A VirusTotal alternative for scam checks in apps

At a glance

VirusTotal aggregates scanning and reputation results

VirusTotal's API documentation, read November 12, 2026, describes lookups for URLs, domains and IP addresses. It also documents file lookups by MD5, SHA-1 or SHA-256 hash and uploads of new files for scanning.

Its service overview describes checks against more than 70 antivirus scanners and URL/domain blocklists. Public community members also comment on items and vote on whether they are harmful.

A URL report includes engine verdict counts for harmless, malicious, suspicious, undetected and timeout results. Individual engine results are normalized into harmless, undetected, suspicious or malicious categories.

Bewary returns a typed scam verdict

Each lookup returns the same typed JSON envelope. It includes verdict, p_scam, reason_codes, classification, entities with typed facts and datasets checked, and signals with their source class, weight, dataset and coverage.

The verdict is scam, suspicious, safe or unknown. Unknown means the evidence was insufficient or a source failed, and your app must never treat it as safe. The overall p_scam is a probability from 0 to 1 that is not yet calibrated against labelled data.

A domain's site.p_scam_site is the one calibrated part. It is Bewary's verdict on a page its worker read in the last 90 days, fitted on labelled hosts and refit as the nightly audit labels more (GET /v1/calibration/site).

The remote MCP server at https://api.bewary.app/mcp exposes 15 tools over streamable HTTP. It runs the same code as REST and returns outputSchema and structuredContent for clients including Claude, ChatGPT, Cursor and VS Code.

We measured lookup latency from Europe on October 23, 2026, sending each input for the first time, with medians of 449 ms for domains, 477 ms for links, 260 ms for IP addresses, 115 ms for phone numbers, 113 ms for SMS short codes, 211 ms for email addresses and 127 ms for wallets.

VirusTotal is stronger for files and per-engine investigation

File scanning is a reason to choose VirusTotal. Its documentation covers both hash-based retrieval and uploading a new file, while Bewary's lookup endpoints cover identifiers and links. VirusTotal also exposes individual engine assessments for teams that need to inspect disagreement between scanners.

VirusTotal's service overview says URL verdicts update as soon as a contributing vendor blocklists the URL.

Its Premium documentation reserves relationship data such as contacted or embedded domains and IP addresses for Premium. It states that Premium comes with an SLA and that request limits follow the licensed tier.

VirusTotal also maintains the official Python client vt-py. For agents, it documents an official VTAI service with REST and MCP access, plus an open source MCP server in its own GitHub organization.

VTAI is free within quotas. It requires no VirusTotal API key and uses a Bearer token.

VTAI requires no VirusTotal API key.

Bewary adds contact and payment checks with reason codes

Bewary's phone, SMS short code, email, wallet, IBAN, mobile app and payment-handle lookups cover inputs outside VirusTotal's documented API lookup set. An app can also assess a new account's contact points together through POST /v1/assess.

Bewary returns its own verdict from the evidence it checks. The reason_codes array names the codes that decided the result, strongest first. Codes are only added, never renamed, so your app can store them and branch on them.

For domains, Bewary reads registration and expiry dates and the registrar from RDAP. It checks brand imitation, TLD scam usage and whether the domain is on Bewary's scam list. The URL lookup follows shorteners and redirects, checks the destination domain and consults phishing and malware URL feeds.

A domain under 30 days old raises risk, but age alone never makes it suspicious. A domain on a shared platform gets no credit for the platform's age.

Bewary's related-domain endpoint finds shared IP addresses, name servers, certificates, registration details, page templates and tracking IDs in its own records. Each related domain carries its own verdict and relations marked strong, medium or weak. CDNs, large hosting providers, parking providers and DNS providers appear as pivots with a reason and are not followed.

Bewary reads the phishing and malware URL feeds every hour and reads new TLS certificates from certificate transparency logs. It also reads national lists, including CERT Polska's phishing domains and US Treasury OFAC wallet sanctions.

On November 6, 2026, Bewary's active scam list held 715,887 domains, 1,163 links, 14,767 phone numbers and 28,604 crypto wallets. The free GET /v1/datasets endpoint exposes dataset geography, entity coverage and active counts.

Bewary lookups use no language model, so their answers are repeatable. Responses follow contract version 1.16.0, with additive changes within /v1.

