Full registry WHOIS beyond RDAP",
      "Sandbox malware detonation"
    ],
    "next_dig": [
      "If stakes are high, dig registrar history and entity filings outside Check"
    ],
    "plain": "Checked: URL heuristics (scheme, host, bait keywords); OpenPhish community phishing feed; RDAP/WHOIS (registrar + age); Page fetch (SSRF-safe markdown). Not checked: Screenshot / visual capture; Paid diligence / entity filings / people OSINT; Full registry WHOIS beyond RDAP. Next dig: If stakes are high, dig registrar history and entity filings outside Check. Soft signals only — not clearance or advice."
  },
  "page": {
    "status": 200,
    "contentType": "text/html",
    "markdown": "# Example Domain\n\nExample Domain\nThis domain is for use in documentation examples without needing permission. Avoid use in operations.\n[Learn more](https://iana.org/domains/example)",
    "final_url": "https://example.com/"
  },
  "page_risk": {
    "flags": [
      "offhost_links"
    ],
    "scoreDelta": 5,
    "hops": [
      {
        "url": "https://iana.org/domains/example",
        "final_url": "http://www.iana.org/help/example-domains",
        "flags": [],
        "scoreDelta": 0
      }
    ]
  },
  "tier": "free",
  "disclaimer": "Informational tooling only. Not financial advice. No custody, trading, or token promotion. Scores are imperfect heuristics — verify independently."
}