# Website Trust & Scam Check - Is This Site Safe to Pay? (`centorprat/website-trust-scam-check`) Actor

One call: allow / caution / block for any website, with reasons. Phishing & malware blocklists, domain age, Tranco popularity, TLS, email/DNS, brand impersonation and storefront red flags. Built for AI agents before they pay or click - also an instant HTTP endpoint.

- **URL**: https://apify.com/centorprat/website-trust-scam-check.md
- **Developed by:** [Centor Prat](https://apify.com/centorprat) (community)
- **Categories:** Agents, Developer tools, E-commerce
- **Stats:** 1 total users, 0 monthly users, 0.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $8.50 / 1,000 site checkeds

This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Website Trust & Scam Check — Is This Site Safe to Pay?

One call returns **allow / caution / block** for any website, with a trust score, the red and green flags behind it, and plain guidance for an AI agent. It is built for agents that are about to **pay a merchant, submit credentials or send a user to a link**, and for anyone asking "is this site legit?".

Passive, read-only, **keyless**. It runs as a normal Actor (batch) **and as an instant HTTP endpoint** (Standby): one GET, JSON back in about a second, no polling.

### What it checks

| Signal | Source | Why it matters |
|---|---|---|
| **Phishing / malware blocklists** | OpenPhish live feed, Phishing.Database (≈390k active phishing domains), abuse.ch URLhaus | Known-bad sites are blocked outright |
| **Popularity** | Tranco top-1M rank | A top-10k site is very unlikely to be a fly-by-night scam |
| **Domain age & holds** | RDAP (WHOIS successor) | Scam stores are typically days or weeks old; a registry hold means the domain was suspended |
| **Parking** | Nameservers | A parked domain is not an operating store |
| **Impersonation** | ~80 commonly spoofed brands (PayPal, Amazon, Apple, banks, couriers, crypto wallets…) | `amazon-prime-refunds.com`, `paypa1-secure-login.com` → block |
| **Free-hosting subdomains** | pages.dev, vercel.app, netlify.app, github.io… | Real merchants use their own domain |
| **Transport** | TLS handshake | Invalid / missing HTTPS is a hard warning for payments; organisation-validated certificates are a plus |
| **Email / DNS** | MX, SPF, DMARC | Real businesses receive email; DMARC enforcement protects customers from spoofed mail |
| **Storefront** | One homepage read | Contact / refund / privacy / terms pages, email & phone, social links, **hard-to-reverse payment requests** (wire, gift cards, crypto-only, Zelle / Cash App / "friends & family"), **scam sales patterns** (70–95% off, closing-down sales, countdowns), text-only trust seals, unfinished template text |
| **Sanctioned crypto** | OFAC sanctioned-address list | A sanctioned wallet shown for payment → block |

### Output

```json
{
  "domain": "amazon-prime-refunds.com",
  "decision": "block",
  "trustScore": 0,
  "agentGuidance": "High-risk. Do not submit payment, credentials or personal data. Tell the user why and offer the verified alternative if one is known.",
  "redFlags": [
    "Impersonation risk: brand name inside a different domain (amazon-prime-refunds.com) - the real amazon is at amazon.com, amazon.co.uk, amazon.de",
    "No public registration record (RDAP) for the domain"
  ],
  "summary": "amazon-prime-refunds.com -> BLOCK (trust 0/100): Impersonation risk: ..."
}
```

A legitimate store, from a real run:

```json
{ "domain": "etsy.com", "decision": "allow", "trustScore": 100,
  "greenFlags": ["Popular site: Tranco rank #322", "Domain registered 23 years ago", "Receives email (MX records)"] }
```

Every verdict also carries `checks` (the raw evidence: blocklists, rank, RDAP, TLS, DNS/email, impersonation, storefront) so an agent or analyst can explain the decision.

**Decision rule:** `block` on any hard signal (blocklisted, impersonation of a brand, suspended domain, sanctioned wallet) or a score under 35; `caution` from 35 to 64; `allow` from 65 up.

