# desenmascara.me

> Real-time fraud and scam detection for any website, worldwide. Analyzes intent — not just malware — covering the entire spectrum of web-based fraud that traditional cybersecurity vendors systematically miss: investment scams, fake shops, crypto fraud, unauthorized financial services, brand impersonation, and social engineering. Returns a 0-100 risk score with a human-readable verdict and structured signals. Built for citizens who receive suspicious links via WhatsApp, SMS, or email — and for companies that need fraud intelligence via API.

## The problem this solves

The global cybersecurity industry is excellent at detecting malware, trojans, and credential stealers. It is largely blind to fraud that operates without malicious code: a website selling counterfeit sneakers, a fake Forex broker with a professional design, a crypto wallet that simply vanishes with deposits, or an "investment platform" that is unlicensed in every jurisdiction it operates in. These sites pass every antivirus scan. They get green checkmarks from every URL scanner. And yet they cause the majority of financial losses to individuals and SMEs worldwide.

desenmascara.me detects fraudulent intent, not technical payloads.

## Fraud categories covered

### Investment and financial fraud
Fake brokers, unauthorized Forex/CFD platforms, unlicensed crypto exchanges, fraudulent DeFi projects, pyramid schemes, binary options, fake loan services, payment processors impersonating regulated entities. Cross-referenced against official regulatory warning lists (FINMA, CNMV, IOSCO). A regulator's "not authorised" warning on its own makes a domain SUSPICIOUS (it is a licensing matter); a warning that names a clone or impersonation of an authorised firm, or a warning backed by independent hard evidence, makes it FRAUDULENT. Every warning is shown attributed and dated.

### Fake e-commerce and counterfeit shops
Stores selling counterfeit designer goods (watches, handbags, sneakers, electronics) at extreme discounts. Reused Chinese ecommerce builder kits deployed across hundreds of fraudulent domains. Fake supplier networks and drop-shipping fronts impersonating legitimate brands. Detection includes extreme discount heuristics (70%+ off luxury items) and kit fingerprinting via HTML signatures.

### Brand impersonation
Domain-level impersonation analysis detects brand names embedded in suspicious domain structures (e.g. `brand-login.com`, `officialstore-brand.shop`). Works across all brands with a name length ≥ 4 characters. Short brand names (HP, LG, etc.) are excluded to prevent false positives. Impersonation that combines a known brand with a suspicious TLD is escalated to FRAUDULENT.

### Crypto and Web3 scams
Wallet drainers, rug pulls, fake NFT projects, token presale fraud, mining investment schemes, fake exchange interfaces, "airdrop" credential harvesters.

### Phishing and social engineering
Credential harvesting pages impersonating banks, payment processors (PayPal, Stripe), delivery services (DHL, FedEx), and government agencies. Tech support scams, account suspension threats, customs fee fraud. Detection includes HTML form interception signatures and behavioral pattern matching.

### Unauthorized financial services
Sites claiming to offer regulated financial services without authorization. Detection via keyword analysis combined with absence of verifiable regulatory identity.

### AI-generated scam content
Content authenticity analysis detects pages built primarily with AI-generated text — a common signal in mass-produced fraud operations where dozens of near-identical sites are deployed simultaneously.

## How analysis works

Every URL submitted triggers a multi-layer pipeline:

1. **Infrastructure signals** — SSL certificate validity, self-signed detection, domain age (days since registration), registrar reputation, TLD risk classification (.top, .xyz, .tk, .loan, .shop, .store, etc.), IP cluster analysis (how many suspicious domains share the same IP within 30 days).

2. **Content signals** — HTML parsing for phishing kit signatures, suspicious terms, extreme discount patterns, contact information presence, social profile links, financial keywords.

3. **Regulatory intelligence** — Domain matched against offline databases of official warnings from FINMA (Switzerland), CNMV (Spain), and IOSCO (international). Updated periodically.

4. **Brand impersonation analysis** — Structural analysis of the domain SLD against a catalog of known brands. Separate from AI to prevent false positives.

