# ScamSense (`blukaze/scamsense`) Actor

ScamSense analyzes suspicious messages with OSINT checks on URLs, emails, phones, and dark web signals to score scam risk and explain why.

- **URL**: https://apify.com/blukaze/scamsense.md
- **Developed by:** [Blukaze Automations](https://apify.com/blukaze) (community)
- **Categories:** Other, Integrations
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.03 / 1,000 scamsense results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js/docs.md):

```bash
npm install apify-client
```

In Python projects, use official [Python client library](https://docs.apify.com/api/client/python/docs.md):

```bash
pip install apify-client
```

In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md):

````bash
# MacOS / Linux
curl -fsSL https://apify.com/install-cli.sh | bash
# Windows
irm https://apify.com/install-cli.ps1 | iex
```bash

In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/integrations/mcp.md).

If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).


# README

## ScamSense – Personal Scam & Fraud OSINT Checker

ScamSense is a professional, open-source intelligence (OSINT) security screening utility packaged as an Apify Actor. It evaluates suspicious messages (e.g. SMS, WhatsApp, Email, social media) along with associated URLs, emails, and phone numbers to assess scam likelihood, returning a standardized risk score, a qualitative verdict, and a detailed markdown-formatted reason.

It can be deployed to the Apify platform and integrated directly into automations like **n8n**, **Zapier**, and custom security flows.

---

### What ScamSense Does

1. **Text Heuristics Scanner**: Scans messages for urgency prompts, brand impersonation, lottery/prize claims, romance scams, and requests for one-time passwords (OTPs) or PINs.
2. **Region-Specific Heuristics**: Custom threat templates for regions (such as India and Europe) targeting localized scam mechanics like Paytm KYC scams, India Post customs alerts, or European IBAN banking manipulations.
3. **Domain & Email Reputation OSINT**: Checks domain records, TLD registration risk patterns, and disposable email providers.
4. **Website Security Analyzer**: Inspects security flags, SSL presence, and common web phishing patterns.
5. **Phone Footprints**: Analyzes virtual number ranges and suspicious international prefixes.
6. **Dark Web Pastes Check**: Cross-references identifiers for credential leak listings or paste dumps.

---

### Input Schema Reference

| Parameter Name | Type | Required | Default | Description |
| :--- | :--- | :--- | :--- | :--- |
| `messageText` | string | **Yes** | - | Paste the full suspicious text content to analyze. |
| `urls` | array of strings | No | `[]` | URLs extracted from the message. If empty, the actor tries auto-extracting. |
| `emails` | array of strings | No | `[]` | Sender/mentioned email addresses. If empty, auto-extracted from text. |
| `phones` | array of strings | No | `[]` | Phone numbers in international format (e.g. `+14155552671`). |
| `attachmentHashes` | array of strings | No | `[]` | MD5 or SHA256 hashes of message attachments. |
| `region` | string | No | `global` | Heuristics region focus. Enum: `global`, `in`, `eu`. |
| `enableDarkWebScan` | boolean | No | `true` | Runs search on paste sites and credential lists. |
| `enableDeepWebsites` | boolean | No | `true` | Runs SSL/DNS/HTTP security diagnostics on links. |

---

### Custom OSINT Actor Setup (Optional)
If you want to plug in real-time deep scans using other Apify store actors, specify their actor IDs and supply your Apify API Token:
- `apifyToken`: Custom token if not running directly inside your authenticated Apify platform environment.
- `emailDomainActorId`: Apify actor to run for email and domain checks.
- `websiteOsintActorId`: Apify actor to run for website integrity checks.
- `phoneOsintActorId`: Apify actor to run for Phone OSINT footprint scans.
- `darkWebActorId`: Apify actor for paste queries.

If these fields are left empty, the actor dynamically executes **built-in local heuristics** to simulate the reputation scores, ensuring zero runtime dependencies and fast executions.

---

### Scoring and Verdict Interpretation

ScamSense uses a **dynamic weighted scoring model** that scales between `0` and `100`. It automatically adjusts weights based on which inputs are present (preventing score dilution if no emails or phone numbers are available).

* **overall_score (0–100)**: Scaled scam likelihood rating.
* **verdict**:
  * **`Likely Scam`** (Score $\ge 70$): High match for phishing, fraud, or coercive tactics. Avoid interaction.
  * **`Suspicious – investigate further`** (Score $40 - 69$): Contains potential indicators of social engineering. Verify the sender independently.
  * **`Low Risk`** (Score $< 40$): Low concentration of threat signals.