Free API allowances and commercial terms differ

VirusTotal's Public API documentation, consulted on November 12, 2026, limits a free key to 500 requests a day and 4 requests a minute. It prohibits use in commercial products or services and prohibits business workflows unless they contribute new files.

VirusTotal's getting-started documentation says breaking the Public API terms leads to a permanent ban of the person or organization.

VirusTotal's VTAI documentation, read November 12, 2026, allows 60 queries a minute and 1,000 per UTC day. A repeated lookup counts again.

VirusTotal's Terms of Service link redirects to Google Cloud's SecOps terms, which say customers may not build SecOps Services into their own applications. Confirm the licensed use with sales before choosing an embedded commercial integration.

Bewary returns 401 for lookups, MCP tool calls and CLI commands without an API key. A free key gets 1,000 credits a month, no card. Bewary allows 600 requests a minute with a key. Free endpoints, including GET /v1/datasets and the OpenAPI spec, allow 30 requests a minute without a key.

Bewary publishes prepaid prices and VirusTotal quotes Premium

Google sells VirusTotal data inside Google Threat Intelligence, a SecOps service that combines Mandiant, VirusTotal and other Google sources. Its product page, as read on November 12, 2026, publishes no Premium price. Premium subscriptions are flat annual fees with a set number of API calls, quoted by sales.

Bewary sells prepaid packs with no subscription, and purchased credits never expire. Packs cost $20 for 10,000 credits, $100 for 60,000 credits, $500 for 375,000 credits and $2,000 for 2,000,000 credits. Published rates run from $2.00 down to $1.00 per 1,000 credits.

A standard lookup costs 1 credit. A deep link or domain lookup costs 30 credits, a phone lookup with live line type costs 10, and related domains cost 5 credits a page. A batch accepts up to 1,000 values and charges 1 credit per item.

Moving a domain or link check changes the response contract

For domain reputation, VirusTotal documents a domain lookup returning reputation from contributing products and blocklists. Its classic API authenticates with an x-apikey header.

The corresponding Bewary call is GET https://api.bewary.app/v1/domain/{host}. It requires an API key and costs 1 credit for the standard lookup. The response returns the registration date, expiry date and registrar from RDAP, the brand-imitation technique, and Bewary's verdict with reason_codes.

For links, VirusTotal documents URL reputation reports with engine counts. Bewary's corresponding call is GET https://api.bewary.app/v1/url, which checks the landing destination, destination-domain facts and phishing and malware URL feeds.

Replace engine-count decision rules with explicit handling of verdict and reason_codes. Keep an unknown branch for incomplete evidence. Bewary publishes the response schema at https://api.bewary.app/v1/openapi.json, with TypeScript types and Python models at bewary.app/types.

Bewary has no file lookup, so file hash lookups and file uploads stay on VirusTotal.

Both APIs can serve different checks in one app

An app that accepts attachments and seller contact details can separate those checks. VirusTotal documents file uploads and hash reports. Bewary can assess the seller's contact points and check a destination link before the app opens it.

Keep each service's response separate in your decision logic. VirusTotal's VTAI documentation warns that a missing report or zero detections does not establish safety.

VirusTotal's overview says submitted file or page content may be shared with Premium customers. A Bewary lookup keeps no record of who asked, although the looked-up value itself can be added to Bewary's data.

Bewary queues a looked-up domain for its web-archive history and records a looked-up app as seen on its store.

Questions

Sources

1. docs.virustotal.com: How it worksdocs.virustotal.com/docs/how-it-works
2. docs.virustotal.com: Getting starteddocs.virustotal.com/reference/getting-started
3. docs.virustotal.com: Url objectdocs.virustotal.com/reference/url-object
4. docs.virustotal.com: Public vs premium apidocs.virustotal.com/reference/public-vs-premium-api
5. cloud.google.com: Secopscloud.google.com/terms/secops
6. cloud.google.com: Servicescloud.google.com/terms/secops/services
7. cloud.google.com: Threat intelligencecloud.google.com/security/products/threat-intelligence
8. docs.virustotal.com: Contributorsdocs.virustotal.com/docs/contributors
9. docs.virustotal.com: Vtai overviewdocs.virustotal.com/docs/vtai-overview
10. ai.virustotal.com: Llms.txtai.virustotal.com/llms.txt
11. github.com: Virustotal mcpgithub.com/VirusTotal/virustotal-mcp
12. github.com: Vt pygithub.com/VirusTotal/vt-py