# Threat Detector — Scam & Malware Scanner (`ferimed/threat-detector`) Actor

Scan Facebook, Instagram, TikTok, and Google for scam ads, malicious links, and fake accounts. Get severity scores and report recommendations instantly.

- **URL**: https://apify.com/ferimed/threat-detector.md
- **Developed by:** [feriel laz](https://apify.com/ferimed) (community)
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: 4.78 out of 5 stars

## Pricing

$0.50 / threat detected

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Threat Detector

Scans any public page — Facebook Ad Library, Instagram, TikTok Creative Center, Google Ads Transparency, or any website — for scam ads, malicious links, and fake accounts. Each finding gets a severity score (0–100) and a recommended action.

Built after spending too much time manually hunting phishing campaigns and fake ad accounts across platforms.

***

### What it detects

- **Scam ads** — fake prizes, phishing language, too-good-to-be-true offers (20+ built-in patterns)
- **Malicious links** — shortened URLs, suspicious domains, known dangerous TLDs
- **Fake accounts** — numeric usernames, multiple suspicious outbound links, thin content

Platforms: Facebook, Instagram, TikTok, Google, and any public URL.

***

### How to use it

1. Open the Actor and click **Try for free**
2. Paste the **URLs** you want to scan — ad library pages, search results, profiles, or any public page
3. Choose **detection modes** (scam ads / malicious links / fake accounts — or all three)
4. Optionally add **custom keywords** to flag beyond the built-in list
5. Enable **VirusTotal** if you have an API key for deeper link analysis
6. Click **Start** — results appear in the Output tab

#### Good URLs to scan

| Platform | What to paste |
|---|---|
| Facebook | `https://www.facebook.com/ads/library/?q=YOUR_KEYWORD` |
| Google Ads | `https://adstransparency.google.com/?region=anywhere` |
| TikTok | `https://ads.tiktok.com/business/creativecenter/inspiration/topads/pc/en` |
| Any website | The direct URL of any public page |

***

### Input

| Field | Description | Default |
|---|---|---|
| **URLs to scan** | Public pages to analyse | Facebook Ad Library, Google Ads, TikTok |
| **Detection modes** | scam\_ads / malicious\_links / fake\_accounts | all |
| **Custom keywords** | Extra terms to flag on top of built-in list | — |
| **VirusTotal check** | Send suspicious links to VirusTotal | off |
| **VirusTotal API key** | Free key at virustotal.com | — |
| **Max items per page** | Links to extract per page | 30 |
| **Proxy** | Apify Proxy for reliable access | off |

***

### Output

Each detected threat includes:

```json
{
  "url": "https://www.facebook.com/ads/library/?q=bitcoin",
  "platform": "facebook",
  "threatType": "scam_ad",
  "severity": "high",
  "severityScore": 64,
  "title": "Earn $5000/week from home — guaranteed!",
  "advertiser": "FastMoney2024",
  "suspiciousLinks": ["https://bit.ly/xK92mP"],
  "flaggedKeywords": ["make money fast", "guaranteed"],
  "fakeAccountSignals": [],
  "evidence": [
    "keyword: \"make money fast\"",
    "suspicious link: https://bit.ly/xK92mP"
  ],
  "recommendation": "Report this scam_ad to the platform.",
  "scannedAt": "2026-09-20T10:00:00.000Z"
}
```

Severity: `low` → `medium` → `high` → `critical` based on stacked signals.

***

### VirusTotal integration

Enable **Check links on VirusTotal** and add your API key to run every suspicious link through 70+ antivirus engines. Free accounts get 500 requests/day.

Get a free key at [virustotal.com](https://www.virustotal.com/gui/join-us).

***

### Tips

- Paste **Ad Library search URLs** with specific keywords for best results (bitcoin, free iphone, make money...)
- Add your **own keywords** for industry-specific scams (crypto, health supplements, fake scholarships...)
- Enable **Apify Proxy** if you're scanning pages that block automated access
- Treat results as a **triage list** — review high/critical findings before reporting

***

### Pricing

Pay per platform usage — you only pay for compute time. A typical scan of 5 pages costs under $0.05.