---

### Integration with n8n (HTTP Node)

You can run ScamSense synchronously and inspect the results in n8n.

1. Add an **HTTP Request** node to your n8n workflow.
2. Configure it with:
   - **Method**: `POST`
   - **URL**: `https://api.apify.com/v2/acts/your-apify-username~scamsense-osint-checker/run-sync?token=YOUR_APIFY_API_TOKEN`
   - **Body Content Type**: `JSON`
   - **JSON Input**:
     ```json
     {
       "messageText": "URGENT: Your Netflix subscription payment has failed. Update details within 24 hours at http://netflix-billing-update.temp-site.xyz to avoid suspension.",
       "region": "global"
     }
     ```
3. The node will return a JSON array containing the run's dataset records. The output contains fields you can bind directly to conditional nodes:
   ```json
   {
     "overall_score": 85,
     "verdict": "Likely Scam",
     "reasoning": "### ScamSense Analysis Report\n...",
     "signals": { ... },
     "version": "1.0.0",
     "created_at": "2026-07-17T12:00:00.000Z"
   }
````

***

### Disclaimer and Limitations

ScamSense is an OSINT security screening tool. It is not an legal, financial, or cyber-forensics advisor. Scammers frequently change templates and tactics; therefore, this actor can return false positives and false negatives. Always verify senders through trusted channels.

# Actor input Schema

## `messageText` (type: `string`):

Paste the full message (WhatsApp, SMS, email, etc.) you want ScamSense to analyze.

## `urls` (type: `array`):

Any links extracted from the message. ScamSense will run website OSINT checks on each. Providing these improves accuracy.

## `emails` (type: `array`):

Sender email or any email mentioned in the message. Providing these improves accuracy.

## `phones` (type: `array`):

Phone numbers in international format (e.g. +14155552671). Providing these improves accuracy.

## `attachmentHashes` (type: `array`):

Optional MD5/SHA256 hashes of attachments associated with the message.

## `region` (type: `string`):

Used to apply region-specific heuristics. Leave as 'global' if unsure.

## `enableDarkWebScan` (type: `boolean`):

If enabled, ScamSense will look for leaked credentials or mentions on dark web/paste sites. May be slower and cost more.

## `enableDeepWebsites` (type: `boolean`):

If enabled, ScamSense will run extended DNS/SSL/headers/ports checks for each URL/domain.

## `apifyToken` (type: `string`):

Optional: Custom Apify API Token. If not specified, standard Actor environment tokens will be used, or the actor will run in mock mode.

## `emailDomainActorId` (type: `string`):

Optional: Custom Apify Actor ID to run for Email/Domain reputation scans.

## `websiteOsintActorId` (type: `string`):

Optional: Custom Apify Actor ID to run for DNS/SSL/Port website security scans.

## `phoneOsintActorId` (type: `string`):

Optional: Custom Apify Actor ID to run for Phone OSINT footprint scans.

## `darkWebActorId` (type: `string`):

Optional: Custom Apify Actor ID to run for Dark Web credentials and mentions scans.

## Actor input object example

```json
{
  "messageText": "URGENT: Your bank account has been locked. Verify identity within 24 hours at http://secure-bank-login-verification.temp-site.xyz or call +14155552671 immediately to avoid a charge of $499.",
  "region": "global",
  "enableDarkWebScan": true,
  "enableDeepWebsites": true
}
```

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "messageText": "URGENT: Your bank account has been locked. Verify identity within 24 hours at http://secure-bank-login-verification.temp-site.xyz or call +14155552671 immediately to avoid a charge of $499."
};

// Run the Actor and wait for it to finish
const run = await client.actor("blukaze/scamsense").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "messageText": "URGENT: Your bank account has been locked. Verify identity within 24 hours at http://secure-bank-login-verification.temp-site.xyz or call +14155552671 immediately to avoid a charge of $499." }

# Run the Actor and wait for it to finish
run = client.actor("blukaze/scamsense").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"])
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "messageText": "URGENT: Your bank account has been locked. Verify identity within 24 hours at http://secure-bank-login-verification.temp-site.xyz or call +14155552671 immediately to avoid a charge of $499."
}' |
apify call blukaze/scamsense --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "command": "npx",
            "args": [
                "mcp-remote",
                "https://mcp.apify.com/?tools=blukaze/scamsense",
                "--header",
                "Authorization: Bearer <YOUR_API_TOKEN>"
            ]
        }
    }
}

```

## OpenAPI specification

