Malwarebytes

Use this when you need to look up domain registration information to verify legitimacy or identify suspicious patterns. Provides WHOIS/RDAP data including registrar, registration dates, name servers, and abuse contacts. Particularly useful for identifying newly registered domains (common in phishing and scams) or verifying domain ownership and registration history. Do not use this for general domain availability checks or bulk domain searches. Returns: Structured content with the following fields: - domain: The queried domain - registrar: Registration service (optional) - created: Registration date (optional) - expires: Expiration date (optional) - name_servers: DNS servers, limited to 4 (optional) - abuse_email: Abuse contact email (optional) - query_method: "whois", "rdap", or "failed" - error: True if query failed - error_message: Error details when query fails (optional)

reputation.whois

Use this when you need to check if an email address is associated with phishing, scams, or malicious activity. Checks the email domain against threat intelligence database. Returns one of: - malicious: Confirmed phishing or malicious email domain - suspicious: Potentially dangerous email domain - safe: Verified legitimate email domain - unknown: No threat intelligence available Do not use this for email validation, mailbox verification, or general email lookup services. Returns: Structured content with the following fields: - verdict: Threat verdict - "malicious" (confirmed harmful), "suspicious" (potentially dangerous), "safe" (verified safe), or "unknown" (no match found) - scanned_email: The email address that was scanned

reputation.check_email

Use this when you need to check if a link or URL is safe, suspicious, or malicious. Provides reputation verdict based on threat intelligence database. Returns one of: - malicious: Confirmed harmful link - suspicious: Potentially dangerous link - safe: Verified safe link - unknown: No threat intelligence available Do not use this for general web searches, content fetching, or webpage analysis. Returns: Structured content with the following fields: - verdict: Threat verdict - "malicious" (confirmed harmful), "suspicious" (potentially dangerous), "safe" (verified safe), or "unknown" (no match found) - scanned_url: The URL that was scanned - destination_url: Final URL after following redirects (optional) - reachable: Whether the URL is reachable (optional)

reputation.check_link

Use this when you need to check if a phone number is associated with scams or suspicious activity. Provides reputation verdict and additional phone information. Returns one of: - malicious: Confirmed scam or spam phone number - suspicious: Potentially dangerous number - safe: Verified legitimate number - unknown: No threat intelligence available Also provides optional details like carrier, location, and phone type when available. Do not use this for phone number lookups, caller ID services, or general phone directory searches. Returns: Structured content with the following fields: - verdict: Threat verdict - "malicious" (confirmed harmful), "suspicious" (potentially dangerous), "safe" (verified safe), or "unknown" (no match found) - scanned_phone: The phone number that was scanned - region: Geographic region (optional) - carrier: Phone carrier (optional) - phone_type: Type of phone number - VOICEMAIL, UAN, PAGER, PERSONAL_NUMBER, VOIP, SHARED_COST, TOLL_FREE, PREMIUM_RATE, UNKNOWN, FIXED_LINE_OR_MOBILE, FIXED_LINE, MOBILE (optional) - location: Location details (optional) - error: Structured error information when phone number validation fails (optional)

reputation.check_phone

Use this when a user wants to report a suspicious link, email address, or phone number. Submits the indicator to the threat intelligence system for analysis and potential inclusion in threat databases. Use this for user-initiated reports of suspected scams, phishing attempts, or spam. Do not use this to automatically report every checked item - only use when explicitly requested by the user. Returns: Structured content with the following fields: - result: Report status confirmation (always "reported") - indicator_value: The indicator value that was reported - indicator_type: Type of indicator reported - "url", "email", or "phone"

reputation.report