whisper.assessUrl() — URL verdicts
A verdict for a full URL, reconciling the apex band with the path band — so a malicious path on a clean host does not disappear behind its host's reputation.
On this page (5)
whisper.assessUrl() — URL verdicts Documentation
whisper.assessUrl is the phishing-triage primitive. It takes URLs, one string or a list, and returns a verdict per URL, reconciling what is known about the host with what is known about the path.
Why it is not just assess on the hostname
The shape it exists for is a malicious tenant path on a clean apex — s3.amazonaws.com/evil-bucket/phish.html. The host is a major cloud endpoint with an unremarkable reputation. The path is a phishing kit. A host-only lookup returns the host's verdict and loses the finding entirely.
assessUrl returns both bands and the reconciliation:
| Column | What it is |
|---|---|
url | the URL you passed, echoed |
host | the full host — never folded to a registrable domain. raw.githubusercontent.com is itself the node |
path | the canonical path key |
apex_band | the band from the host alone |
path_band | the band from the path listing store. It follows the listing's category: a command-and-control path bands CRITICAL; malware, phishing and scam paths band HIGH; a plain reputation listing bands MEDIUM |
band | the reconciled verdict: the higher of the two |
coverage | path coverage: what is known about this path, not about the host. no-data — coverage: no-data. Not in coverage. This is not a verdict — nothing was looked at. here means no path listing, whatever the host's reputation |
evidence[] | the reasons, including advisory:path-scoped-listing when the lift came from the path |
Band-only. There is no numeric score on this surface.
Try it
CALL whisper.assessUrl(["https://github.com/whisper-sec"])
YIELD url, host, path, apex_band, path_band, band, coverage, evidence
RETURN url, host, apex_band, path_band, band, coverage
A single string works too, and the call chains straight into whisper.assess on the host it returns, so one query answers the path question and the host question together:
CALL whisper.assessUrl("https://raw.githubusercontent.com/torvalds/linux/master/README")
YIELD host, path, apex_band, path_band, band, coverage
CALL whisper.assess(host) YIELD coverage AS host_coverage, band AS host_band
RETURN host, path, band, coverage AS path_coverage, host_band, host_coverage
Here the path reads no-data — coverage: no-data. Not in coverage. This is not a verdict — nothing was looked at. (nothing is listed on it) while the host reads known-clean — coverage: known-clean. In coverage, no malicious evidence.: two axes, two answers.
Read band, and read evidence[]
band is the reconciled verdict and evidence[] is the reasoning behind it — including advisory:path-scoped-listing when the lift came from the path rather than the host, and apex-multi-tenant:true when the host is a platform where anyone can publish. Those are what a rule on this surface should read. The apex and path axes are independent: a clean apex with a listed path reads apex_band: NONE, path_band: HIGH, and a listed apex with an unknown path reads a high apex_band beside coverage: no-data, because coverage answers only what is known about this path.
For a coverage-qualified answer about the host, call whisper.assess on host — that is the surface host coverage belongs to, and the two compose in one query as shown above.
Where the answer comes from
The live verdict engine plus the per-path listing store. No upstream call — nothing is fetched from the URL, nothing is rendered, and the target host never sees a request. Assessing a URL does not visit it. Listed paths come from live phishing feeds and rotate fast, so a specific example may age out; the three-band shape is the durable part.
Related
- Procedures — the whole set
- Coverage — what we looked at
- Brand protection recipes