Website Trust & Scam Check — Is This Site Safe to Pay?

One call returns allow / caution / block for any website, with a trust score, the red and green flags behind it, and plain guidance for an AI agent. It is built for agents that are about to pay a merchant, submit credentials or send a user to a link, and for anyone asking "is this site legit?".

Passive, read-only, keyless. It runs as a normal Actor (batch) and as an instant HTTP endpoint (Standby): one GET, JSON back in about a second, no polling.

What it checks

Signal	Source	Why it matters
Phishing / malware blocklists	OpenPhish live feed, Phishing.Database (≈390k active phishing domains), abuse.ch URLhaus	Known-bad sites are blocked outright
Popularity	Tranco top-1M rank	A top-10k site is very unlikely to be a fly-by-night scam
Domain age & holds	RDAP (WHOIS successor)	Scam stores are typically days or weeks old; a registry hold means the domain was suspended
Parking	Nameservers	A parked domain is not an operating store
Impersonation	~80 commonly spoofed brands (PayPal, Amazon, Apple, banks, couriers, crypto wallets…)	amazon-prime-refunds.com, paypa1-secure-login.com → block
Free-hosting subdomains	pages.dev, vercel.app, netlify.app, github.io…	Real merchants use their own domain
Transport	TLS handshake	Invalid / missing HTTPS is a hard warning for payments; organisation-validated certificates are a plus
Email / DNS	MX, SPF, DMARC	Real businesses receive email; DMARC enforcement protects customers from spoofed mail
Storefront	One homepage read	Contact / refund / privacy / terms pages, email & phone, social links, hard-to-reverse payment requests (wire, gift cards, crypto-only, Zelle / Cash App / "friends & family"), scam sales patterns (70–95% off, closing-down sales, countdowns), text-only trust seals, unfinished template text
Sanctioned crypto	OFAC sanctioned-address list	A sanctioned wallet shown for payment → block

Output

{
  "domain": "amazon-prime-refunds.com",
  "decision": "block",
  "trustScore": 0,
  "agentGuidance": "High-risk. Do not submit payment, credentials or personal data. Tell the user why and offer the verified alternative if one is known.",
  "redFlags": [
    "Impersonation risk: brand name inside a different domain (amazon-prime-refunds.com) - the real amazon is at amazon.com, amazon.co.uk, amazon.de",
    "No public registration record (RDAP) for the domain"
  ],
  "summary": "amazon-prime-refunds.com -> BLOCK (trust 0/100): Impersonation risk: ..."
}

A legitimate store, from a real run:

{ "domain": "etsy.com", "decision": "allow", "trustScore": 100,
  "greenFlags": ["Popular site: Tranco rank #322", "Domain registered 23 years ago", "Receives email (MX records)"] }

Every verdict also carries checks (the raw evidence: blocklists, rank, RDAP, TLS, DNS/email, impersonation, storefront) so an agent or analyst can explain the decision.

Decision rule: block on any hard signal (blocklisted, impersonation of a brand, suspended domain, sanctioned wallet) or a score under 35; caution from 35 to 64; allow from 65 up.

Use it as an agent tool (instant endpoint)

Standby mode keeps the checker warm behind an HTTP endpoint:

curl "https://<standby-url-of-this-actor>/?url=shop-example.com" -H "Authorization: Bearer <APIFY_TOKEN>"
curl -X POST "https://<standby-url-of-this-actor>/" -H "Authorization: Bearer <APIFY_TOKEN>" \
     -H "Content-Type: application/json" -d '{"urls": ["etsy.com", "amazon-prime-refunds.com"]}'

The standby URL is shown on the Actor's Standby tab. One charge per site checked; failed checks aren't charged. Up to 10 sites per request.

Via MCP:

https://mcp.apify.com/?tools=actors,docs,centorprat/website-trust-scam-check

Batch input (regular run)

Field	Type	Description
urls	array	Websites or domains.
datasetId	dataset	…or read sites from another dataset (url / website / domain).
maxSites	integer	Cap per run (default 50).
webhookUrl	string	POST the verdicts here.

Use cases

• Agentic commerce: check the merchant before an agent pays, especially with agent wallets.
• Link safety: check a URL before an assistant opens it or recommends it to a user.
• Marketplaces & affiliate networks: screen new merchant / publisher sign-ups in batch.
• Customer support: answer "is this site legit?" with evidence.
• Brand protection: spot domains impersonating your brand (pair with the Lookalike Domain Finder).

Ready-made tasks

• Is This Website Legit? Scam & Trust Check
• Merchant Risk Check for AI Agents (Pre-Payment)
• Phishing & Brand Impersonation Domain Check

FAQ

Does it visit the site? One normal homepage request (like a browser), plus public DNS, RDAP and a TLS handshake. Nothing is submitted and no probing is done.

Is "allow" a guarantee? No. A clean result means no risk signals were found, not that a merchant is honest. A "block" is a strong reason not to pay, not a legal finding.

Why might a real small shop get "caution"? Young domains, missing refund/contact pages or no email set-up all lower trust, because those are what scam stores look like too. The flags list exactly what to verify.

How fresh are the blocklists? They're loaded at run start (and refreshed hourly in Standby mode) from the live feeds.

Cost? One site-checked event per site. No external API key or paid scraper behind it.

Related actors

• Crypto Address Risk & AML Screener
• Shopify Dropshipping & Trust Checker