Domain Security & Reputation Scanner

Investigate domains for malware, phishing, crypto scams, botnet command-and-control, sandbox observations, community reports, DNS blacklist hits, weak HTTPS headers, and certificate problems. The actor returns one normalized row per domain with a verdict, a 0–100 security score, positive source signals, and explicit coverage so an unavailable provider is never mistaken for a clean result.

Most checks need no API keys. Optional credentials activate URLHaus, ThreatFox, provider verdicts, commercial feeds, Recorded Future Triage, or your organization's MISP intelligence.

The actor performs read-only lookups. It does not submit URLs to public sandboxes or create urlscan.io scans.

Threat-intelligence coverage

Keyless checks

Check	Evidence used
PhishTank	Community-verified phishing reports
Sucuri SiteCheck	Malware and vendor blacklist results
PhishDestroy	Phishing and crypto-scam status, activity, severity, risk score, and flags
ScamSandbox	Non-safe community reports for the exact domain
urlscan.io	Presence and recency of archived scans; verdict details require a key
AlienVault OTX	Recent threat-related pulses, with popular/whitelisted-domain suppression
ThreatView	Daily high-confidence malicious domain feed
PhishStats	Related phishing URLs reported during the last 180 days
TweetFeed	Exact IOC observations from the trailing 365-day community dataset
DNS blacklists	Five domain lists and three IP lists
HTTPS posture	TLS expiry and six HTTP response-header/cookie checks

Credentialed checks

Check	Credential	Behavior
URLHaus + ThreatFox	abuse.ch Auth-Key	Checks online malware URLs and IOCs seen during the last 30 days
urlscan.io	Free or commercial API key	Retrieves verdicts for up to three recent archived scans; never submits a scan
AlienVault OTX	Optional OTX key	Uses your account quota instead of public access
PhishStats	Free or commercial psk_ key	Uses your registered daily quota
Recorded Future Triage	Triage access key	Searches analyses from the last year for extracted C2/domain evidence; never submits a sample
MISP	HTTPS instance URL + read-only key	Searches domain and hostname attributes ingested by your MISP instance
ThreatCat	Timed feed key	Matches accessible main, scam, DGA, and suspicious-domain feeds while respecting the one-request-per-second limit
VirusTotal	Free or commercial API key	Adds engine verdict counts and categories
Google Safe Browsing	Google API key	Checks HTTP and HTTPS variants for malware and social-engineering matches

MISP feeds must be enabled and fetched in your instance first; the actor searches its ingested attributes rather than downloading the public catalog per run.

Verdict and confidence semantics

verdict has three values:

• threats_detected: at least one provider or DNS blacklist returned a positive signal.
• no_threats_detected: at least one threat check completed and none returned a signal.
• inconclusive: no threat check returned an interpretable result.

isClean is true only for no_threats_detected. A clean result means “no signal was found by the completed checks at this time”; it is not a guarantee that the domain is safe.

totalFlagged counts positive providers and DNS blacklist hits; it is an evidence count, not a count of independent incidents. Use the coverage arrays to judge the result.

The securityScore begins at 100 and applies weighted deductions for threat signals, DNS blacklist hits, weak security headers, and certificate expiry. It is a triage aid, not a probability or compliance certification.

Input

Minimal input:

{
  "domains": [
    "example.com",
    "login.suspicious-domain.example"
  ]
}

Input fields:

Field	Required	Description
domains	Yes	Up to 500 domains or URLs; values are normalized and deduplicated
abuseChAuthKey	No	Activates URLHaus and ThreatFox
urlscanApiKey	No	Enables recent archived-scan verdict retrieval
otxApiKey	No	Uses your OTX quota; public lookup is used when omitted
phishStatsApiKey	No	Uses your registered PhishStats quota
triageApiKey	No	Enables read-only Triage sandbox search
threatCatApiKey	No	Timed key for permitted ThreatCat domain feeds
mispInstanceUrl	No	HTTPS base URL for your MISP instance
mispApiKey	No	Read-only MISP key; required with mispInstanceUrl
virusTotalApiKey	No	Enables VirusTotal engine analysis
safeBrowsingApiKey	No	Enables Google Safe Browsing
datasetId	No	Also append each row to an existing Apify dataset
runId	No	Copy a pipeline correlation value to each row

Secrets are submitted through secret input fields and are never written to dataset rows or logs.

