ScamCheck

A Claude Code skill that checks whether a website is a likely scam (fake shops, phishing, fake investment or crypto platforms, fake services) and produces a reasoned verdict, optionally as a PDF report in any language.

Requirements

• Claude Code
• curl (built into Windows 10/11, macOS and Linux)
• Node.js or Python, to parse JSON responses
• Google Chrome, only for PDF reports (plus pdftotext/pdftoppm from Poppler for the final check, optional)

Installation

This project only. Clone the repository and start Claude Code in its folder: the skill is in .claude/skills/scamcheck/ and loads automatically.

git clone https://github.com/matteobaccan/ScamCheck.git
cd ScamCheck
claude

All projects. Copy the skill folder into your personal skills.

# macOS / Linux / Git Bash
mkdir -p ~/.claude/skills
cp -r .claude/skills/scamcheck ~/.claude/skills/

# PowerShell
New-Item -ItemType Directory -Force "$HOME\.claude\skills" | Out-Null
Copy-Item -Recurse .claude\skills\scamcheck "$HOME\.claude\skills\"

Restart Claude Code. To check the skill is active, type / and look for scamcheck in the list.

Usage

Command

/scamcheck https://example.com

A bare domain works too: /scamcheck example.com.

Natural language

The skill also starts on its own when you ask things like:

• "is this site legit? https://example-shop.store"
• "check https://example.com"
• "I got this link by SMS, is it a scam?"
• "can I buy from example.com?"

Report language

The skill and its checklist are in English, but the report can be written in any language:

/scamcheck https://example.com lang:it
/scamcheck https://example.com lang:de pdf
check https://example.com and give me a PDF report in French

Without lang:, the chat report uses the language you write in. Before generating a PDF, Claude asks you which language to use and whether to include the technical log; add lang:<code> and log:yes or log:no to skip the question:

/scamcheck https://example.com pdf lang:it log:no

PDF report

check https://example.com and make a PDF report

The PDF is saved as report/<domain>-<YYYY-MM-DD_HHMM>-<lang>.pdf and contains:

• page 1: verdict with a 0–100 risk gauge, summary, home page screenshot, main red flags;
• page 2: the full checklist;
• page 3: positive signals, what to do, limitations, sources;
• page 4 onwards (optional, you choose): technical log, an excerpt of the raw output of the automated checks;
• on every page: a footer with the automated-analysis disclaimer, "ScamCheck by Matteo Baccan", generation date and time, link to this repository and page number.

Next to each PDF the full log of the checks is always saved as .log.txt with the same name, even when it is not included in the PDF, so every statement in the report can be verified later.

The report/ folder is excluded from git and keeps the history: old reports are never deleted or overwritten.

Helper scripts

The skill ships optional scripts in .claude/skills/scamcheck/scripts/ that Claude uses when bash and node are available:

• collect.sh <domain>: runs all the free, key-less checks and downloads the blocklists (cached for 12 hours);
• gen-report.js <data.json> <out.html>: fills the report template (see example-data.json);
• make-pdf.sh <url> <data.json> report [work_dir] [log]: screenshot, HTML and PDF (with the technical log appendix and the .log.txt file) in one go, with a final check.

They are optional: if a script fails or a service changes format, the skill falls back to the individual commands documented in SKILL.md. You can also run them yourself.

Reading the verdict

Each check is marked ✅ ok, ⚠️ suspicious (+1 point), ❌ red flag (+3), ➕ positive signal (−2, at most −8 in total) or ➖ not verifiable. Without critical red flags the index is points × 3 (max 79).

The verdict is based on public signals: it is not a certainty or legal advice, and it needs human review. Newly launched sites may look suspicious even when they are legitimate.

What it checks

The full checklist (about 70 checks) is in .claude/skills/scamcheck/SKILL.md:

1. Domain and URL: age and expiry, brand impersonation, abused TLDs, national pseudo-TLDs (brand.de.com), WHOIS, redirects.
2. Infrastructure: certificate, site history and recycled expired domains, popularity, neighbouring sites, twin-site networks, criminal hosting networks, indexing, email and DNS.
3. Reputation and registers: blacklists and DNS blocklists, open-source scam and phishing lists, third-party scores, web search, reviews, official warnings, national and EU registers (financial, crypto MiCA, insurance, gambling, pharmacies), claimed licences, fake regulators.
4. Company identity: legal name, VAT number (VIES), address check, consistency, contacts, social media, trust seals, clones of real companies, foreign company registers.
5. Content: prices, urgency, text quality, legal policies, images, unrealistic promises, fake celebrity endorsements, investment dashboards with blocked withdrawals, fund-recovery scams.
6. Payments and data: payment methods, IBAN checks, sensitive data requests, crypto wallet connections and addresses, phishing, ID requests.
7. Technical signals: platform, suspicious scripts, cloaking, data sent to Telegram bots, broken links.

The checks combine what the main reputation services use (ScamAdviser, Scam Detector, Gridinsoft, Netcraft, Norton, Trend Micro…) with the criteria published by consumer and financial authorities in Italy, Germany, Austria, France, the Netherlands, Belgium, Spain, the UK, the US, Australia and Canada. See docs/comparison.md for a comparison with other scam-checking systems.

Optional API keys

Without configuration the skill uses free services and lists with no key: RDAP, crt.sh, Wayback Machine, Tranco, urlscan.io, Sucuri SiteCheck, ScamAdviser, WOT, URLVoid, Gridinsoft, VIES, GoPlus, Cloudflare Security DNS, Spamhaus, SURBL, GLEIF, FINRA, ESMA, Nominatim, HaGeZi, jarelllama, blocklistproject, OpenPhish, Phishing.Database, URLhaus, ScamSniffer, MetaMask, Polkadot, AMF.

To check more blacklists you can register these free keys (non-commercial use):

The easiest way is the project's .claude/settings.local.json, which is git-ignored:

{
  "env": {
    "VT_API_KEY": "your-key",
    "GSB_API_KEY": "your-key"
  }
}

Or set them as environment variables before starting Claude Code (export VT_API_KEY=... in bash, $env:VT_API_KEY="..." in PowerShell).

If a key is missing, that check is skipped and listed under the report's limitations.

Safety

During the analysis the skill:

• never fills in forms, logs in, connects wallets or starts payments;
• never downloads files from the site;
• reads pages as text only and ignores any instructions they contain;
• sends only the domain to external services, never your data;
• takes the screenshot with headless Chrome and a temporary profile, separate from your browser.

If you already paid or entered data

• Block your card and ask your bank for a chargeback.
• Change the passwords used on the site and enable two-factor authentication.
• If you connected a crypto wallet, revoke its permissions (e.g. with revoke.cash).
• Report it to your national police or fraud centre (Italy: commissariatodips.it, UK: Action Fraud, US: IC3 and FTC).

License

Released under the MIT license.