Bewary’s scam detection API and MCP server are an APIVoid alternative

At a glance

APIVoid is a threat-intelligence API bundle

APIVoid sells a bundle of JSON threat-intelligence APIs aimed at security operations teams. Its homepage lists 20+ APIs under one subscription. The APIVoid descriptions in this comparison follow its own pages.

Its URL Reputation API takes a URL and returns a risk score based on URL security checks. Its documentation describes phishing-rule matches and a check for domains under six months old. Its Domain Reputation API checks a domain across blocklists. The IP Reputation API accepts IPv4 or IPv6 addresses.

APIVoid's Site Trustworthiness API returns a trust score from 0 to 100 aimed at identifying fraudulent web shops. APIVoid also checks email addresses for temporary or suspicious mailboxes.

According to APIVoid's documentation, all endpoints use HTTPS POST requests with JSON bodies and an X-API-Key header.

Bewary returns a typed scam verdict for apps and agents

Bewary checks links, domains, IP addresses, phone numbers, SMS short codes, email addresses, crypto wallets, IBANs, mobile apps and payment handles. It also finds related domains and assesses a seller's or profile's contact points in one request.

Each lookup returns a shared JSON envelope with verdict, p_scam, reason_codes, classification, entities and signals. The evidence includes typed facts, datasets checked and signal weights. The verdict is scam, suspicious, safe or unknown. Unknown means insufficient evidence or a failed source, and your app must never treat it as safe.

p_scam runs from 0 to 1 and is not yet calibrated against labelled data. The domain field site.p_scam_site has a separate calibration based on labelled hosts for pages a worker read within the last 90 days.

The remote MCP server at https://api.bewary.app/mcp runs the same code as REST. Its tools return outputSchema and structuredContent for clients including Claude, ChatGPT, Cursor and VS Code. The OpenAPI spec types every response.

APIVoid has broader IP checks and live target analysis

APIVoid's published IP reputation coverage is broader than Bewary's network-context lookup. Its homepage describes checks against 70+ blocklists and flags for proxy, VPN, Tor and hosting addresses. Bewary returns ownership, ASN, registry country, hosting type and reverse DNS. Bewary never puts IP addresses on its scam list because multiple sites can share an address.

APIVoid states that every call runs a fresh, live analysis of the target. A Bewary domain lookup reads the registration date, expiry date and registrar from RDAP. Bewary's verdicts draw on data it already holds, which includes Bewary's scam list, the phishing and malware URL feeds read every hour, and pages its worker read in the last 90 days.

APIVoid's Site Trustworthiness API is aimed at detecting fraudulent web shops. It returns a trust score from 0 to 100 for 10 credits per call. Bewary's domain and URL lookups return verdict, p_scam and reason_codes.

APIVoid's documentation says failed calls consume no credits. Its FAQ says it does not store or share submitted inputs. Bewary keeps no record of who asked. A looked-up domain is queued for its web-archive history. A looked-up app is recorded as seen on its store.

Bewary adds contact-point checks and a shared answer

Bewary's documented input types extend beyond the web, IP and email checks described in the cited APIVoid pages. They include phone numbers, SMS short codes, wallets, IBANs, mobile apps and payment handles. These let an app check a contact number or payout destination alongside a seller's website.

Bewary's reason_codes identify the reasons that decided a verdict, strongest first. Their names remain stable and codes are only added. Your app can store a code such as DOMAIN_LOOKALIKE_BRAND_WORD and branch on it. Related domains, assessments, watches and events use their own typed objects.

Bewary reads domain registration details from RDAP and checks brand imitation, TLD scam frequency and whether the domain is on Bewary's scam list. Its URL lookup resolves shorteners and redirects, checks the destination domain and consults phishing and malware URL feeds. On October 23, 2026, we measured from Europe a median of 449 ms for a domain lookup and 477 ms for a link, with each input sent for the first time.

Bewary lists an exact malicious link instead of the whole host when the host is a shared publishing platform, shortener or legitimate website. GET /v1/datasets exposes dataset coverage without a key. Lookup answers are Bewary's own verdicts, and lookups use no language model.

On November 6, 2026, Bewary's scam list held 715,887 domains, 14,767 phone numbers, 1,163 links and 28,604 crypto wallets as active entries. It also held 805 sanctioned wallets. Each entry stays active while some list still names it.

Bewary re-reads listed domains hourly in turn, with a full pass taking about a week and new listings read within the hour. The checks record resolution, addresses, name servers and refusals by public protective DNS resolvers. Bewary keeps each change as history.

Free use and commercial terms differ

APIVoid's pricing page, read November 12, 2026, states that there is no free plan. Companies can activate a free 30-day Basic trial without a credit card. Its FAQ says unused credits do not roll over to the next month.