```json
{
    "openapi": "3.0.1",
    "info": {
        "title": "ScamSense",
        "description": "ScamSense analyzes suspicious messages with OSINT checks on URLs, emails, phones, and dark web signals to score scam risk and explain why.",
        "version": "0.0",
        "x-build-id": "zyT0dMQazTq8mwdxD"
    },
    "servers": [
        {
            "url": "https://api.apify.com/v2"
        }
    ],
    "paths": {
        "/acts/blukaze~scamsense/run-sync-get-dataset-items": {
            "post": {
                "operationId": "run-sync-get-dataset-items-blukaze-scamsense",
                "x-openai-isConsequential": false,
                "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.",
                "tags": [
                    "Run Actor"
                ],
                "requestBody": {
                    "required": true,
                    "content": {
                        "application/json": {
                            "schema": {
                                "$ref": "#/components/schemas/inputSchema"
                            }
                        }
                    }
                },
                "parameters": [
                    {
                        "name": "token",
                        "in": "query",
                        "required": true,
                        "schema": {
                            "type": "string"
                        },
                        "description": "Enter your Apify token here"
                    }
                ],
                "responses": {
                    "200": {
                        "description": "OK"
                    }
                }
            }
        },
        "/acts/blukaze~scamsense/runs": {
            "post": {
                "operationId": "runs-sync-blukaze-scamsense",
                "x-openai-isConsequential": false,
                "summary": "Executes an Actor and returns information about the initiated run in response.",
                "tags": [
                    "Run Actor"
                ],
                "requestBody": {
                    "required": true,
                    "content": {
                        "application/json": {
                            "schema": {
                                "$ref": "#/components/schemas/inputSchema"
                            }
                        }
                    }
                },
                "parameters": [
                    {
                        "name": "token",
                        "in": "query",
                        "required": true,
                        "schema": {
                            "type": "string"
                        },
                        "description": "Enter your Apify token here"
                    }
                ],
                "responses": {
                    "200": {
                        "description": "OK",
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/runsResponseSchema"
                                }
                            }
                        }
                    }
                }
            }
        },
        "/acts/blukaze~scamsense/run-sync": {
            "post": {
                "operationId": "run-sync-blukaze-scamsense",
                "x-openai-isConsequential": false,
                "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.",
                "tags": [
                    "Run Actor"
                ],
                "requestBody": {
                    "required": true,
                    "content": {
                        "application/json": {
                            "schema": {
                                "$ref": "#/components/schemas/inputSchema"
                            }
                        }
                    }
                },
                "parameters": [
                    {
                        "name": "token",
                        "in": "query",
                        "required": true,
                        "schema": {
                            "type": "string"
                        },
                        "description": "Enter your Apify token here"
                    }
                ],
                "responses": {
                    "200": {
                        "description": "OK"
                    }
                }
            }
        }
    },
    "components": {
        "schemas": {
            "inputSchema": {
                "type": "object",
                "required": [
                    "messageText"
                ],
                "properties": {
                    "messageText": {
                        "title": "Suspicious message text",
                        "type": "string",
                        "description": "Paste the full message (WhatsApp, SMS, email, etc.) you want ScamSense to analyze."
                    },
                    "urls": {
                        "title": "URLs in the message",
                        "type": "array",
                        "description": "Any links extracted from the message. ScamSense will run website OSINT checks on each. Providing these improves accuracy.",
                        "items": {
                            "type": "string"
                        }
                    },
                    "emails": {
                        "title": "Email addresses",
                        "type": "array",
                        "description": "Sender email or any email mentioned in the message. Providing these improves accuracy.",
                        "items": {
                            "type": "string"
                        }
                    },
                    "phones": {
                        "title": "Phone numbers",
                        "type": "array",
                        "description": "Phone numbers in international format (e.g. +14155552671). Providing these improves accuracy.",
                        "items": {
                            "type": "string"
                        }
                    },
                    "attachmentHashes": {
                        "title": "Attachment hashes",
                        "type": "array",
                        "description": "Optional MD5/SHA256 hashes of attachments associated with the message.",
                        "items": {
                            "type": "string"
                        }
                    },
                    "region": {
                        "title": "Region (optional)",
                        "enum": [
                            "global",
                            "in",
                            "eu"
                        ],
                        "type": "string",
                        "description": "Used to apply region-specific heuristics. Leave as 'global' if unsure.",
                        "default": "global"
                    },
                    "enableDarkWebScan": {
                        "title": "Enable dark web checks",
                        "type": "boolean",
                        "description": "If enabled, ScamSense will look for leaked credentials or mentions on dark web/paste sites. May be slower and cost more.",
                        "default": true
                    },
                    "enableDeepWebsites": {
                        "title": "Enable deep website OSINT",
                        "type": "boolean",
                        "description": "If enabled, ScamSense will run extended DNS/SSL/headers/ports checks for each URL/domain.",
                        "default": true
                    },
                    "apifyToken": {
                        "title": "Apify API Token",
