How Bewary builds lookup verdicts
Each signal carries its code, severity, weight, source class, dataset and that dataset's coverage. Signals add up to the score behind p_scam. Bewary returns its own verdict without passing through a source's output unchanged. Lookups use no language model.
Verdict thresholds and signal rules
scam means p_scam is at least 0.80, or a critical confirmed signal sets a floor. suspicious means p_scam is 0.50 to under 0.80, or a high signal is not offset by first-party reassurance. safe requires p_scam under 0.20, no signal of medium severity or higher, and no failed source. Other results are unknown, meaning insufficient evidence or a failed source. Required source failures or timeouts mark answers degraded and prevent safe. Code must never treat unknown as safe.
0.00 Safe under 0.20, no medium or higher signal, no failed source 0.20 Unknown not enough evidence either way, or a source failed 0.50 Suspicious 0.50 or more, or a high signal not netted out 0.80 Scam 0.80 or more, or a critical confirmed signal Scam list inclusion rules
Bewary adds hosts to the scam list only when their owners are plausibly attackers. For top sites, business websites, URL shorteners and open publishing platforms, it lists exact links only. When FTC Do Not Call or FCC complaints name a number only as the caller ID, it carries PHONE_REPORTED_CALLER_ID and stays unknown unless other evidence names it, because callers can fake caller ID. IP addresses never enter the scam list because sites share them. Entries stay active while a list names them.
Dataset refresh schedules
Bewary reads phishing and malware URL feeds, FTC Do Not Call complaints, FCC complaints and CERT Polska's phishing domain list hourly. It reads Taiwan's 165 line, Germany's Federal Network Agency (BNetzA) actions against phone numbers and OFAC's wallet sanctions list daily. Hourly domain re-reads check resolution, addresses, name servers and public protective DNS refusals. A full pass takes about a week, with new listings checked within the hour. Bewary reads certificate transparency logs as certificates appear and rechecks brand imitation candidates over 3 days.
Where the data comes from
Every listed entry carries where it is from, such as a number's country or a domain's country-code TLD, and in target_countries the countries it is aimed at, from the national lists that name it: CERT Polska (PL), Taiwan's 165 line (TW), BNetzA (DE), the FTC and FCC (US). Nothing is inferred from the entry. GET /v1/datasets is free, needs no key and returns each dataset's geography and active entries. The data page lists every dataset with its live size.
How the scam library is researched
Each topic starts with a real search need and current web research. New pages keep links to the sources used for the brief, pass duplicate and factual-structure checks, and are reviewed by two independent quality models before publication. Automated checks reject templated or near-duplicate pages.
Older library pages predate source retention. They link to the FTC and FBI reporting hubs until page-specific citations are added. We do not label every pattern as trending, and publication dates only change when the content changes.
Limits and corrections
A verdict is guidance, not a guarantee. Each answer lists the datasets checked and their coverage, and p_scam is not yet calibrated against labelled data for every input.
Found an error? Send the evidence to support. We review corrections and update the page date when the published guidance changes.
Who is behind this
Bewary is a product of Reply200 Inc. The team that builds its engine is accountable for its verdicts and the scam library: what they claim, and correcting them when they turn out to be wrong.