DEV Community

Edison Flores
Edison Flores

Posted on

Your AI recommended a store. Is it a scam? (Free API, no auth, transparent heuristics)

#ai #agents #security #webdev

The problem

AI agents increasingly recommend products, stores, and URLs to users. But when an agent says "this store looks good," there's no automatic check of whether the store is a scam.

Commercial services like WHOISXML, IPQualityScore, and CheckPhish sell domain reputation data — but they're paid, require API keys, and are black boxes. You can't see why they flagged a domain.

What we built

A free domain reputation checker with transparent heuristics. No API key. No registration. CORS open.

Try it live: https://www.marketnow.site/scam-checker.html

API:

curl "https://www.marketnow.site/api/scam-check?domain=example.com"
Enter fullscreen mode Exit fullscreen mode

Response:

{
  "domain": "example.com",
  "decision": "TRUSTED",
  "risk_score": 0,
  "reasons": [],
  "checks": {
    "url_shortener": { "triggered": false, "detail": "Not a known URL shortener" },
    "suspicious_tld": { "triggered": false, "detail": "TLD not in suspicious list" },
    "typosquatting": { "triggered": false, "detail": "No typosquatting pattern matched" },
    ...
  }
}
Enter fullscreen mode Exit fullscreen mode

What it checks (8 heuristics)

  1. URL shorteners — bit.ly, tinyurl, t.co and 20+ others. Destination hidden, cannot inspect final URL.
  2. Suspicious TLDs — .zip, .xyz, .top, .click and 20+ others commonly abused for spam.
  3. Punycode/IDN — internationalized domains that imitate legitimate brands (homograph attacks).
  4. Typosquatting — amaz0n, paypa1, app1e. Uses Levenshtein distance to detect 1-character typos of popular brands.
  5. Domain age — checks if domain is in known-popular list (established domains).
  6. Subdomain abuse — deep subdomain chains and brands in subdomains of unrelated roots.
  7. HTTP tokens — @, //, long numeric sequences in the domain.
  8. SSL — checks if domain is in popular list (SSL assumed valid).

How agents should use this 

import requests

def is_safe_to_recommend(url):
    result = requests.get(
        f"https://www.marketnow.site/api/scam-check?domain={url}"
    ).json()

    if result["decision"] == "SUSPICIOUS":
        return False, result["reasons"]
    elif result["decision"] == "CAUTION":
        return None, result["reasons"]  # Let user decide
    else:
        return True, []
Enter fullscreen mode Exit fullscreen mode

Honest limitations

This is heuristic v1. No threat feeds. A new, clean scam returns UNKNOWN, not TRUSTED.

What this means:

  • We can detect patterns that scammers commonly use (shorteners, suspicious TLDs, typosquatting)
  • We cannot detect a brand-new scam site that uses a normal TLD and doesn't typosquat
  • The check is transparent — every decision shows exactly which heuristics triggered and why

This is not a substitute for commercial threat intelligence. It's a free, transparent first check that agents can call without an API key.

Why this is different

Feature Commercial (WHOISXML, IPQualityScore) UTA Scam Checker
Price Paid Free
API key Required Not required
Transparency Black box Every check shows its reasoning
CORS Usually closed Open
Cacheable No Yes (5 min cache)
Registration Required Not required

Use case: AI agents that recommend products

If you're building an agent that recommends products or stores (product research, dropshipping, affiliate), the agent should check the domain before recommending:

# Before the agent recommends a store
safe, reasons = is_safe_to_recommend("suspicious-store.xyz")
if not safe:
    agent_response = f"I cannot recommend this store. Reasons: {reasons}"
else:
    agent_response = f"This store looks safe to explore."
Enter fullscreen mode Exit fullscreen mode

Try it

This is the first "policy pack" for UTA (Universal Trust Adapter). The scam checker runs alongside the credential verification pipeline. Both are free, no auth, CORS open.

Top comments (0)