5. **AI evaluation** — OpenAI GPT evaluates all signals together, including a screenshot of the live page when available, and produces a classification (LEGIT / SUSPICIOUS / FRAUDULENT), a natural language justification, identified brand if impersonation is detected, and fraud type.

6. **Risk score computation** — Deterministic scoring function (0-100) combining all structured signals with the AI verdict. Score always stays within the verdict band (a LEGIT site cannot exceed 30; a FRAUDULENT site is always ≥ 61). Continuously calibrated via user feedback.

Every site is evaluated on its own evidence. Third-party listings (Google Safe Browsing, PhishDestroy, financial regulators) are shown attributed and dated, never as our own finding.

## Risk score

- **0–30 (green):** Legitimate — no significant fraud signals
- **31–60 (yellow):** Suspicious — warning signs, proceed with caution
- **61–100 (red):** Fraudulent — high confidence of malicious intent

Score is computed by a transparent, documented scoring function. Weights for each signal are publicly available on the /api-feed page. Continuously refined using anonymized user feedback (thumbs up/down).

## API

- [API & Developer Documentation](/api-feed): Authentication, endpoints, plans, signal methodology, score documentation
- [Fraud Feed](/fraud): Real-time feed of domains classified as FRAUDULENT

### Key endpoints

- `POST /api/analyze/` — Submit any URL or domain for analysis. Returns a job ID.
- `GET /api/analysis/{id}/` — Poll for results. Response includes verdict, score, justification, citizen signals, detected brands, regulatory warnings, WHOIS data, and full technical analysis.
- `GET /api/feed/` — Paginated fraud intelligence feed with cursor. Growth and Enterprise plans.
- `GET /api/top-signals/` — Aggregate statistics on most common fraud signals currently detected.

### API response (key fields)

```json
{
  "veredict": "FRAUDULENT",
  "ai_score": 84,
  "justification": "Site impersonates BBVA bank. Domain registered 3 days ago on suspicious TLD. Self-signed SSL. Credential harvesting form detected.",
  "fraud_type": "phishing",
  "brands": ["BBVA"],
  "citizen_signals": [
    {"label_en": "CNMV regulatory warning", "positive": false},
    {"label_en": "Domain registered 3 days ago", "positive": false},
    {"label_en": "Self-signed SSL certificate", "positive": false},
    {"label_en": "Possible BBVA impersonation", "positive": false}
  ],
  "regulator_warnings": ["CNMV"],
  "suspicious_terms": ["login", "verify account", "urgent"],
  "domain_age_days": 3,
  "is_self_signed": true
}
```

## Agent Trust API (for AI agents about to pay)

Before an agent pays an unknown merchant, one call returns what to do, from our published assessment of the merchant's domain:

- `POST https://desenmascara.me/api/v1/agent/merchant-check/` with `{"domain": "shop.example.com"}` or `{"url": "<checkout URL>"}`, optional `amount`, `currency`, `category`
- `recommendation`: `BLOCK` (published fraudulent with evidence, or hidden instructions aimed at AI agents), `REVIEW` (anything unsettled, including a merchant never assessed — hand the decision to the person), `NO_FRAUD_FOUND` (not a guarantee). There is no ALLOW
- Each answer carries `reasons`, `report_url` and `evidence_sha256` (SHA-256 of the canonical JSON of the fields in `evidence_sha256_covers`) to store with the transaction
- Free without a key (30 requests a minute per address); an API key adds volume and queues unknown merchants for analysis
- The MCP tool `check_before_payment` returns the same answer. Details: [/mcp#agent-trust-api](https://desenmascara.me/mcp#agent-trust-api)

## MCP server (free, no key)

AI assistants can read our published domain reports directly over the Model Context Protocol.