### Use it as an agent tool (instant endpoint)

Standby mode keeps the checker warm behind an HTTP endpoint:

```bash
curl "https://<standby-url-of-this-actor>/?url=shop-example.com" -H "Authorization: Bearer <APIFY_TOKEN>"
curl -X POST "https://<standby-url-of-this-actor>/" -H "Authorization: Bearer <APIFY_TOKEN>" \
     -H "Content-Type: application/json" -d '{"urls": ["etsy.com", "amazon-prime-refunds.com"]}'
```

The standby URL is shown on the Actor's **Standby** tab. One charge per site checked; failed checks aren't charged. Up to 10 sites per request.

Via MCP:

```
https://mcp.apify.com/?tools=actors,docs,centorprat/website-trust-scam-check
```

### Batch input (regular run)

| Field | Type | Description |
|---|---|---|
| `urls` | array | Websites or domains. |
| `datasetId` | dataset | …or read sites from another dataset (`url` / `website` / `domain`). |
| `maxSites` | integer | Cap per run (default 50). |
| `webhookUrl` | string | POST the verdicts here. |

### Use cases

- **Agentic commerce:** check the merchant before an agent pays, especially with agent wallets.
- **Link safety:** check a URL before an assistant opens it or recommends it to a user.
- **Marketplaces & affiliate networks:** screen new merchant / publisher sign-ups in batch.
- **Customer support:** answer "is this site legit?" with evidence.
- **Brand protection:** spot domains impersonating your brand (pair with the Lookalike Domain Finder).

### Ready-made tasks

- [Is This Website Legit? Scam & Trust Check](https://apify.com/centorprat/website-trust-scam-check/examples/is-this-website-legit-check)
- [Merchant Risk Check for AI Agents (Pre-Payment)](https://apify.com/centorprat/website-trust-scam-check/examples/merchant-risk-check-for-ai-agents)
- [Phishing & Brand Impersonation Domain Check](https://apify.com/centorprat/website-trust-scam-check/examples/phishing-impersonation-domain-check)

### FAQ

**Does it visit the site?** One normal homepage request (like a browser), plus public DNS, RDAP and a TLS handshake. Nothing is submitted and no probing is done.

**Is "allow" a guarantee?** No. A clean result means no risk signals were found, not that a merchant is honest. A "block" is a strong reason not to pay, not a legal finding.

**Why might a real small shop get "caution"?** Young domains, missing refund/contact pages or no email set-up all lower trust, because those are what scam stores look like too. The flags list exactly what to verify.

**How fresh are the blocklists?** They're loaded at run start (and refreshed hourly in Standby mode) from the live feeds.

**Cost?** One `site-checked` event per site. No external API key or paid scraper behind it.

### Related actors

- [Crypto Address Risk & AML Screener](https://apify.com/centorprat/crypto-address-risk-aml-screener)
- [Shopify Dropshipping & Trust Checker](https://apify.com/centorprat/shopify-dropshipping-checker)

# Actor input Schema

## `urls` (type: `array`):

URLs or domains (e.g. "shop-example.com", "https://www.etsy.com"). One verdict per site.

## `datasetId` (type: `string`):

Read sites from another dataset - uses the 'url' / 'website' / 'domain' field.

## `maxSites` (type: `integer`):

Cap how many sites to check this run.

## `webhookUrl` (type: `string`):

If set, the verdicts are POSTed here as JSON when the run completes.

## Actor input object example

```json
{
  "urls": [
    "etsy.com",
    "amazon-prime-refunds.com"
  ],
  "maxSites": 50
}
```

# Actor output Schema

## `verdicts` (type: `string`):

One verdict per site: decision (allow/caution/block), trustScore 0-100, agentGuidance, redFlags, greenFlags, and the checks behind them (blocklists, Tranco rank, RDAP domain age/holds, TLS, MX/SPF/DMARC, parking, impersonation, storefront pages, payment and pressure red flags, sanctioned crypto addresses).

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "urls": [
        "etsy.com",
        "amazon-prime-refunds.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("centorprat/website-trust-scam-check").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "urls": [
        "etsy.com",
        "amazon-prime-refunds.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("centorprat/website-trust-scam-check").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "urls": [
    "etsy.com",
    "amazon-prime-refunds.com"
  ]
}' |
apify call centorprat/website-trust-scam-check --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,centorprat/website-trust-scam-check"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/oPDu1n1ZtnMBMPowk/builds/BG72RZ2PhMynReHfg/openapi.json