API REFERENCE

Scam Archive API

A free, read-only JSON API for accessing the Scam Archive database. No authentication required. All endpoints return application/json.

No auth required Read-only Free to use Base URL: https://scamarchive.org

Scams

GET /api/scams

List and search all scams. Supports filtering, sorting, and pagination.

Query Parameters

Parameter	Type	Description
`q`	string	Search across title, description, category, channels, and tags.
`channel`	string	Filter by delivery channel. e.g. "email", "sms".
`category`	string	Filter by scam category. e.g. "phishing".
`verified`	"true" \| "false"	Filter by verification status.
`sort`	"az" \| "recent" \| "reports" \| "risk"	Sort order. Defaults to "az".
`limit`	number	Max results to return. Omit for all.
`offset`	number	Pagination offset. Defaults to 0.

Example Request

GET https://scamarchive.org/api/scams?q=paypal&sort=recent&limit=5

Response Shape

{
  "meta": {
    "total": 42,
    "returned": 5,
    "offset": 0,
    "limit": 5,
    "query": { "q": "paypal", "sort": "recent", ... }
  },
  "filters": {
    "categories": ["phishing", "refund-invoice", ...],
    "channels": ["Email", "SMS/Text", ...]
  },
  "rows": [
    {
      "id": "paypal-invoice-scam",
      "title": "PayPal Invoice Scam",
      "desc": "...",
      "category": "phishing",
      "channels": ["Email"],
      "risk": "High",
      "verified": false,
      "variationsCount": 4,
      "reports": 0,
      "lastSeen": "2025-11-01T00:00:00.000Z",
      "hero": "/images/paypal-invoice-scam/...",
      "tags": ["PayPal", "Invoice", ...]
    }
  ]
}

GET /api/scams/{id}.json

Retrieve a single scam and all its variations by scam ID (slug).

Path Parameters

Parameter	Description
`id`	The scam slug, e.g. `paypal-invoice-scam`

Example Request

GET https://scamarchive.org/api/scams/paypal-invoice-scam.json

Response Shape

{
  "post": {
    "id": "paypal-invoice-scam",
    "slug": "paypal-invoice-scam",
    "data": {
      "scamName": "PayPal Invoice Scam",
      "category": "phishing",
      "severity": "High",
      "description": "...",
      "howItWorks": [...],
      "dos": [...],
      "donts": [...],
      "tags": [...]
    }
  },
  "variations": [
    {
      "id": "paypal-invoice-scam/armory",
      "title": "Armory PayPal Invoice",
      "channel": "Email",
      "dateObserved": "2025-10-01",
      "images": ["/images/paypal-invoice-scam/armory.png"],
      "navigation": "/scams/paypal-invoice-scam/armory"
    }
  ]
}

Variations

Each scam has one or more variations — specific real-world instances with their own screenshots, channel, and observed date.

GET /api/variations

List and search all variations across every scam. Supports filtering by scam, channel, and severity.

Query Parameters

Parameter	Type	Description
`q`	string	Search across title, description, scam name, and tags.
`scam`	string	Filter by parent scam slug. e.g. paypal-invoice-scam
`channel`	string	Filter by delivery channel. e.g. "email", "sms".
`severity`	string	Filter by severity. e.g. "high".
`sort`	"recent" \| "az"	Sort order. Defaults to "recent".
`limit`	number	Max results to return. Omit for all.
`offset`	number	Pagination offset. Defaults to 0.

