Open data & API
HasTrust publishes its scam-domain blocklist and per-domain trust verdicts as open data. Free for research, blocklists, security tooling and journalism — attribution required (CC BY 4.0, see below).
Looking for headline numbers instead of raw data? See the fake-webshop statistics (citable, anchored figures), the monthly Fake Shop Report (frozen editions with embeddable charts) and the live fake-webshop monitor.
Scam-domain blocklist
Our curated blocklist: domains with confirmed scam signals — the highest-confidence slice of the corpus. Updated continuously; responses are cached for 5 minutes. CORS is enabled, so you can call it straight from a browser or extension.
GET https://hastrust.com/api/blocklist{ "domains": ["example-scam.shop", "…"] }Need to know why a domain is listed? The full variant adds provenance per row — feed:<host> marks rows imported from vetted abuse feeds (the majority, URLhaus and similar); manual and watcher rows come from HasTrust's own human-confirmed review:
GET https://hastrust.com/api/blocklist/fullWrong entry? See the false-positive & removal policy — first response within 72 hours.
Research dataset — per-domain features
One row per assessed webshop with the objective features behind the score: trust score and label, RDAP registration date, first Wayback capture, the age-laundering flag, assessment timestamp and URL. This is the dataset for researchers and journalists — the blocklist tells you what we flagged, this tells you why the corpus looks the way it does.
GET https://hastrust.com/data/features.csv
GET https://hastrust.com/data/features.jsonRegenerated at most every 6 hours. Headline aggregates with citation anchors live on the statistics page; frozen monthly editions with embeddable charts in the Fake Shop Report.
Trust score — single domain (v1, stable)
The integration endpoint: keyless, CORS-open, versioned. Returns the cached verdict (score 0–100, label, assessment URL) or the blocklist flag. A domain we haven't assessed returns "status": "unknown" with a link to run the check — this endpoint never starts a live check itself, so it's safe to call in bulk.
GET https://hastrust.com/api/v1/score/<domain>curl -s 'https://hastrust.com/api/v1/score/temu.com'
{ "domain": "temu.com", "status": "assessed", "trust_score": 62,
"trust_label": "Mixed", "url": "https://hastrust.com/v/temu",
"attribution": "data: HasTrust, CC-BY 4.0 — https://hastrust.com/data" }Statuses: assessed · blocklisted (score 0) · unknown. Rate limit: 30 requests/minute per IP — for more, use the bulk blocklist above or get in touch.
Full reports — paid API
For merchant onboarding, marketplace and affiliate-network vetting, payment risk and security tools. A key unlocks the full assessment — summary, pros and cons, red flags (phrased as signals), domain age, registry and certificate facts, community outcomes and safer alternatives — and fresh=1, a live check of a shop we have never assessed (a few seconds; the result is also published at its /v/ page).
curl -s -H 'X-API-Key: ht_…' 'https://hastrust.com/api/v1/report/example-shop.com?fresh=1'Same thing as its own path (live check included): GET /api/v1/fresh/<domain>. OpenAPI 3 spec: /api/v1/openapi.json.
{ "domain": "example-shop.com", "status": "assessed", "trust_score": 34,
"trust_label": "High risk", "red_flags": ["…"], "assessed_at": 1790000000,
"usage": { "tier": "pro", "calls_left": 9412, "fresh_left": 288 } }Statuses: assessed · blocklisted · unknown (free — only charged when you ask for fresh=1). A live check we refuse before running it (not a shop, capacity) is not charged. lang=nl|de|fr|es translates the summary where a translation exists; pros, cons and red flags are English. Errors: 401 missing/invalid/expired key, 422 not a shop, 429 monthly quota used or rate limit (300/min), 503 live-check capacity for today reached.
To get a key, get in touch with your use case and expected volume — trial keys are usually issued the same day. Report data carries the same CC BY 4.0 attribution as the free endpoints.
Trust lookup — single domain
The extension's own endpoint. Returns the cached verdict when we have one (trust score 0–100, label, assessment URL); otherwise an instant domain-age signal plus a link that runs the full check.
GET https://hastrust.com/api/quick?domain=example.comcurl -s 'https://hastrust.com/api/quick?domain=temu.com'Batch lookup — up to 30 domains
One call for a whole page of links (what our extension uses on search results). Same shape as the single lookup, per domain.
GET https://hastrust.com/api/quickbatch?domains=a.com,b.com&lang=enScam-message scan
POST a message a user received; returns pattern flags, the first linked domain's verdict, per-identifier checks (email / IBAN / phone) and — budget permitting — an AI read of the tactics.
POST https://hastrust.com/api/scan
{ "message": "You won! Pay shipping to NL91…", "lang": "en" }{ "flags": ["…"], "domain": "…", "row": { … }, "ids": [ { "kind": "iban", "status": "bad", … } ], "ai": { … } }License & attribution
All data is licensed CC BY 4.0. Use it in any project, commercial or not — credit “HasTrust” with a link to hastrust.com where the data is shown or documented.
Upstream sources: domain-popularity ranks come from the Majestic Million (© Majestic, CC BY 3.0); scam-domain feeds include URLhaus by abuse.ch (CC0).
Fair use
Cache responses for at least 5 minutes and fetch server-side for anything high-volume — don't proxy every visitor through the API. Need bulk access, historical snapshots or a different format? Get in touch — we're happy to help researchers.
How verdicts are made
Methodology, signal weights and the fairness floor for new shops are documented on How we score. Assessments are refreshed continuously; the newest ones are in the RSS feed.