Apex Intelligence
A smart website scanner that exposes hidden internet scams
Up until now my tool was only a text based scraper. It would scan a suspicious link and spit out the code, hidden trackers, and text. But scammers are smart sometimes the underlying code looks completely harmless, but the actual webpage is a obvious fake login screen or scam shop.
I built a disposable "cloud camera" to look at the sites for me. It uses Python and Microsoft Playwright, running completely isolated on a Railway server.
Here is how it works:
The Sandbox: You paste a sketchy link into the app.
The Cloud Browser: My server spins up an invisible, temporary web browser miles away from my actual computer.
The Snapshot: It safely opens the link, snaps a screenshot and then instantly destroys the fake browser.
The Evidence: It sends that screenshot straight to the dashboard.
The Result: Now instead of just reading lines of code you can look right at a fully rendered phishing site safely. You don't have to risk your device, you'll instantly know exactly what the attacker is trying to pull.
Come check it out! https://apexthreat.io/
Staying up for long hours and learning from website crash after crash has finally paid off. I’m incredibly excited to announce a huge change for Apex Intelligence
By upgrading the scanning engine I’ve been able to successfully map the shadow supply chain behind spam attacks.
Here is what is actually happening behind the scenes of a scam:
The Illusion: Scammers who send phishing emails rarely process the stolen data themselves.
The Drop Zone: They rely on pre built templates that route a victim's typed passwords, emails, or credit card numbers to hidden, third party servers.
The Shadow Market: These "Drop Zones" are more often than not run by higher-level data brokers who sell this information
Instead of just blocking the initial spam link Apex Intelligence now physically rips open the phishing templates, extracts the hidden form data, and unmasks the exact "Drop Zone" URLs where the stolen data is being funneled.
-
1
This is deep — "physically rips open the phishing templates" is exactly the kind of forensic analysis enterprise security teams need.
Curious: How are you validating that CISOs/enterprise security teams will actually pay for this level of threat intelligence before building out the full drop-zone mapping infrastructure?
I learned that "technical breakthrough" ≠ "budget allocation" the hard way ($20K, 3 months, zero enterprise sales). Now I validate B2B security features with video prototypes — show the "unmasked drop zone" workflow to prospects, see if they'd commit budget, before scaling the scanning engine.
Would love to hear your approach to enterprise validation for Apex Intelligence.
-
1
That is a tough lesson but I really appreciate you sharing it. It's so easy for developers to get lost in building cool forensic tech and forget about the actual sales motion
To be completely honest I built this initial engine highly optimized. so thankfully I haven't sunk $20k into it. By keeping the main scanner free I can see exactly what threat intel provides the most value to the community.
The real test for budget is API tier. if teams find the intel valuable enough to want it directly into their network infrastructure that's my green light to scale up the enterprise features
-
1
Smart approach — "free scanner for value discovery, API tier for budget validation" is lean.
One acceleration layer: Instead of waiting for teams to find the API valuable enough, you could proactively test specific enterprise workflows (SIEM integration? threat hunting?) with video prototypes — show CISOs the "drop zone intel flowing into their dashboard," see if they'd pay for that integration before you build the enterprise features.
Basically: validate the API tier demand with demos, not just organic adoption.
Either way, keeping the main engine free to learn is the right call. Best of luck with Apex Intelligence!
-
1
I 100% agree with you. This approach is way too passive. Since the scanner already generates all the raw data (screenshots, hashes, etc.), I can just record a quick Loom video showing how it would look inside their dashboards before I write a single line of integration code.
Selling the workflow before building the pipeline is a brilliant move. Really appreciate the insight.
-
1
Exactly — "sell the workflow before building the pipeline" is the game.
You already have the raw data, so a Loom video of the dashboard integration is the perfect MVP. Test with 3-5 CISOs, see if they ask "when can I get this?" vs "interesting."
If they ask for timeline, you have validation. If they just nod, you saved months of SIEM integration work.
Best of luck with Apex — looking forward to seeing how the proactive validation goes!
-
-
-
-
Here's a snapshot of what ive worked on with the scraper.
Stealth Mode: It disguises itself as a normal visitor so websites don't immediately block it from looking around.
Built for speed: It ignores heavy images and designs. focusing only on the actual text and data so it can scan pages instantly.
Doesn't get fooled by redirects: If a tricky link tries to bounce you around to multiple different pages, the scanner waits until it hits the final destination before grabbing the data
Deep extraction: Once the page finally settles, it quickly pulls out exactly what you need. like hidden links, background forms, and contact info.
Just to be clear the tool is absolutely free to use. Running the cloud servers and constantly updating the database is a tough job so I do ask for donations if you find it helpful. But they are absolutely not required everything is completely free.
I was tired of seeing standard security tools get easily blocked by modern websites. So I built a smart website scanner from scratch that safely opens suspicious links in the cloud to expose hidden tracking pixels, credential drops, and scams.
It is totally free to test right now.
Comment