Scam domain blocklist: includes brand lookalikes

Bewary's scam data comes as files too: the listed domains, links, phone numbers and wallets as CSV, an RPZ zone for DNS resolvers, a STIX 2.1 bundle or a TAXII 2.1 collection, rebuilt every hour with deltas. A day pass of 5,000 credits covers every download that day. A backtest runs your own list of known bad values against Bewary's history and shows what it would have caught, and when.

Bulk files

A key enabled for bulk downloads Bewary’s assertions as files: every domain, link, phone number and wallet a lookup would answer as listed or sanctioned, live domains only, and only entries whose sources allow redistribution. Enable it on a key with PATCH /v1/keys/{id} and {"bulk": true}, signed in to your account.

Format	Path	Use it for
CSV	`GET /v1/bulk/csv`	Your own pipeline: `type,value,severity,reason_code,status,first_seen,list_count,target_countries`. Add `?type=domain` (or `url`, `phone`, `wallet`) for one kind
RPZ	`GET /v1/bulk/rpz`	A DNS resolver: a response policy zone of the live domains, its serial the file’s version
STIX 2.1	`GET /v1/bulk/stix`	A threat intelligence platform: a bundle of indicators for domains and links
TAXII 2.1	`GET /v1/taxii2/`	A TIP that pulls a collection: one read-only collection with `added_after` paging

A new version is built every hour. GET /v1/bulk is free and shows the current version, its size and what changed. Pass ?since=<version> to the CSV or STIX file for a delta: a first change column (added, changed, removed) in the CSV, and revoked: true on a removed STIX indicator. Versions are kept for 30 days. Every response carries X-Bulk-Version and an ETag, so an unchanged file answers 304.

The files carry the licence notices of the sources behind them (GET /v1/bulk/notices, free). Keep them with any copy you make.

Price: a day pass of 5,000 credits per account per UTC day, bought by the day’s first file request. Every later download that day is free, in every format.

Backtests

A backtest answers: what would Bewary have told you about the bad domains, links, numbers, emails and wallets you already know? Upload your list, with the date you learned each one if you have it, and the report shows for each whether Bewary had it before you, after you, or not at all.

Shell

curl https://api.bewary.app/v1/backtest \
  -H "Authorization: Bearer $BEWARY_API_KEY" \
  -H "Content-Type: text/csv" \
  --data-binary @known-bad.csv          # a header row type,value,reported_at: type and date optional

The call answers 202 with the report’s address. GET /v1/backtest/{id} returns its status and, when done, a summary and one result per item in upload order: outcome (caught_before, caught_after, caught, flagged, missed or before_history), what Bewary answered then and now, when Bewary first saw and listed it, and lead_hours, positive when Bewary had it first. It is answered from stored history only: no lookup is re-run.

Up to 10,000 items a request. The first 1,000 items each month are free, then each costs 1 credit like a lookup. Your upload is deleted as soon as the report is written, and the report after 7 days.

Bulk files and backtests

Bulk files

Backtests