DEV Community

Sumama-Jameel
Sumama-Jameel

Posted on

Scam Intelligence Network: One API for Threat Intelligence (URL, Email, Phone & Crypto)

#showdev #security #api #opensource

I’m a 14-year-old builder. My first big project using AI was trying to commercialize a threat intelligence tool. I failed to sell it. So I open-sourced it instead.

Scam Intelligence Network (SIN) is an open-source “OpenRouter for threat intelligence.” One unified API to check suspicious URLs, emails, phone numbers, and crypto addresses against 1.43 million local records + 10+ external sources + optional LLM analysis.

The Problem

Cybercrime is exploding, but checking threats is fragmented and painful:

  • You need 10–12 different APIs (VirusTotal, AbuseIPDB, HIBP, EmailRep, IPQualityScore, etc.).
  • Each has different keys, rate limits, response formats, and pricing.
  • Most solutions are either expensive, closed-source, or lack coverage for all four vectors (URL + Email + Phone + Crypto).

This is especially hard for indie developers, small security teams, and self-hosted setups.

What Scam Intelligence Network Solves

One POST request. One consistent response format. Parallel checks. Smart fallback. Local-first design.

Key Highlights:

  • 1.43 million local threat records — Instant offline detection (under 10ms). Skips external calls on matches.
  • 10+ external sources checked in parallel using asyncio.gather().
  • Unified verdict engine with weighted scoring + rule-based overrides.
  • Circuit breakers and caching for reliability.
  • Full Docker deployment + CLI tool.
  • Privacy-first and self-hostable.

Core Architecture

The system follows a clean vertical-slice + layered design:

REST/CLI Layer → Analyzer Layer → Service Layer → Infrastructure Layer → Local Threat Data
Enter fullscreen mode Exit fullscreen mode
  • Analyzer Layer — One folder per type (URL, Email, Phone, Crypto). Easy to extend.
  • Service Layer — Parallel calls to VirusTotal, AbuseIPDB, URLhaus, HIBP, IPQS, Groq LLM, etc.
  • Infrastructure — SQLite caching (with HMAC integrity), circuit breakers, rate limiting, API key auth.
  • Verdict Engine — Combines signals into HIGH/MEDIUM/LOW/CRITICAL with confidence scores.

Local blacklist check happens first — massive speed win and cost saver.

Main Features

  • Four analyzers behind a single /analyze endpoint.
  • Local + external + optional LLM reasoning (anonymized data only).
  • Quality gates and tiered confidence scoring.
  • Prometheus metrics, security headers, correlation IDs.
  • Analytics database for tracking queries.
  • Ready for monetization (tiered plans) but fully open source.

Quick Start

Docker (recommended):

git clone https://github.com/Sumama-Jameel/scam-intelligence-network.git
cd scam-intelligence-network
cp .env.example .env
docker-compose up -d
Enter fullscreen mode Exit fullscreen mode

Test it:

curl -X POST http://localhost:8000/analyze \
  -H "X-API-Key: your-key" \
  -d '{"input": "https://suspicious-site.com", "input_type": "URL"}'
Enter fullscreen mode Exit fullscreen mode

Or use the CLI:

python main.py "suspicious@example.com"
Enter fullscreen mode Exit fullscreen mode

Why I Open Sourced It

I tried selling it and failed. Couldn’t find customers or explain the value clearly. But the code is solid and catches real threats. If even one person uses it to block a phishing attempt, it was worth releasing.

Threat intelligence shouldn’t be locked behind enterprise budgets.

Competitor Comparison

Tool URL Email Phone Crypto Local DB Open Source Self-Hosted
SIN Yes Yes Yes Yes 1.43M Yes Yes
IPQualityScore Yes Yes Yes No No No No
AlienVault OTX Yes No No No No Partial No

No other open tool covers all four vectors with this level of local + parallel + resilient design.

Tech Stack & Design Choices

  • FastAPI + Python
  • SQLite for cache + analytics + auth
  • Asyncio for parallel checks
  • Vertical slice architecture for easy extension
  • Heavy focus on resilience (circuit breakers, caching, quality gates)

Get Involved

  • Run it locally or deploy on a cheap VPS.
  • Add new data sources or blocklists.
  • Share feedback or issues.

GitHub: https://github.com/Sumama-Jameel/scam-intelligence-network

What’s the biggest pain point you face with threat intelligence today — fragmented APIs, cost, or lack of coverage for certain vectors? Let me know in the comments.

Top comments (0)