# Website Legitimacy & Scam Check: Domain Age, SSL, VAT, LEI (`poised_beardlichen/website-legitimacy-check`) Actor

Use this when you must judge if a website or company looks legitimate before buying, partnering or clicking. Signals, not verdicts: domain age, SSL, DNS, archive, rank, look-alikes, red flags, VAT, LEI. $0.008/site, $0.004/registry check. Input: {"url":"example-shop.com"}. Output: score, flags.

- **URL**: https://apify.com/poised_beardlichen/website-legitimacy-check.md
- **Developed by:** [Isaac](https://apify.com/poised_beardlichen) (community)
- **Categories:** AI, Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

Pay per event

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Website Legitimacy & Scam Check API: Domain Age, SSL, Look-alikes, VAT and LEI

**Use this when you or your AI agent need to decide whether a website or company looks legitimate** before you buy from it, partner with it, onboard it as a supplier or click its link. Give it a URL or domain. It returns the **observable facts** in one JSON object, plus a 0–100 **signal score** with plain-English **red flags** and **positive signals**:

- 📅 **Domain age, registrar, expiry and registry status** from RDAP, the official successor to WHOIS
- 🔐 **SSL certificate** validity, issuer and dates, plus **DNS** (A, MX, SPF, DMARC, nameservers)
- ↪️ **Redirect chain** and cross-domain redirects
- 🏛️ **Wayback Machine** first-archived date and **Tranco** global popularity rank
- 🎭 **Look-alike domain detection** against 120+ commonly impersonated brands (typos like `arnazon.com`, `micros0ft.com`, brand-plus-words like `apple-id-support.net`, punycode)
- 🧾 **Page cues:** contact, about, privacy, terms and refund pages; parked or for-sale pages; "coming soon" placeholders; bot-challenge pages; risky wording ("guaranteed returns", "double your bitcoin", seed-phrase requests)
- 🏢 **Optional business mode:** an EU VAT number checked live against **VIES**, the legal entity looked up in **GLEIF** (LEI register), and a check that the company name appears on the site. A VAT number printed on the page can be detected and verified automatically

> **Signals, not verdicts.** The score summarises facts. A new or small site can be completely legitimate, and an old one can still be risky. Each result carries this disclaimer so agents pass it on.

### Why use it?

- **AI shopping and procurement agents:** check a merchant before you pay
- **Supplier and partner onboarding:** a quick KYB pre-check with VAT and LEI
- **Link safety in chatbots:** spot look-alike phishing domains before your agent visits them
- **Lead qualification:** filter out parked, for-sale and placeholder domains

No Google Safe Browsing, no paid threat feeds and no API keys. Only open, official sources.

### Input

```json
{ "url": "apify.com" }
```

```json
{ "url": "google.ie", "companyName": "Google Ireland Limited", "vatNumber": "IE6388047V" }
```

```json
{ "url": "example.com", "urls": ["shop-one.com", "shop-two.net"] }
```

### Output example (shortened)

```json
{
  "input": "apify.com",
  "signalScore": 99,
  "signalLevel": "many_positive_signals",
  "positiveSignals": ["domain registered 17 years ago", "in the global top 100k sites (Tranco #15419)", "archived by the Wayback Machine since 2007", "valid HTTPS certificate", "has contact, about, privacy or terms pages"],
  "redFlags": [],
  "domain": {"name": "apify.com", "createdDate": "2009-06-02T17:14:10Z", "registrar": "Amazon Registrar, Inc.", "ageDays": 6347},
  "tls": {"httpsValid": true, "issuer": "Amazon", "validTo": "2027-01-16T23:59:59+00:00"},
  "page": {"finalUrl": "https://apify.com", "statusCode": 200, "hasContactPage": true, "parkedOrForSale": false, "riskPhrases": []},
  "lookalike": null,
  "disclaimer": "Automated signals only, not a verdict ..."
}
```

`signalLevel` is one of `many_positive_signals` (75+), `mostly_positive` (60–74), `mixed` (40–59) or `several_red_flags` (under 40).

### Use it from the API or with AI agents

```bash
curl -X POST "https://api.apify.com/v2/acts/poised_beardlichen~website-legitimacy-check/run-sync-get-dataset-items?token=<YOUR_APIFY_TOKEN>" \
  -H "Content-Type: application/json" -d '{"url": "example-shop.com"}'
```

```python
from apify_client import ApifyClient
client = ApifyClient("<YOUR_APIFY_TOKEN>")
run = client.actor("poised_beardlichen/website-legitimacy-check").call(run_input={"url": "apify.com"})
print(next(client.dataset(run["defaultDatasetId"]).iterate_items())["redFlags"])
```

**MCP:** connect `https://mcp.apify.com/?tools=poised_beardlichen/website-legitimacy-check` to Claude, Cursor or any MCP client. Agents can also pay per call with Apify agentic payments.

### Pricing

| Event | Price |
|---|---|
| Website checked (all signals) | $0.008 |
| Business registry check (VIES and/or GLEIF) | $0.004 |

Invalid input, non-existent domains and failed registry lookups are **never charged**. Typical single checks finish in 2–6 seconds.

### FAQ

**Is a low score proof of a scam?** No. It means several warning signs were found. Read the `redFlags` list and verify independently.

**Why is the domain age missing for some sites?** Some country-code registries (for example .ie and .au) don't publish creation dates over RDAP. Then the Wayback Machine date is the best age hint.

**Do you visit the site?** Yes, once, like a normal browser request to the URL you give, to read the redirect chain and page cues. We don't run scripts, fill in forms or log in.

