Website Legitimacy & Scam Check API: Domain Age, SSL, Look-alikes, VAT and LEI

Use this when you or your AI agent need to decide whether a website or company looks legitimate before you buy from it, partner with it, onboard it as a supplier or click its link. Give it a URL or domain. It returns the observable facts in one JSON object, plus a 0–100 signal score with plain-English red flags and positive signals:

• 📅 Domain age, registrar, expiry and registry status from RDAP, the official successor to WHOIS
• 🔐 SSL certificate validity, issuer and dates, plus DNS (A, MX, SPF, DMARC, nameservers)
• ↪️ Redirect chain and cross-domain redirects
• 🏛️ Wayback Machine first-archived date and Tranco global popularity rank
• 🎭 Look-alike domain detection against 120+ commonly impersonated brands (typos like arnazon.com, micros0ft.com, brand-plus-words like apple-id-support.net, punycode)
• 🧾 Page cues: contact, about, privacy, terms and refund pages; parked or for-sale pages; "coming soon" placeholders; bot-challenge pages; risky wording ("guaranteed returns", "double your bitcoin", seed-phrase requests)
• 🏢 Optional business mode: an EU VAT number checked live against VIES, the legal entity looked up in GLEIF (LEI register), and a check that the company name appears on the site. A VAT number printed on the page can be detected and verified automatically

Signals, not verdicts. The score summarises facts. A new or small site can be completely legitimate, and an old one can still be risky. Each result carries this disclaimer so agents pass it on.

Why use it?

• AI shopping and procurement agents: check a merchant before you pay
• Supplier and partner onboarding: a quick KYB pre-check with VAT and LEI
• Link safety in chatbots: spot look-alike phishing domains before your agent visits them
• Lead qualification: filter out parked, for-sale and placeholder domains

No Google Safe Browsing, no paid threat feeds and no API keys. Only open, official sources.

Input

{ "url": "apify.com" }

{ "url": "google.ie", "companyName": "Google Ireland Limited", "vatNumber": "IE6388047V" }

{ "url": "example.com", "urls": ["shop-one.com", "shop-two.net"] }

Output example (shortened)

{
  "input": "apify.com",
  "signalScore": 99,
  "signalLevel": "many_positive_signals",
  "positiveSignals": ["domain registered 17 years ago", "in the global top 100k sites (Tranco #15419)", "archived by the Wayback Machine since 2007", "valid HTTPS certificate", "has contact, about, privacy or terms pages"],
  "redFlags": [],
  "domain": {"name": "apify.com", "createdDate": "2009-06-02T17:14:10Z", "registrar": "Amazon Registrar, Inc.", "ageDays": 6347},
  "tls": {"httpsValid": true, "issuer": "Amazon", "validTo": "2027-01-16T23:59:59+00:00"},
  "page": {"finalUrl": "https://apify.com", "statusCode": 200, "hasContactPage": true, "parkedOrForSale": false, "riskPhrases": []},
  "lookalike": null,
  "disclaimer": "Automated signals only, not a verdict ..."
}

signalLevel is one of many_positive_signals (75+), mostly_positive (60–74), mixed (40–59) or several_red_flags (under 40).

Use it from the API or with AI agents

curl -X POST "https://api.apify.com/v2/acts/poised_beardlichen~website-legitimacy-check/run-sync-get-dataset-items?token=<YOUR_APIFY_TOKEN>" \
  -H "Content-Type: application/json" -d '{"url": "example-shop.com"}'

from apify_client import ApifyClient
client = ApifyClient("<YOUR_APIFY_TOKEN>")
run = client.actor("poised_beardlichen/website-legitimacy-check").call(run_input={"url": "apify.com"})
print(next(client.dataset(run["defaultDatasetId"]).iterate_items())["redFlags"])

MCP: connect https://mcp.apify.com/?tools=poised_beardlichen/website-legitimacy-check to Claude, Cursor or any MCP client. Agents can also pay per call with Apify agentic payments.

Pricing

Event	Price
Website checked (all signals)	$0.008
Business registry check (VIES and/or GLEIF)	$0.004

Invalid input, non-existent domains and failed registry lookups are never charged. Typical single checks finish in 2–6 seconds.

FAQ

Is a low score proof of a scam? No. It means several warning signs were found. Read the redFlags list and verify independently.

Why is the domain age missing for some sites? Some country-code registries (for example .ie and .au) don't publish creation dates over RDAP. Then the Wayback Machine date is the best age hint.

Do you visit the site? Yes, once, like a normal browser request to the URL you give, to read the redirect chain and page cues. We don't run scripts, fill in forms or log in.

Which VAT numbers work? EU member-state VAT numbers (and XI for Northern Ireland) via the European Commission's VIES service. National services are sometimes briefly unavailable. Those lookups are retried and never charged if they fail.

What is Tranco? A research-grade ranking of the world's top 1 million sites, combined from several traffic lists to resist manipulation.

Other tools by us

• Audio & Video Transcriber (Whisper): MP3, WAV, M4A and MP4 to text, timed segments and SRT subtitles at $0.006 per audio minute.
• Bulk Email Verifier: syntax, MX, disposable and role-address checks at $0.30 per 1,000 emails.
• Website Screenshot & PDF API: bulk screenshots and PDFs of any page with cookie banners and pop-ups removed.
• Website Screenshot & PDF for AI Agents: fast single-page screenshots and PDFs for agents, from $0.0015 per screenshot.
• PDF to Text & Markdown with OCR: turn PDFs, DOCX and scans into clean, LLM-ready Markdown.
• Image to Text OCR API: extract text from PNG, JPEG, TIFF and WebP images in 27 languages.
• Bulk PageSpeed & Lighthouse Checker: Lighthouse scores, Core Web Vitals and top fixes for many URLs.
• Website Tech Stack Detector: CMS, ecommerce, analytics, CDN and 7,600+ other technologies behind any website.
• Research Paper Search: arXiv, PubMed and Crossref papers plus legal open-access full text from $0.0015 per paper.
• SEC EDGAR Financials & Filings: US company financials, filings and 10-K sections as compact JSON.
• Bulk Phone Number Validator: validity, E.164 format, line type and region for any number at $0.70 per 1,000.
• Company Contact & Profile Extractor: generic emails, phones, socials and profile from any company website at $0.004 per site.
• UK & Australia Company Check: ABN, ACN, ASIC and Companies House status and red flags from $0.003 per company.
• Company Careers & Open Jobs Lookup: open jobs from Greenhouse, Lever, Ashby and more at $0.0015 per job.

Support

See a false positive or a look-alike we missed? Open an issue on the Issues tab.

More agent tools from Monie Tools

• Website Screenshot & PDF for AI Agents: Use this when an AI agent needs a clean screenshot or PDF of a web page (cookie banners, ads, chats removed).
• Website Tech Stack Detector — Wappalyzer Alternative: to know what a website is built with: CMS, ecommerce platform, frameworks, analytics, ad pixels, CDN, hosting, payment and marketing tools, with versions.
• Research Paper Search: arXiv, PubMed, Crossref + Full Text: scholarly papers by topic, DOI, arXiv ID or PMID from arXiv, Crossref and Europe PMC/PubMed.
• SEC EDGAR API: Financials, Filings & 10-K Sections: SEC data on a US public company: profile, standardised financials, filings, 10-K/10-Q sections or EDGAR full-text search.