# Your AI recommended a store. Is it a scam? (Free API, no auth, transparent heuristics)

> Source: <https://dev.to/edison_flores_6d2cd381b13/your-ai-recommended-a-store-is-it-a-scam-free-api-no-auth-transparent-heuristics-1god>
> Published: 2026-09-04 00:07:27+00:00

AI agents increasingly recommend products, stores, and URLs to users. But when an agent says "this store looks good," there's no automatic check of whether the store is a scam.

Commercial services like WHOISXML, IPQualityScore, and CheckPhish sell domain reputation data — but they're paid, require API keys, and are black boxes. You can't see why they flagged a domain.

A free domain reputation checker with transparent heuristics. No API key. No registration. CORS open.

**Try it live:** [https://www.marketnow.site/scam-checker.html](https://www.marketnow.site/scam-checker.html)

**API:**

```
curl "https://www.marketnow.site/api/scam-check?domain=example.com"
```

**Response:**

```
{
  "domain": "example.com",
  "decision": "TRUSTED",
  "risk_score": 0,
  "reasons": [],
  "checks": {
    "url_shortener": { "triggered": false, "detail": "Not a known URL shortener" },
    "suspicious_tld": { "triggered": false, "detail": "TLD not in suspicious list" },
    "typosquatting": { "triggered": false, "detail": "No typosquatting pattern matched" },
    ...
  }
}
python
import requests

def is_safe_to_recommend(url):
    result = requests.get(
        f"https://www.marketnow.site/api/scam-check?domain={url}"
    ).json()

    if result["decision"] == "SUSPICIOUS":
        return False, result["reasons"]
    elif result["decision"] == "CAUTION":
        return None, result["reasons"]  # Let user decide
    else:
        return True, []
```

This is **heuristic v1**. No threat feeds. A new, clean scam returns UNKNOWN, not TRUSTED.

What this means:

This is not a substitute for commercial threat intelligence. It's a free, transparent first check that agents can call without an API key.

| Feature | Commercial (WHOISXML, IPQualityScore) | UTA Scam Checker |
|---|---|---|
| Price | Paid | Free |
| API key | Required | Not required |
| Transparency | Black box | Every check shows its reasoning |
| CORS | Usually closed | Open |
| Cacheable | No | Yes (5 min cache) |
| Registration | Required | Not required |

If you're building an agent that recommends products or stores (product research, dropshipping, affiliate), the agent should check the domain before recommending:

```
# Before the agent recommends a store
safe, reasons = is_safe_to_recommend("suspicious-store.xyz")
if not safe:
    agent_response = f"I cannot recommend this store. Reasons: {reasons}"
else:
    agent_response = f"This store looks safe to explore."
```

`GET https://www.marketnow.site/api/scam-check?domain=example.com`

*This is the first "policy pack" for UTA (Universal Trust Adapter). The scam checker runs alongside the credential verification pipeline. Both are free, no auth, CORS open.*