Bewary is a ScamAdviser alternative for apps and agents

At a glance

ScamAdviser is a website trust score service

ScamAdviser's API page, read November 12, 2026, describes a Domain Trust Score API that takes only a website address. Its OpenAPI specification defines the main output as a Trust Score from 0, very likely a scam, to 100, very likely legitimate.

ScamAdviser's API page says domain records can include reasons for the score, WHOIS data and aggregated consumer reviews. Its documentation says a result-mapper attached to the customer's API key determines which fields the customer receives.

ScamAdviser's consumer page describes a service for shoppers judging websites before buying. Its business page offers API access, feeds and analysis tools to law enforcement, security firms, consumer authorities and brand protection agencies.

ScamAdviser's documentation says hidden ownership details and GDPR have reduced the value of WHOIS in its Trust Score.

Bewary returns typed scam detection answers

Bewary is a scam detection API and MCP server for apps and AI agents. It checks domains, links, IP addresses, phone numbers, SMS short codes, email addresses, crypto wallets, IBANs, mobile apps and payment handles.

Each lookup returns a typed JSON envelope containing verdict, p_scam, reason_codes, classification and entities with typed facts and the datasets checked. Its signals identify the source class, weight, dataset and coverage.

The verdict is scam, suspicious, safe or unknown. Unknown means the evidence was insufficient or a source failed. Your code should never treat unknown as safe.

The remote MCP server at https://api.bewary.app/mcp runs the same code as the REST API. Its tools support Claude, ChatGPT, Cursor, VS Code and other MCP clients over streamable HTTP, returning outputSchema and structuredContent.

Bewary also finds related domains and assesses a profile's contact points. Those operations have their own typed responses in the OpenAPI specification.

Bewary's responses follow contract version 1.16.0. Within /v1, changes add fields, enum values and reason codes without renaming or removing existing ones. Stable reason-code names let your app store a decision and branch on the code that decided it.

ScamAdviser offers consumer review data and website feeds

ScamAdviser documents consumer-review coverage alongside its website score. Its OpenAPI specification names reviews from Trustpilot, Sitejabber, MyWOT and ScamAdviser's own users.

On November 12, 2026, ScamAdviser's API page reported 30,778,253 websites in its database, including 2,631,881 scam websites. The same page reported more than 4.5 million consumers a month and over 1 million new sites analyzed.

Bewary's scam list held 715,887 active domains on November 6, 2026. ScamAdviser's website database and Bewary's scam list are different collections.

ScamAdviser's own description says its algorithm draws on more than 40 sources, including server IP addresses, website contact details, domain age and review-site ratings. Its API page also describes alerts when an approved domain's Trust Score rises or falls, supporting ongoing merchant monitoring.

For feed consumers, ScamAdviser's API page documents an update file every 5 minutes, rolled up hourly and daily. Its OpenAPI specification gives a Batch API limit of up to 5,000 URLs per append call.

ScamAdviser's business site also lists a Number API and an SDK for detecting and blocking scam calls, SMS and malicious websites inside an app.

Bewary differs in lookup inputs and evidence

Bewary exposes separate endpoints for email addresses, wallets, IBANs, mobile apps and payment handles. ScamAdviser's Domain Trust Score documentation specifies a website address as that API's input.

Bewary's domain lookup reads registration and expiry dates and the registrar from RDAP. It returns domain age in days as a field your code can branch on. It also returns brand-impersonation techniques, TLD scam frequency and scam list membership.

An age under 30 days raises the risk most. Age alone never makes a domain suspicious because new businesses register domains too. An age of 30 to 90 days raises risk less. An age of 90 days to a year counts a little in the domain's favor. An age over a year counts strongly in its favor. A domain on vercel.app, github.io or sites.google.com receives no credit for the platform's age.

The URL lookup follows shorteners and redirects, checks the destination domain and checks phishing and malware URL feeds. Bewary reads those feeds every hour and lists an exact malicious link instead of an entire shared publishing host.

The answer is Bewary's own verdict. Lookups use no language model, and reason_codes lists the stable codes that decided the verdict, strongest first. Signals expose the datasets and coverage behind the decision.

p_scam is an interim probability from 0 to 1, not yet calibrated against labelled data. site.p_scam_site is the one calibrated part: Bewary's verdict on a page its worker read in the last 90 days, fitted on labelled hosts and refit as the nightly audit adds labels (GET /v1/calibration/site).

