# Country Profile Intelligence (`ntriqpro/domain-threat-intelligence-scorer`) Actor Score domain threat intelligence and security risks - **URL**: https://apify.com/ntriqpro/domain-threat-intelligence-scorer.md - **Developed by:** [daehwan kim](https://apify.com/ntriqpro) (community) - **Categories:** AI, Developer tools - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, NaN bookmarks - **User rating**: No ratings yet ## Pricing $100.00 / 1,000 charged when a domain threat intelligence analyses This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Domain Threat Intelligence Scorer Instantly check whether any domain or URL is a phishing site, malware host, or abusive IP — without running your own threat feed infrastructure. Cross-checks PhishTank, URLhaus (abuse.ch), and AbuseIPDB in parallel to produce a 0–100 threat score with grade and actionable verdict, so security teams and platforms can block threats at scale. ### What does Domain Threat Intelligence Scorer do? - Checks domains against PhishTank's verified phishing URL database via POST API - Queries URLhaus (abuse.ch) malware feed for active malicious URLs and Spamhaus/SURBL blacklist status - Resolves the domain to its IP address and checks AbuseIPDB for confidence score and total abuse reports - Extracts malware family tags (e.g. Emotet, Cobalt Strike) from URLhaus metadata - Returns a composite threat score, grade (Clean/Low/Medium/High/Critical), and specific threat flags ### Key Features - **Multi-Source Cross-Validation**: Combines PhishTank, URLhaus/abuse.ch, and AbuseIPDB for comprehensive threat intelligence across phishing, malware, and IP abuse vectors - **Scoring System**: Produces a 0–100 threat score with grades from Clean to Critical - **Threat Flag Detection**: Flags `CONFIRMED_PHISHING`, `ACTIVE_MALWARE_HOST`, `RANSOMWARE`, `BLACKLISTED`, and more - **Malware Family Identification**: Surfaces specific malware families associated with the domain from URLhaus tags - **Batch Processing**: Analyze multiple domains in a single run - **Pay Per Event**: Only $0.05 per analysis — no subscription needed ### Input | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `domains` | array | Yes | List of domains or URLs to analyze (protocol and path are stripped automatically) | ### Output Example ```json { "domain": "evil-phishing-example.com", "threatScore": 75, "grade": "High", "verdict": "High risk — active threats identified, blocking recommended", "phishingStatus": "Confirmed phishing site", "phishDetailPage": "https://www.phishtank.com/phish_detail.php?phish_id=12345", "malwareUrls": 2, "malwareBlacklisted": true, "abuseConfidence": 87, "resolvedIp": "192.0.2.45", "ipTotalReports": 234, "ipUsageType": "Data Center/Web Hosting/Transit", "threatTypes": ["Emotet", "phishing"], "flags": ["CONFIRMED_PHISHING", "MALWARE_URLS_DETECTED", "BLACKLISTED", "HIGH_ABUSE_CONFIDENCE"], "scoreBreakdown": { "phishing": 40, "malware": 20, "ipAbuse": 25, "total": 75 }, "sources": [ "PhishTank (https://www.phishtank.com)", "URLhaus / abuse.ch (https://urlhaus.abuse.ch)", "AbuseIPDB (https://www.abuseipdb.com)" ], "timestamp": "2024-01-15T10:30:00Z" } ```` ### Use Cases - **Email Security Gateways**: Enrich inbound link scanning with real-time phishing and malware verdicts - **SOC Threat Hunting**: Batch-screen domains from log files, SIEM alerts, or threat intel feeds - **Brand Protection**: Monitor for impersonation domains distributing phishing kits using your brand name - **Threat Intelligence Platforms**: Integrate domain scoring as an enrichment step in existing workflows ### Data Sources | Source | Coverage | Rate Limit | |--------|----------|------------| | PhishTank | 2M+ verified phishing URLs | Free; key increases limits | | URLhaus / abuse.ch | Active malware URL feed, Spamhaus/SURBL blacklists | Free, no key required | | AbuseIPDB | 8M+ IP abuse reports (90-day window) | Free tier: 1,000 req/day with key | ### Scoring Breakdown | Dimension | Max Points | What It Measures | |-----------|-----------|-----------------| | Phishing (PhishTank) | 40 | Verified = 40, unverified = 25, not found = 0 | | Malware (URLhaus) | 35 | 5+ active URLs = 35, 1–4 = 20, blacklisted only = 30 | | IP Abuse (AbuseIPDB) | 25 | Confidence >80% = 25, 50–80% = 15, 20–50% = 8 | ### Pricing This actor uses Pay Per Event pricing at **$0.05 per analysis**. You only pay for successful analyses. ### API Keys (Optional) Some data sources work better with API keys. Set these as environment variables: - `ABUSEIPDB_API_KEY`: Required for IP reputation lookups — [Get free key here](https://www.abuseipdb.com/register) - `PHISHTANK_APP_KEY`: Increases PhishTank rate limits — [Get free key here](https://www.phishtank.com/api_register.php) Without AbuseIPDB key, the IP abuse dimension is skipped and the max possible score is 75/100. PhishTank and URLhaus work without any keys. # Actor input Schema ## `country` (type: `string`): Country name to look up (e.g., United States, Japan, Germany) ## Actor input object example ```json { "country": "United States" } ``` # Actor output Schema ## `results` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "country": "United States" }; // Run the Actor and wait for it to finish const run = await client.actor("ntriqpro/domain-threat-intelligence-scorer").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "country": "United States" } # Run the Actor and wait for it to finish run = client.actor("ntriqpro/domain-threat-intelligence-scorer").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "country": "United States" }' | apify call ntriqpro/domain-threat-intelligence-scorer --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=ntriqpro/domain-threat-intelligence-scorer", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Country Profile Intelligence", "description": "Score domain threat intelligence and security risks", "version": "1.0", "x-build-id": "u6B2AAh62rdS5Ienf" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/ntriqpro~domain-threat-intelligence-scorer/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-ntriqpro-domain-threat-intelligence-scorer", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/ntriqpro~domain-threat-intelligence-scorer/runs": { "post": { "operationId": "runs-sync-ntriqpro-domain-threat-intelligence-scorer", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/ntriqpro~domain-threat-intelligence-scorer/run-sync": { "post": { "operationId": "run-sync-ntriqpro-domain-threat-intelligence-scorer", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "country" ], "properties": { "country": { "title": "Country Name", "type": "string", "description": "Country name to look up (e.g., United States, Japan, Germany)" } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```