Phishing and malicious-URL reputation check. POST JSON {"url": "https://..."} to /v1/reputation; the URL itself is not fetched. The response is a JSON object with url, host, verdict, heuristics, threat_matches and checked_sources. Verdicts: malicious (a threat database matched), suspicious (URL heuristics fired: raw IP host, punycode host, user@host, credential words in the host, very long host, deep subdomains), clean (a threat database was checked and found nothing) and unknown (no threat database was consulted and no heuristic fired). This supplier has no threat database configured (Google Safe Browsing is used only when the supplier sets an API key), so answers are suspicious or unknown, never clean. checked_sources shows exactly what ran. Identical input gives identical output while no threat database is configured.
