---
title: Scamalytics
description: >-
  Enrich logs with Scamalytics Threat Intelligence to identify risk and intent
  signals
breadcrumbs: Docs > Integrations > Scamalytics
---

# Scamalytics
Supported OS Integration version1.0.0  Monitor Scamalytics risk scores, Tor exit nodes, and VPN usage.Visualize traffic origins and top foreign IP sources.
## Overview{% #overview %}

Scamalytics transforms raw IP traffic into actionable threat intelligence. The platform provides IP enrichment and generates accurate risk scores for every IP address, offering clear, evidence-based context for each connection. It identifies anonymization methods such as VPNs, proxies, Tor nodes, and data center traffic, and attributes requests by geolocation, ASN, and ISP. Scamalytics also performs abuse and blacklist checks, giving organizations insight into suspicious or high-risk IP activity.

This integration collects Scamalytics logs in Datadog to visualize risk distribution, monitor threat patterns by geography, and trigger automated alerts for high-risk connections. Additionally, this integration allows Scamalytics to query Datadog logs in order to correlate IP reputation data with application activity and investigate security incidents with full historical context.

## Setup{% #setup %}

1. Run the following command to install the Agent integration:

   ```shell
   datadog-agent integration install -t datadog-scamalytics==1.0.0
   ```

1. Open `conf.d/scamalytics.d/conf.yaml` and add the Scamalytics API endpoint URL along with your API key.

   ```
   init_config:
   
   instances:
     - url: "https://api.scamalytics.com/?ip="
     - api_key: "<YOUR_API_KEY>" 
     - customer_id: "<YOUR_CUSTOMER-ID>" 
   ```

1. [Restart](https://docs.datadoghq.com/agent/guide/agent-commands.md#start-stop-and-restart-the-agent) the Agent.

## Verify the integration is working{% #verify-the-integration-is-working %}

Run `datadog-agent check scamalytics`

The Scamalytics integration automatically detects and scans IP addresses found in Datadog's standard network attributes:

- **Inbound Traffic (`network.client.ip`)**
- **Outbound Traffic (`network.destination.ip`)**

## Uninstallation{% #uninstallation %}

1. Run the `datadog-agent integration remove` [command](https://docs.datadoghq.com/agent/guide/integration-management.md?tab=linux#remove).
1. Click **Uninstall** to remove the included dashboard.

## Support{% #support %}

Need help? Contact [Scamalytics](mailto:dev@scamalytics.com).