Bewary is a urlscan alternative for typed scam checks

At a glance

urlscan.io records what a submitted page does

The urlscan.io documentation describes a URL scanner API that loads a submitted URL in a browser and records the page's behavior. Each scan preserves a screenshot, the DOM, JavaScript globals, cookies and other artifacts.

Its API documentation distinguishes submitting a URL from searching existing scans. Search accepts identifiers including a domain, IP address, AS number or hash.

The result reference describes verdicts from urlscan.io, third-party engines and the community. It also documents a maliciousness score from -100 for legitimate to 100 for malicious.

Its FAQ says scans are point-in-time snapshots and are not re-crawled. The service also publishes an official command-line tool covering its free and Pro APIs.

Bewary returns typed scam verdicts through REST and MCP

Bewary is a scam detection API and MCP server for apps and AI agents. Its lookups cover links, domains, IP addresses, phone numbers, SMS short codes, email addresses, crypto wallets, IBANs, mobile apps and payment handles.

Each lookup returns a typed JSON envelope containing verdict, p_scam, reason_codes, classification, entities and signals. Entities carry typed facts and the datasets checked. Signals identify their source class, weight, dataset and coverage.

The verdict is scam, suspicious, safe or unknown. An unknown answer means evidence was insufficient or a source failed, and your code must never treat it as safe. The overall p_scam ranges from 0 to 1 and is not yet calibrated against labelled data.

site.p_scam_site is Bewary's verdict on a page its worker read in the last 90 days. This is the one calibrated part, fitted on labelled hosts and refit as the nightly audit labels more hosts. GET /v1/calibration/site is the site calibration endpoint.

The remote MCP server at https://api.bewary.app/mcp runs the same code as REST. Its tools return the same lookup envelope with outputSchema and structuredContent for Claude, ChatGPT, Cursor, VS Code and other MCP clients. Assessments, related-domain results, watches and events have their own typed objects.

urlscan.io is stronger for browser evidence and scan search

A preserved browser session with inspectable page artifacts is urlscan.io's documented advantage. Screenshots, DOM snapshots, JavaScript globals and cookies support investigations that require evidence of what a page displayed or executed. A Bewary link verdict does not replace those artifacts. The urlscan.io free allowance provides 5,000 public scans and 10,000 result retrievals a day against Bewary's 1,000 credits a month, though urlscan.io's terms require written permission for commercial use.

The urlscan.io result reference, read on November 12, 2026, documents annotations in urlscan.io's results, including ASN, GeoIP and AdBlock data.

The urlscan.io pricing page, as read on November 12, 2026, states that its paid phishing feed flags over 25,000 malicious and phishing URLs a day across 3,000+ tracked brands. It also lists a newly observed domains feed with 6.5 billion historical domains and more than 300,000 new domains a day.

Bewary differs in input coverage, decision fields and datasets

Bewary accepts identifiers beyond the URL submission documented by urlscan.io. A phone number, SMS short code, email address, wallet, IBAN, mobile app or payment handle has its own lookup endpoint. GET /v1/domain/{host} returns registration and expiry dates and the registrar from RDAP, age in days, whether the name imitates a brand, how often its TLD is used for scams, and whether it is on Bewary's scam list. The urlscan.io brand-detection page says it does not flag a site from the domain name or URL alone and needs page content. Bewary's MCP server provides 15 tools for AI agents.

The response contract gives application code stable decision fields. reason_codes lists the codes that decided the verdict, strongest first, and codes are added without renaming. The OpenAPI spec types the responses, with published TypeScript types and Python models.

Bewary retrieves domain registration facts from RDAP, reads new TLS certificates from certificate transparency logs as they are published, and reads phishing and malware URL feeds every hour. For shared publishing platforms and URL shorteners, its listing policy records the exact malicious link rather than the whole host. The final verdict is Bewary's own assessment.

A domain lookup also identifies brand imitation techniques, including homoglyphs and typos. A domain under 30 days old raises risk, but age alone never makes it suspicious. A domain on a shared platform gets no credit for the platform's age.

Related-domain results identify connections through infrastructure, certificates, registration details, page templates or tracking IDs. Each relation carries a strength, and each related domain has its own verdict. Shared infrastructure providers appear as pivots with an explanation and are not followed.

Lookups use no language model. A lookup keeps no record of who asked. A looked-up domain is queued for its web-archive history.

The public dataset directory at GET /v1/datasets lists each dataset's geography, kind, covered entity types and active entry counts. For scam lists, it also reports how many active entries are aimed at each country.

Free tiers, rate limits and commercial use

The urlscan.io pricing page, read November 12, 2026, gives a free account 50 private, 1,000 unlisted and 5,000 public scans a day. It also gets 1,000 search requests and 10,000 result retrievals a day. Free-account search covers public scans. Searching for pages detected as malicious requires paid urlscan Pro.