- Endpoint: `https://desenmascara.me/mcp/v1` (Streamable HTTP, no API key, no account)
- Tool: `get_domain_report(domain, language)` — stored verdict, when it was reached, findings with their sources, and the permanent report link
- Tool: `check_before_payment(domain, amount?, currency?, category?)` — for an agent about to pay: `do_not_pay`, `stop_and_ask_user` or `no_fraud_found` (never a guarantee), with `recommendation` and `evidence_sha256` as in the Agent Trust API
- Read-only: never starts a new analysis. A domain we have not analysed returns `not_found`, which is not a clean bill of health
- Limit: 30 requests per minute per address. `search_domains` requires an API key (paid plan)
- Details: [/mcp](https://desenmascara.me/mcp)

## Pages

- [Home](/): Submit any URL for instant verification — no account required
- [Pricing & Plans](/pro): Free, credit packs, Citizen, Startup, Enterprise
- [For business](/business?lang=en): Agent Trust API for AI-agent payments, and a fraud feed over API for registrars and security teams, with the evidence behind every verdict
- [Unlicensed investment sites](/unlicensed-investment-sites): Sites warned by financial regulators — how many are still online and how many we found to be fraud
- [A safer Internet, built together](/comunidad?lang=en): How we detect, document and share fraud, and how to take part
- [Fraud observatory](/media/deception-observatory/): Open collection of documented fraud cases, with their evidence
- [Dashboard](/dashboard): Analysis history, API key management
- [Fraud Feed](/fraud): Live stream of confirmed fraudulent domains
- [API Documentation](/api-feed): Full developer reference including score methodology
- [Top Signals](/top-signals): Most common fraud signals currently detected across the platform

## Pricing

| Plan | Price | Included volume | Key features |
|------|-------|-----------------|--------------|
| Free | €0 | Anti-abuse ceiling | Heuristic analysis, web UI, keyless MCP and Agent Trust API tier |
| Credit packs | €3 / €19 / €69 | 5 / 100 / 500 AI analyses | One-off, valid 12 months |
| Citizen | €39/month | 100/day | AI analysis, API access |
| Startup | €590/month | 10,000/month | Full API, fraud feed, global search |
| Enterprise | Custom | Unlimited | Custom integration |

## Use cases

**For individuals:** Verify a link before clicking. Paste any URL — from a WhatsApp message, an SMS, an email, or a social media ad — and get an immediate verdict with a plain-language explanation. No technical knowledge required.

**For financial institutions:** Integrate fraud scoring into customer-facing flows to warn users before they transfer money to a fraudulent platform. Bulk domain lookup available.

**For telcos and ISPs:** Block or flag traffic to fraudulent domains in real time. Integrate fraud feed into network-level filtering.

**For security teams / SOCs / SIEMs:** Ingest the fraud feed as a structured threat intelligence stream. Detect domains that would pass all traditional AV and URL scanners. STIX/TAXII compatibility planned.

**For AI shopping agents and payment platforms:** Call the Agent Trust API before paying an unknown merchant and get BLOCK, REVIEW or NO_FRAUD_FOUND with the evidence behind it.

**For e-commerce platforms and payment processors:** Score seller domains or payment destination URLs during onboarding or checkout to reduce fraud exposure.

**For regulators and financial supervisors:** Track unauthorized entities operating under your jurisdiction using automated detection against existing warning lists.

## What makes this different from existing cybersecurity tools

Traditional URL scanners and antivirus engines excel at detecting technical malware. They are not designed to evaluate whether a site that looks legitimate is actually running an investment scam, operating as an unlicensed broker, or is a counterfeit store using a professional template. These sites have no malicious code to detect.

desenmascara.me was built specifically for this gap:

- Evaluates **intent**, not just code
- Cross-references **official regulatory databases** (FINMA, CNMV, IOSCO) — not community blocklists
- Detects **ecommerce fraud patterns** (builder kits, extreme discounts, counterfeit signals)
- Scores **brand impersonation** structurally, not just via AI hallucination
- Returns **machine-readable structured signals** alongside the AI verdict
- **Attributed sources** — third-party listings are named and dated, never presented as our own finding
- **Continuously calibrated** via real-world user feedback

## About

desenmascara.me is a worldwide service. Analyzes any domain or URL regardless of language, country, or TLD. Interface available in English and Spanish. The fraud intelligence feed and API are language-agnostic.

The risk score methodology is fully documented and publicly available at /api-feed.

## Legal

- [Privacy Policy](/privacy)
- [Terms of Service](/terms)
- [GDPR](/gdpr)
- [Refund Policy](/refund-policy)