Example Request

GET https://scamarchive.org/api/variations?scam=remote-job-offer-text-scam&sort=recent

Response Shape

{
  "meta": {
    "total": 8,
    "returned": 8,
    "offset": 0,
    "limit": null,
    "query": { "q": "", "scam": "remote-job-offer-text-scam", "channel": "", "severity": "", "sort": "recent" }
  },
  "rows": [
    {
      "id": "remote-job-offer-text-scam/robert-half",
      "scamSlug": "remote-job-offer-text-scam",
      "variationSlug": "robert-half",
      "scamName": "Remote Job Offer Text Scam",
      "title": "Robert Half text job offer $250-$500/day",
      "description": "...",
      "channel": "SMS (iMessage)",
      "dateObserved": "2025-10-13",
      "severity": "High",
      "images": ["/images/remote-job-offer-text-scam/robert-half-team.png"],
      "tags": ["Robert Half", "Remote Job", "SMS"],
      "associations": ["+1 (202) 651-1350"],
      "url": "/scams/remote-job-offer-text-scam/robert-half"
    }
  ]
}

Identifiers

Identifiers are phone numbers, email addresses, domains, and other IOCs (indicators of compromise) extracted from scam variations.

GET /api/identifiers

List and search all identifiers with appearance counts and category breakdowns.

Query Parameters

Parameter	Type	Description
`q`	string	Search across value, kind, and top categories.
`kind`	string	Filter by identifier type. e.g. "phone", "email", "domain".
`category`	string	Filter by scam category the identifier appears in.
`min`	number	Minimum number of appearances. Defaults to 0.
`sort`	"appearances" \| "kind" \| "az"	Sort order. Defaults to "appearances".
`limit`	number (1–500)	Max results. Defaults to 100.
`offset`	number	Pagination offset. Defaults to 0.

Example Request

GET https://scamarchive.org/api/identifiers?kind=phone&min=2&sort=appearances

Response Shape

{
  "meta": {
    "total": 38,
    "returned": 10,
    "offset": 0,
    "limit": 100,
    "query": { "q": "", "kind": "phone", "min": 2, "sort": "appearances" }
  },
  "rows": [
    {
      "kind": "phone",
      "value": "+1 (202) 651-1350",
      "normalized": "+12026511350",
      "slug": "+12026511350",
      "summary": {
        "appearances": 3,
        "top": [
          { "name": "phishing", "count": 2 },
          { "name": "investment", "count": 1 }
        ],
        "more": 0
      }
    }
  ]
}

GET /api/identifiers/{slug}

Look up a specific identifier. Returns full appearance history and co-occurring identifiers seen in the same scams.

Path Parameters

Parameter	Description
`slug`	Normalized identifier slug from the list endpoint, e.g. `+12026511350`

Query Parameters

Parameter	Default	Description
`co`	1	Include co-occurrences. Set to `0` to omit.
`apps`	1	Include appearance list. Set to `0` to omit.

Example Request

GET https://scamarchive.org/api/identifiers/+12026511350

Response Shape

{
  "identifier": {
    "kind": "phone",
    "value": "+1 (202) 651-1350",
    "normalized": "+12026511350",
    "slug": "+12026511350"
  },
  "stats": {
    "appearancesCount": 2,
    "firstSeen": "2025-10-13",
    "lastSeen": "2025-10-13"
  },
  "appearances": [
    {
      "scamId": "remote-job-offer-text-scam",
      "variationSlug": "robert-half",
      "scamName": "Remote Job Offer Text Scam",
      "url": "/scams/remote-job-offer-text-scam/robert-half",
      "channel": "SMS (iMessage)",
      "firstSeen": "2025-10-13",
      "lastSeen": "2025-10-13",
      "primaryImage": "/images/...",
      "excerpt": "..."
    }
  ],
  "cooccurrences": [
    {
      "kind": "phone",
      "value": "+63 951 926 0696",
      "normalized": "+639519260696",
      "count": 1,
      "url": "/identifiers/+639519260696"
    }
  ]
}

Notes

• All endpoints are read-only. No API key is required.
• Responses are cached between 60 seconds and 5 minutes. Build with that in mind.
• /api/scams/{id}.json is statically generated at build time. /api/scams and the identifier endpoints are server-rendered.
• If you build something with this API, we'd love to know — reach out via the report page.