**Which VAT numbers work?** EU member-state VAT numbers (and XI for Northern Ireland) via the European Commission's VIES service. National services are sometimes briefly unavailable. Those lookups are retried and never charged if they fail.

**What is Tranco?** A research-grade ranking of the world's top 1 million sites, combined from several traffic lists to resist manipulation.

### Other tools by us

- [Audio & Video Transcriber (Whisper)](https://apify.com/poised_beardlichen/audio-video-transcriber): MP3, WAV, M4A and MP4 to text, timed segments and SRT subtitles at $0.006 per audio minute.
- [Bulk Email Verifier](https://apify.com/poised_beardlichen/email-verifier-bulk): syntax, MX, disposable and role-address checks at $0.30 per 1,000 emails.
- [Website Screenshot & PDF API](https://apify.com/poised_beardlichen/website-screenshot-pdf): bulk screenshots and PDFs of any page with cookie banners and pop-ups removed.
- [Website Screenshot & PDF for AI Agents](https://apify.com/poised_beardlichen/website-screenshot-pdf-agent): fast single-page screenshots and PDFs for agents, from $0.0015 per screenshot.
- [PDF to Text & Markdown with OCR](https://apify.com/poised_beardlichen/pdf-to-text-markdown-ocr): turn PDFs, DOCX and scans into clean, LLM-ready Markdown.
- [Image to Text OCR API](https://apify.com/poised_beardlichen/image-to-text-ocr): extract text from PNG, JPEG, TIFF and WebP images in 27 languages.
- [Bulk PageSpeed & Lighthouse Checker](https://apify.com/poised_beardlichen/pagespeed-lighthouse-checker): Lighthouse scores, Core Web Vitals and top fixes for many URLs.
- [Website Tech Stack Detector](https://apify.com/poised_beardlichen/tech-stack-detector): CMS, ecommerce, analytics, CDN and 7,600+ other technologies behind any website.
- [Research Paper Search](https://apify.com/poised_beardlichen/research-paper-search): arXiv, PubMed and Crossref papers plus legal open-access full text from $0.0015 per paper.
- [SEC EDGAR Financials & Filings](https://apify.com/poised_beardlichen/sec-edgar-financials): US company financials, filings and 10-K sections as compact JSON.
- [Bulk Phone Number Validator](https://apify.com/poised_beardlichen/phone-number-validator): validity, E.164 format, line type and region for any number at $0.70 per 1,000.
- [Company Contact & Profile Extractor](https://apify.com/poised_beardlichen/company-contact-extractor): generic emails, phones, socials and profile from any company website at $0.004 per site.
- [UK & Australia Company Check](https://apify.com/poised_beardlichen/company-registry-check): ABN, ACN, ASIC and Companies House status and red flags from $0.003 per company.
- [Company Careers & Open Jobs Lookup](https://apify.com/poised_beardlichen/careers-jobs-lookup): open jobs from Greenhouse, Lever, Ashby and more at $0.0015 per job.

### Support

See a false positive or a look-alike we missed? Open an issue on the **Issues** tab.

### More agent tools from Monie Tools

- [Website Screenshot & PDF for AI Agents](https://apify.com/poised_beardlichen/website-screenshot-pdf-agent): Use this when an AI agent needs a clean screenshot or PDF of a web page (cookie banners, ads, chats removed).
- [Website Tech Stack Detector — Wappalyzer Alternative](https://apify.com/poised_beardlichen/tech-stack-detector): to know what a website is built with: CMS, ecommerce platform, frameworks, analytics, ad pixels, CDN, hosting, payment and marketing tools, with versions.
- [Research Paper Search: arXiv, PubMed, Crossref + Full Text](https://apify.com/poised_beardlichen/research-paper-search): scholarly papers by topic, DOI, arXiv ID or PMID from arXiv, Crossref and Europe PMC/PubMed.
- [SEC EDGAR API: Financials, Filings & 10-K Sections](https://apify.com/poised_beardlichen/sec-edgar-financials): SEC data on a US public company: profile, standardised financials, filings, 10-K/10-Q sections or EDGAR full-text search.

# Actor input Schema

## `url` (type: `string`):

The website to check, e.g. example.com or https://shop.example.com/product. One per call; use 'urls' for a batch.

## `urls` (type: `array`):

Optional list of extra websites or domains (max 5,000).

## `companyName` (type: `string`):

Legal name to look up in the global LEI register (GLEIF) and to look for on the website. Single-site calls only.

## `vatNumber` (type: `string`):

EU VAT number with country prefix, e.g. IE6388047V, checked live against the EU VIES service. Single-site calls only.

## `lei` (type: `string`):

20-character Legal Entity Identifier to look up in GLEIF.

## `businessCheck` (type: `boolean`):

Also verify an EU VAT number printed on the page against VIES, even without the fields above. Charged only when a registry answer is delivered.

## `concurrency` (type: `integer`):

How many websites to check at once in a batch.

## Actor input object example

```json
{
  "url": "apify.com",
  "businessCheck": false,
  "concurrency": 8
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "url": "apify.com"
};

// Run the Actor and wait for it to finish
const run = await client.actor("poised_beardlichen/website-legitimacy-check").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "url": "apify.com" }

# Run the Actor and wait for it to finish
run = client.actor("poised_beardlichen/website-legitimacy-check").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "url": "apify.com"
}' |
apify call poised_beardlichen/website-legitimacy-check --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,poised_beardlichen/website-legitimacy-check"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/2YfWWmbcjgUnP1fgW/builds/pRKqHIgnfZOfxmPkm/openapi.json