GET /v1/datasets lists each dataset's geography, kind, entity coverage and active entry count. For scam lists, it also reports how many entries target each country. Your app can inspect the coverage of the datasets Bewary answers from.

A lookup keeps no record of who asked, but it can add the queried value to Bewary's data. Bewary queues a looked-up domain for its web-archive history and records a looked-up app as seen on its store.

Free use and commercial limits differ

Every call needs a key. A free key gets 1,000 credits a month, no card. Bewary's free allocation applies across its endpoints, and keyed requests have a rate limit of 600 requests a minute.

Bewary's browser checkers answer without an API key, with 10 checks a day per visitor. They include a link checker, domain age checker and phone number checker.

ScamAdviser's terms, reviewed on November 12, 2026, license the free consumer app for personal, non-commercial use only. Those terms direct business use to the paid API or feed.

ScamAdviser's documentation says its product team issues API keys. Under its quota rules, each key has a customer-specific monthly call quota, and calls beyond that quota return an error.

ScamAdviser's terms describe a non-exclusive, non-transferable, non-sublicensable business license lasting for the agreement. They also disclaim completeness and accuracy and leave responsibility for checking with the user.

Bewary publishes credit prices and ScamAdviser quotes by volume

As of November 12, 2026, ScamAdviser's API page publishes no Trust Score API price and says pricing depends on API call volume. For feeds, the same page lists no price and says pricing depends on use.

Bewary sells prepaid credits without a subscription. Prepaid credits never expire. Packs cost $20 for 10,000 credits, $100 for 60,000 credits, $500 for 375,000 credits or $2,000 for 2,000,000 credits. Rates run from $2.00 down to $1.00 per 1,000 credits.

A standard domain or URL lookup costs 1 credit. Deep domain and link lookups cost 30 credits, phone lookups with live line type cost 10 credits, and related-domain pages cost 5 credits.

POST /v1/batch accepts up to 1,000 values per call at 1 credit per item. A full batch costs 1,000 credits.

Moving a domain check from ScamAdviser to Bewary

ScamAdviser's API documentation describes a Domain Trust Score request using a website address and an API key. For an existing integration, identify the Trust Score and reason fields supplied by your key's result-mapper.

ScamAdviser's documentation recommends calling its cache endpoint first. The documentation says cached results can be up to 30 days old and an uncached live lookup can take up to 25 seconds.

GET https://api.bewary.app/v1/domain/{host} checks the same domain for 1 credit. We measured a median of 449 ms on October 23, 2026, from Europe, for an input sent for the first time. With your API key in BEWARY_API_KEY, run npx bewary domain paypal-login-secure.top --key "$BEWARY_API_KEY". The response includes verdict, reason_codes and the registration date, expiry date and registrar from RDAP.

For a full link, use GET https://api.bewary.app/v1/url to check redirects and URL feeds as well as the destination domain. Keep your handling of unknown explicit when replacing a score threshold with verdict-based decisions.

A Bewary batch returns the same envelope for each item as an individual lookup. Your app can retain per-item verdicts and reason codes when moving domain checks into a batch request.

The response contract and endpoint definitions are published at https://api.bewary.app/v1/openapi.json. Bewary also publishes TypeScript types and Python models at bewary.app/types.

Both APIs can serve different checks in one app

An app can retain ScamAdviser's documented website Trust Score and consumer-review fields while using Bewary for links and other contact points. Store the outputs separately so a review-derived score remains distinguishable from Bewary's verdict and reason codes.

For merchant monitoring, ScamAdviser's API page describes alerts after a domain's score changes. Bewary's POST /v1/assess can separately check a new seller's website, email, phone, other links and payout wallet.

Bewary's assessment returns deny when a field is scam, review when a field is suspicious, and otherwise pass. Pass means nothing Bewary holds names those contact points. It does not establish that the account is safe.

An agent can call Bewary through MCP while your app retains its existing website-score integration. Your application decides how either result affects review, navigation or payment.

Questions

Sources

1. www.scamadviser.com: About scamadviserwww.scamadviser.com/about-scamadviser
2. www.scamadviser.com: Scamadviser apiwww.scamadviser.com/scamadviser-api
3. api.scamadviser.cloud: Openapi v3.jsonapi.scamadviser.cloud/docs/openapi/openapi-v3.json
4. api.scamadviser.cloud: Docsapi.scamadviser.cloud/docs/
5. www.scamadviser.com: Terms conditionswww.scamadviser.com/terms-conditions
6. www.scamadviserbiz.comwww.scamadviserbiz.com/