Output

Example output shape:

{
  "domain": "example.com",
  "verdict": "no_threats_detected",
  "isClean": true,
  "totalFlagged": 0,
  "flaggedSources": [],
  "securityScore": 72,
  "checksCompleted": ["sucuri", "phishdestroy", "scamsandbox", "urlscan", "otx", "threatview", "phishstats", "tweetfeed", "http_security", "ssl"],
  "checksUnavailable": ["phishtank"],
  "optionalChecksNotConfigured": ["urlhaus", "threatfox", "triage", "misp", "threatcat", "virustotal", "safebrowsing"],
  "phishDestroyThreat": false,
  "scamSandboxReported": false,
  "urlscanScanCount": 42,
  "urlscanMalicious": null,
  "otxThreatFound": false,
  "threatViewListed": false,
  "phishStatsFound": false,
  "tweetFeedFound": false,
  "domainBlacklistCount": 0,
  "ipBlacklistCount": 0,
  "sslDaysUntilExpiry": 71
}

Provider fields preserve supporting evidence. true is a signal, false a completed negative lookup, and null means unavailable or not configured.

Run through the Apify API

curl -X POST \
  "https://api.apify.com/v2/acts/trovevault~domain-security-scanner/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "domains": ["example.com"],
    "runId": "incident-2026-0715"
  }'

Fetch the dataset after the run finishes:

curl \
  "https://api.apify.com/v2/datasets/DATASET_ID/items?clean=true&format=json" \
  -H "Authorization: Bearer $APIFY_TOKEN"

Operational behavior

• External provider failures are soft failures for an individual domain and appear in checksUnavailable.
• Provider responses and feeds have timeouts, retries, and size limits; feed content is never executed.
• The actor follows urlscan.io guidance by searching before any submission—and never submits.
• PhishStats anonymous access is limited by the provider; add a key for repeat or bulk workloads.
• ThreatView and other community feeds can contain false positives. Review the supporting evidence before blocking.
• DNSBL queries can be refused from some datacenter resolvers. Refused checks are not counted as hits.
• Only HTTPS MISP instances are accepted.
• The default scan performs an HTTPS HEAD request to assess response headers; it does not crawl page content.

Troubleshooting

Use the coverage arrays and run log to distinguish downtime, quotas, rejected credentials, and omitted keys. urlscan verdicts need its key; MISP needs both fields and ingested attributes; ThreatCat needs a timed feed key. HTTPS posture can lower the score without a threat signal.

Limitations

• Threat intelligence is incomplete and time-sensitive; absence from a feed is not proof of safety.
• URLHaus and ThreatFox now require an abuse.ch Auth-Key; without one they appear in optionalChecksNotConfigured.
• ScamSandbox integration uses the documented read-only community-report lookup. It does not create its longer active multi-source scan.
• urlscan integration searches existing scans only, avoiding public disclosure of user-supplied URLs.
• OTX pulses are community intelligence. The actor requires recent threat-related terms and suppresses OTX-whitelisted/popular domains, but analysts should still review context.
• TweetFeed explicitly describes its IOCs as community-reported and recommends watchlist or hunting use rather than automatic blocking.
• MISP results depend entirely on what the connected instance has ingested and what the key can access.
• Etugen is not included in this release because its public site advertises a commercial REST API but does not publish a stable endpoint, authentication contract, or response schema. A provider-issued API specification is required before an honest connector can be shipped.

Changelog

2026-07-23 — v0.2.0

• Added PhishDestroy, ScamSandbox community reports, urlscan.io, AlienVault OTX, ThreatView, PhishStats, TweetFeed, Recorded Future Triage, MISP, and ThreatCat adapters.
• Added coverage-aware verdicts, normalized positive-source lists, and explicit unavailable/not-configured checks.
• Added response limits, read-only provider behavior, parser tests, RUN_SUMMARY, and additional-dataset delivery.
• Added previously omitted securityScore, HTTPS header, TLS, and pipeline fields to the public schemas.

Support

If a provider changes its API or a result looks wrong, open an issue on the actor's GitHub repository with the domain redacted when necessary, the affected field, and the run ID. Do not include API keys or credentialized URLs.