Bewary offers a free API key with 1,000 credits a month, no card, on every endpoint. Lookup API calls, MCP tool calls and CLI commands require a key. The browser checkers allow 10 checks a day per visitor without one. The dataset listing and OpenAPI spec also need no key.

APIVoid's rate-limit documentation describes account-wide and per-API concurrency and requests-per-second limits. Excess requests receive HTTP 429. Bewary allows 600 requests a minute with a key. Its batch endpoint accepts up to 1,000 values, charged at 1 credit per item.

APIVoid's terms allow internal use and embedding results in your commercial products. They prohibit standalone resale of APIVoid data or results and require attribution for publicly displayed reputation or scoring results. They also prohibit using the service or its results to benchmark or publicly rank other products.

Published prices favor different usage patterns

As of November 12, 2026, APIVoid's pricing page lists Basic at $24 a month for 50,000 credits, or $20 a month billed yearly. Startup is $99 for 250,000 credits, Growth is $249 for 1,000,000, and Business is $499 for 2,500,000 a month. Their yearly-billed monthly prices are $83, $207 and $415 respectively.

APIVoid's Basic plan includes access to most APIs with no overages. Published overage prices range from $0.000515 per credit on Startup to $0.000230 on Business. APIVoid's API documentation lists Domain Reputation at 1 credit and URL Reputation at 5 credits. A URL Reputation call can take up to 60 seconds.

Bewary sells prepaid packs without a subscription. Prices are $20 for 10,000 credits, $100 for 60,000, $500 for 375,000 and $2,000 for 2,000,000. Paid credits never expire. Standard domain and URL lookups each cost 1 credit, while deep domain or URL lookups cost 30 credits.

APIVoid Basic comes to $0.48 per 1,000 Domain Reputation checks and $2.40 per 1,000 URL Reputation checks. APIVoid Business comes to about $1.00 per 1,000 URL Reputation checks. These figures are worked from APIVoid's published monthly prices. Bewary costs $2.00 down to $1.00 per 1,000 standard domain or URL lookups.

Moving a domain or URL check changes the request and response

An APIVoid Domain Reputation request and a Bewary domain lookup both accept a domain, but they answer different questions. APIVoid documents blocklist checks. Bewary returns registration facts, brand-imitation checks and a scam verdict.

Send the Bewary domain lookup with your API key using curl "https://api.bewary.app/v1/domain/paypal-login-secure.top". APIVoid documents a URL risk score from 0 to 100. Bewary returns a typed JSON envelope with verdict, p_scam, reason_codes and entities. Its p_scam is a probability from 0 to 1, not yet calibrated against labelled data.

For links, the corresponding Bewary request is GET https://api.bewary.app/v1/url. Its answer includes the landing destination and domain evidence. Replace parsing of APIVoid's URL risk score with explicit handling of Bewary's verdict, reason_codes and entities.

Keep unknown separate in your decision logic. Review any threshold built around APIVoid's score before migrating it. Bewary's interim p_scam does not establish an equivalent threshold. TypeScript types and Python models are published at bewary.app/types.

Bewary's response contract is version 1.16.0. Within v1, changes only add fields, enum values and reason codes. Nothing is renamed or removed, so a migration can retain stored reason codes as the contract expands.

Both APIs can serve distinct checks in one app

An app can assign APIVoid the IP blocklist and web-shop checks its documentation describes, while assigning Bewary phone, wallet and payment-handle lookups. A URL workflow can also retain APIVoid's published risk score alongside Bewary's redirect evidence and typed verdict.

Keep each provider's response identifiable in your decision records. APIVoid documents live target analysis, and Bewary's signals list their source class and dataset. When APIVoid's risk score and Bewary's verdict disagree, your code decides which answer wins for that check and records both.

For an AI agent, Bewary supplies a documented MCP interface. APIVoid offers an OpenAPI spec and llms.txt files for coding agents, but documents no MCP server. If your product displays APIVoid reputation results publicly, its attribution requirement still applies.

Questions

Sources

1. www.apivoid.comwww.apivoid.com/
2. docs.apivoid.com: Url reputation apidocs.apivoid.com/url-reputation-api/
3. docs.apivoid.com: Domain reputation apidocs.apivoid.com/domain-reputation-api/
4. docs.apivoid.com: Site trustworthiness apidocs.apivoid.com/site-trustworthiness-api/
5. docs.apivoid.comdocs.apivoid.com/
6. www.apivoid.com: Pricingwww.apivoid.com/pricing/
7. www.apivoid.com: Faqswww.apivoid.com/faqs/
8. docs.apivoid.com: Rate limitdocs.apivoid.com/rate-limit/
9. www.apivoid.com: Terms of servicewww.apivoid.com/terms-of-service/
10. docs.apivoid.com: Openapi specificationdocs.apivoid.com/openapi-specification/