ScamSense – Personal Scam & Fraud OSINT Checker

ScamSense is a professional, open-source intelligence (OSINT) security screening utility packaged as an Apify Actor. It evaluates suspicious messages (e.g. SMS, WhatsApp, Email, social media) along with associated URLs, emails, and phone numbers to assess scam likelihood, returning a standardized risk score, a qualitative verdict, and a detailed markdown-formatted reason.

It can be deployed to the Apify platform and integrated directly into automations like n8n, Zapier, and custom security flows.

---

What ScamSense Does

1. Text Heuristics Scanner: Scans messages for urgency prompts, brand impersonation, lottery/prize claims, romance scams, and requests for one-time passwords (OTPs) or PINs.
2. Region-Specific Heuristics: Custom threat templates for regions (such as India and Europe) targeting localized scam mechanics like Paytm KYC scams, India Post customs alerts, or European IBAN banking manipulations.
3. Domain & Email Reputation OSINT: Checks domain records, TLD registration risk patterns, and disposable email providers.
4. Website Security Analyzer: Inspects security flags, SSL presence, and common web phishing patterns.
5. Phone Footprints: Analyzes virtual number ranges and suspicious international prefixes.
6. Dark Web Pastes Check: Cross-references identifiers for credential leak listings or paste dumps.

---

Input Schema Reference

Parameter Name	Type	Required	Default	Description
messageText	string	Yes	-	Paste the full suspicious text content to analyze.
urls	array of strings	No	[]	URLs extracted from the message. If empty, the actor tries auto-extracting.
emails	array of strings	No	[]	Sender/mentioned email addresses. If empty, auto-extracted from text.
phones	array of strings	No	[]	Phone numbers in international format (e.g. +14155552671).
attachmentHashes	array of strings	No	[]	MD5 or SHA256 hashes of message attachments.
region	string	No	global	Heuristics region focus. Enum: global, in, eu.
enableDarkWebScan	boolean	No	true	Runs search on paste sites and credential lists.
enableDeepWebsites	boolean	No	true	Runs SSL/DNS/HTTP security diagnostics on links.

---

Custom OSINT Actor Setup (Optional)

If you want to plug in real-time deep scans using other Apify store actors, specify their actor IDs and supply your Apify API Token:

• apifyToken: Custom token if not running directly inside your authenticated Apify platform environment.
• emailDomainActorId: Apify actor to run for email and domain checks.
• websiteOsintActorId: Apify actor to run for website integrity checks.
• phoneOsintActorId: Apify actor to run for Phone OSINT footprint scans.
• darkWebActorId: Apify actor for paste queries.

If these fields are left empty, the actor dynamically executes built-in local heuristics to simulate the reputation scores, ensuring zero runtime dependencies and fast executions.

---

Scoring and Verdict Interpretation

ScamSense uses a dynamic weighted scoring model that scales between 0 and 100. It automatically adjusts weights based on which inputs are present (preventing score dilution if no emails or phone numbers are available).

• overall_score (0–100): Scaled scam likelihood rating.
• verdict:
  • Likely Scam (Score $\ge 70$): High match for phishing, fraud, or coercive tactics. Avoid interaction.
  • Suspicious – investigate further (Score $40 - 69$): Contains potential indicators of social engineering. Verify the sender independently.
  • Low Risk (Score $< 40$): Low concentration of threat signals.

---

Integration with n8n (HTTP Node)

You can run ScamSense synchronously and inspect the results in n8n.

1. Add an HTTP Request node to your n8n workflow.
2. Configure it with:
   • Method: POST
   • URL: https://api.apify.com/v2/acts/your-apify-username~scamsense-osint-checker/run-sync?token=YOUR_APIFY_API_TOKEN
   • Body Content Type: JSON
   • JSON Input:

     {
       "messageText": "URGENT: Your Netflix subscription payment has failed. Update details within 24 hours at http://netflix-billing-update.temp-site.xyz to avoid suspension.",
       "region": "global"
     }
     

3. The node will return a JSON array containing the run's dataset records. The output contains fields you can bind directly to conditional nodes:

   {
     "overall_score": 85,
     "verdict": "Likely Scam",
     "reasoning": "### ScamSense Analysis Report\n...",
     "signals": { ... },
     "version": "1.0.0",
     "created_at": "2026-07-17T12:00:00.000Z"
   }
   

---

Disclaimer and Limitations

ScamSense is an OSINT security screening tool. It is not an legal, financial, or cyber-forensics advisor. Scammers frequently change templates and tactics; therefore, this actor can return false positives and false negatives. Always verify senders through trusted channels.