***

### Legal

Scans public pages only. No login required, no private data accessed. You're responsible for complying with each platform's terms of service and applicable laws in your jurisdiction. Do not use for surveillance or targeted harassment.

***

### Issues / requests

Open an issue via Apify Console or reach out through the messaging tab. Adding more detection patterns regularly as new scam trends appear.

# Actor input Schema

## `urls` (type: `array`):

URLs to scan for threats. Paste any public page: Facebook Ad Library, Google Ads Transparency Center, TikTok Creative Center, or any website URL. Example: https://www.facebook.com/ads/library/?q=bitcoin

## `platforms` (type: `array`):

Platforms to scan.

## `detectionModes` (type: `array`):

What to look for.

## `keywords` (type: `array`):

Add your own scam terms on top of the built-in list.

## `checkVirusTotal` (type: `boolean`):

Send suspicious links to VirusTotal for malware analysis. Needs an API key.

## `virusTotalApiKey` (type: `string`):

Free key at virustotal.com — needed if VirusTotal check is on.

## `maxPagesPerPlatform` (type: `integer`):

How many pages to scan per platform (1–100).

## `proxyConfiguration` (type: `object`):

Apify Proxy recommended for reliable platform access.

## Actor input object example

```json
{
  "urls": [
    "https://www.facebook.com/ads/library/?active_status=all&ad_type=all&country=ALL&q=bitcoin&search_type=keyword_unordered",
    "https://adstransparency.google.com/?region=anywhere",
    "https://ads.tiktok.com/business/creativecenter/inspiration/topads/pc/en"
  ],
  "platforms": [
    "facebook",
    "instagram",
    "tiktok",
    "google"
  ],
  "detectionModes": [
    "scam_ads",
    "malicious_links",
    "fake_accounts"
  ],
  "keywords": [
    "free iPhone",
    "click here to win",
    "verify your account"
  ],
  "checkVirusTotal": false,
  "maxPagesPerPlatform": 20,
  "proxyConfiguration": {
    "useApifyProxy": true
  }
}
```

# Actor output Schema

## `results` (type: `string`):

All detected threats with severity score, platform, type, and evidence.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "urls": [
        "https://www.facebook.com/ads/library/?active_status=all&ad_type=all&country=ALL&q=bitcoin&search_type=keyword_unordered",
        "https://adstransparency.google.com/?region=anywhere",
        "https://ads.tiktok.com/business/creativecenter/inspiration/topads/pc/en"
    ],
    "keywords": [
        "free iPhone",
        "click here to win",
        "verify your account"
    ],
    "proxyConfiguration": {
        "useApifyProxy": true
    }
};

// Run the Actor and wait for it to finish
const run = await client.actor("ferimed/threat-detector").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "urls": [
        "https://www.facebook.com/ads/library/?active_status=all&ad_type=all&country=ALL&q=bitcoin&search_type=keyword_unordered",
        "https://adstransparency.google.com/?region=anywhere",
        "https://ads.tiktok.com/business/creativecenter/inspiration/topads/pc/en",
    ],
    "keywords": [
        "free iPhone",
        "click here to win",
        "verify your account",
    ],
    "proxyConfiguration": { "useApifyProxy": True },
}

# Run the Actor and wait for it to finish
run = client.actor("ferimed/threat-detector").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "urls": [
    "https://www.facebook.com/ads/library/?active_status=all&ad_type=all&country=ALL&q=bitcoin&search_type=keyword_unordered",
    "https://adstransparency.google.com/?region=anywhere",
    "https://ads.tiktok.com/business/creativecenter/inspiration/topads/pc/en"
  ],
  "keywords": [
    "free iPhone",
    "click here to win",
    "verify your account"
  ],
  "proxyConfiguration": {
    "useApifyProxy": true
  }
}' |
apify call ferimed/threat-detector --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,ferimed/threat-detector"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/Gi2x9Ylh7wT3TMgTw/builds/fSrPNtHpUNKtuU6Ua/openapi.json