                        "type": "string",
                        "description": "Optional: Custom Apify API Token. If not specified, standard Actor environment tokens will be used, or the actor will run in mock mode."
                    },
                    "emailDomainActorId": {
                        "title": "Email/Domain OSINT Actor ID",
                        "type": "string",
                        "description": "Optional: Custom Apify Actor ID to run for Email/Domain reputation scans."
                    },
                    "websiteOsintActorId": {
                        "title": "Website Intelligence Actor ID",
                        "type": "string",
                        "description": "Optional: Custom Apify Actor ID to run for DNS/SSL/Port website security scans."
                    },
                    "phoneOsintActorId": {
                        "title": "Phone OSINT Actor ID",
                        "type": "string",
                        "description": "Optional: Custom Apify Actor ID to run for Phone OSINT footprint scans."
                    },
                    "darkWebActorId": {
                        "title": "Dark Web OSINT Actor ID",
                        "type": "string",
                        "description": "Optional: Custom Apify Actor ID to run for Dark Web credentials and mentions scans."
                    }
                }
            },
            "runsResponseSchema": {
                "type": "object",
                "properties": {
                    "data": {
                        "type": "object",
                        "properties": {
                            "id": {
                                "type": "string"
                            },
                            "actId": {
                                "type": "string"
                            },
                            "userId": {
                                "type": "string"
                            },
                            "startedAt": {
                                "type": "string",
                                "format": "date-time",
                                "example": "2025-01-08T00:00:00.000Z"
                            },
                            "finishedAt": {
                                "type": "string",
                                "format": "date-time",
                                "example": "2025-01-08T00:00:00.000Z"
                            },
                            "status": {
                                "type": "string",
                                "example": "READY"
                            },
                            "meta": {
                                "type": "object",
                                "properties": {
                                    "origin": {
                                        "type": "string",
                                        "example": "API"
                                    },
                                    "userAgent": {
                                        "type": "string"
                                    }
                                }
                            },
                            "stats": {
                                "type": "object",
                                "properties": {
                                    "inputBodyLen": {
                                        "type": "integer",
                                        "example": 2000
                                    },
                                    "rebootCount": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "restartCount": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "resurrectCount": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "computeUnits": {
                                        "type": "integer",
                                        "example": 0
                                    }
                                }
                            },
                            "options": {
                                "type": "object",
                                "properties": {
                                    "build": {
                                        "type": "string",
                                        "example": "latest"
                                    },
                                    "timeoutSecs": {
                                        "type": "integer",
                                        "example": 300
                                    },
                                    "memoryMbytes": {
                                        "type": "integer",
                                        "example": 1024
                                    },
                                    "diskMbytes": {
                                        "type": "integer",
                                        "example": 2048
                                    }
                                }
                            },
                            "buildId": {
                                "type": "string"
                            },
                            "defaultKeyValueStoreId": {
                                "type": "string"
                            },
                            "defaultDatasetId": {
                                "type": "string"
                            },
                            "defaultRequestQueueId": {
                                "type": "string"
                            },
                            "buildNumber": {
                                "type": "string",
                                "example": "1.0.0"
                            },
                            "containerUrl": {
                                "type": "string"
                            },
                            "usage": {
                                "type": "object",
                                "properties": {
                                    "ACTOR_COMPUTE_UNITS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_WRITES": {
                                        "type": "integer",
                                        "example": 1
                                    },
                                    "KEY_VALUE_STORE_LISTS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_INTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_EXTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_SERPS": {
                                        "type": "integer",
                                        "example": 0
                                    }
                                }
                            },
                            "usageTotalUsd": {
                                "type": "number",
                                "example": 0.00005
                            },
                            "usageUsd": {
                                "type": "object",
                                "properties": {
                                    "ACTOR_COMPUTE_UNITS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_WRITES": {
                                        "type": "number",
                                        "example": 0.00005
                                    },
                                    "KEY_VALUE_STORE_LISTS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_INTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_EXTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_SERPS": {
                                        "type": "integer",
                                        "example": 0
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }
    }
}
```