Its visibility documentation says unlisted scans remain visible to vetted security companies using urlscan Pro. Its rate-limit documentation applies quotas per minute, hour and day for each action, with HTTP 429 responses above quota. The keyless quotas page shows 30 searches a minute, 100 an hour and 500 a day per caller IP.

For commercial use, urlscan.io's FAQ permits daily company work but requires prior agreement for heavy volume or commercial product integration. Its terms require written permission for any commercial use. Confirm permission before embedding scans in a product.

Every call needs a key. A free key gets 1,000 credits a month, no card. Bewary permits 600 requests a minute with a key, and its browser checkers allow 10 lookups a day per visitor without one.

Bewary's dataset directory and OpenAPI spec are available without a key. A batch accepts up to 1,000 values and charges 1 credit per item.

Published prices use different billing units

Read on November 12, 2026, the urlscan.io pricing page lists Professional at $1,250 a month, Enterprise at $2,500 a month and Ultimate at $5,000 a month. Annual prices are $5,000 for Automate, $12,500 for Professional, $25,000 for Enterprise and $50,000 for Ultimate. Automate is annual-only.

The urlscan.io pricing page, read on November 12, 2026, offers a free trial of every commercial plan for 30 days.

Bewary sells prepaid credits without a subscription, and prepaid credits never expire. Packs cost $20 for 10,000 credits, $100 for 60,000, $500 for 375,000 and $2,000 for 2,000,000. Pack prices run from $2.00 down to $1.00 per 1,000 credits.

A lookup costs 1 credit. Deep link and domain lookups cost 30 credits, live phone line type costs 10, and a related-domains page costs 5.

Moving a link check changes the response your code reads

The comparable integration question is whether a URL has evidence of phishing or malware. The documented urlscan.io call submits the URL for a browser scan, authenticated through an API-Key HTTP header from a registered account. Your integration then polls for its result.

The corresponding Bewary call is GET https://api.bewary.app/v1/url, with an API key. It checks the destination after shorteners and redirects, the destination domain's facts, and phishing and malware URL feeds. Your code reads the returned verdict and reason_codes.

Your code branches on Bewary's verdict and reason_codes in place of urlscan.io's -100 to 100 maliciousness score. The urlscan.io FAQ advises against using its malicious verdict as an automatic blocking signal and says its phishing judgments cover tracked brands.

Bewary responses follow contract version 1.16.0. Within v1, changes only add fields, enum values and reason codes, with nothing renamed or removed. Your integration should account for additions when parsing responses and branching on verdicts.

Keep the browser scan if your integration needs screenshots, DOM or cookies. For latency planning, we measured a median link lookup of 477 ms from Europe on October 23, 2026, with each input sent for the first time.

Both APIs can serve different stages of one investigation

An app can request Bewary's link verdict before deciding whether to open a URL. A trust and safety analyst can submit selected URLs to urlscan.io when an investigation requires browser artifacts. These are separate checks with different evidence.

An AI agent can call Bewary's lookup_url tool and retain reason_codes for its decision. A URL the agent flags can be submitted to urlscan.io as a private scan for human review because urlscan Pro gives vetted security companies access to unlisted scans.

For continued observation, Bewary watches domains, phone numbers, wallets and brands, with events available through GET /v1/events or signed webhooks. The snapshots documented by urlscan.io preserve the page at scan time.

A domain watch reports changes in IP addresses, name servers, availability, registration, expiry or listing. A brand watch produces events for new lookalikes. Phone number and wallet watches report listing changes.

Questions

Sources

1. docs.urlscan.io: Aboutdocs.urlscan.io/about
2. docs.urlscan.io: Result api referencedocs.urlscan.io/pages/result-api-reference
3. docs.urlscan.io: Api introdocs.urlscan.io/pages/api-intro
4. urlscan.io: Pricingurlscan.io/pricing/
5. docs.urlscan.io: Api rate limitsdocs.urlscan.io/pages/api-rate-limits
6. urlscan.io: Quotasurlscan.io/user/quotas/
7. docs.urlscan.io: Visibilitydocs.urlscan.io/pages/visibility
8. docs.urlscan.io: Faqdocs.urlscan.io/pages/faq
9. urlscan.io: Termsurlscan.io/terms/
10. docs.urlscan.io: Brand detectiondocs.urlscan.io/pages/brand-detection
11. docs.urlscan.io: Api best practicesdocs.urlscan.io/pages/api-best-practices
12. docs.urlscan.io: Quickstartdocs.urlscan.io/guides/quickstart
13. docs.urlscan.io: Cli introdocs.urlscan.io/pages/cli-intro