# Website Safety & Domain Age Checker API (Scam Signals) (`tudorlane/website-safety-check`) Actor

Is this website safe? Domain age and registrar (RDAP/WHOIS), DNS (MX, SPF, DMARC), SSL certificate, HTTPS redirect, brand-lookalike detection and a 0-100 risk score with reasons. Built for AI agents checking links.

- **URL**: https://apify.com/tudorlane/website-safety-check.md
- **Developed by:** [Tudor Lane](https://apify.com/tudorlane) (community)
- **Categories:** Business, Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$5.00 / 1,000 website checks

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Website Safety & Domain Age Checker API

### Use when…

- You need quick scam/risk signals: domain age, DNS/MX/SPF/DMARC, SSL, HTTPS, lookalike hints.
- An onboarding or anti-phishing agent must score a URL before a user clicks or pays.
- You want a structured risk summary from public protocols (not a full malware sandbox).

### Try this input

Copy-paste this JSON as the Actor input (it matches a successful run / the default schema):

```json
{
  "urls": [
    "google.com",
    "paypa1-secure-login.com"
  ]
}
```

### Sample output (real run 2026-10-26)

One dataset item, shortened:

```json
{
  "input": "paypa1-secure-login.com",
  "host": "paypa1-secure-login.com",
  "registered_domain": "paypa1-secure-login.com",
  "tld": "com",
  "is_ip": false,
  "punycode": false,
  "dns": {
    "resolves": false,
    "a": [],
    "aaaa": [],
    "mx": [],
    "ns": [],
    "spf": null,
    "dmarc": null
  },
  "ssl": {
    "valid": false,
    "error": "no HTTPS on port 443 (gaierror)"
  },
  "http": {
    "error": "ConnectError"
  },
  "registration": {
    "registered": false,
    "source": "RDAP"
  },
  "domain_created": null,
  "domain_age_days": null,
  "…": "+6 more keys"
}
```

"Is this website legit?" in one call. For each domain or URL you get:

- **Domain age & registration**: created / expires dates, registrar, status, name servers (RDAP, WHOIS fallback for ccTLDs)
- **DNS**: resolves?, A/AAAA, MX, NS, SPF, DMARC
- **SSL/TLS certificate**: valid?, issuer, valid from/to, days left, certificate age
- **HTTPS**: status code, redirects, final URL, HSTS
- **Lookalike detection**: typo-squats and brand-in-domain tricks (paypa1-secure.com, amaz0n-login.net...) for 60+ banks, shops, couriers and tech brands
- **Risk score 0–100** (low / medium / high) with plain-English reasons, e.g. "domain registered 4 days ago", "looks like paypal"

### Quick start

Leave the default input (it is prefilled) and click **Start**:

```json
{"urls": ["google.com", "paypa1-secure-login.com"]}
```

### Sample output (real run, 26 Oct 2026, default input)

| input | domain_age_days | registrar | ssl valid | DMARC | risk_score | risk_level | top reasons |
|---|---|---|---|---|---|---|---|
| google.com | 10633 | MarkMonitor Inc. | true | yes | 0 | low | none |
| paypa1-secure-login.com | (not registered) | none | false | no | 90 | high | domain is not registered; looks like paypal (brand name inside a different domain); domain does not resolve |

Each row also has full `dns`, `ssl`, `http` and `registration` objects, `lookalike` and a `note`.

### Use cases

- Check a link from an email or text before an AI agent or a person clicks it.
- Vet a new supplier's or shop's website before paying.
- Flag brand lookalike or typo-squat domains in support tickets or marketplace listings.
- Bulk-screen sign-up or referral domains for very new registrations.

### Pricing

Pay per event: **$0.005 per website checked**. Invalid input is not charged.

### FAQ

**Is this a phishing blocklist?** No. It scores public registration, DNS and certificate signals. It does not use Google Safe Browsing.

**Do I need an API key?** No.

**Can I check many sites?** Yes, put them all in `urls` in one run.

### Limits & failure modes

- A low score does not prove a site is safe, and a high score means "verify", not "proven scam".
- Some country-code domains do not publish registration dates, so domain age can be empty.
- Lookalike detection covers about 60 well-known brands, not every brand.
- Sites that block cloud servers may show HTTP errors even when they work in a browser.
- Heuristic risk only — not a malware sandbox, Safe Browsing replacement, or guarantee.
- New domains look riskier by age alone; combine signals before blocking.

### Notes

The score is built from public registration, DNS and certificate signals. It is **not** a malware or phishing blocklist (Google Safe Browsing is not used because its terms forbid commercial use). A low score does not guarantee a site is safe; a high score means "be careful and verify". Sources: IANA RDAP bootstrap and registry RDAP/WHOIS servers, public DNS, the site's own TLS certificate.

# Actor input Schema

## `urls` (type: `array`):

Max 500. e.g. example.com or https://shop.example.co.uk/page

## Actor input object example

```json
{
  "urls": [
    "google.com",
    "paypa1-secure-login.com"
  ]
}
```

# Actor output Schema

## `results` (type: `string`):

One item per request.

## `dataset` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "urls": [
        "google.com",
        "paypa1-secure-login.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("tudorlane/website-safety-check").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "urls": [
        "google.com",
        "paypa1-secure-login.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("tudorlane/website-safety-check").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "urls": [
    "google.com",
    "paypa1-secure-login.com"
  ]
}' |
apify call tudorlane/website-safety-check --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,tudorlane/website-safety-check"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/1k5IYxff7n1fe143o/builds/5NyrNbEiuIWvr2MOS/openapi.json