MerchantGuard is a modular Python engine that analyzes a merchant's website, extracts publicly available business and technical signals, correlates them with external infrastructure intelligence (WHOIS, DNS, SSL), and produces an explainable risk assessment using a configurable rule engine — every finding comes with the evidence and rule that triggered it, not a black-box score.
Disclaimer: MerchantGuard is an educational project, not affiliated with or endorsed by Stripe, Visa, Mastercard, Razorpay, PayPal, Adyen, or any payment provider. Commercial underwriting systems use proprietary transaction data, fraud intelligence, and ML models that are outside this project's scope.
Before a merchant can process online payments, payment providers and acquiring banks run verification checks — business identity, contact info, legal policy pages, domain registration, SSL/DNS configuration, public business presence — to decide whether a merchant needs further review.
This information is scattered across many sources and usually collected manually. MerchantGuard automates the collection, correlation, and evaluation of these signals.
MerchantGuard is not a web scraper — the crawler is just the first stage. The engine turns a website into structured evidence, evaluates that evidence against transparent business rules, and answers questions like:
- Does the site provide enough business identity information?
- Is the merchant using secure infrastructure?
- Are legal policy pages present?
- Does the domain registration warrant more scrutiny?
- Which observations should raise the merchant's risk?
Every triggered rule reports: evidence detected → rule triggered → risk category → severity → rationale.
Website Intelligence — multi-page crawl (About, Contact, Privacy, Terms, Refund, Shipping), JS rendering fallback via Playwright, structured HTML parsing.
Evidence Extraction — business identity, contact details, legal pages, marketing claims, payment indicators, social links, embedded scripts, mixed-content detection.
External Correlation — WHOIS, DNS records, SSL/TLS inspection, domain registration analysis.
Rule Engine — configurable rule catalogue, severity classification, evidence-backed findings.
Reporting — structured JSON + human-readable console output, overall risk score and recommendation.
| Category | Technologies |
|---|---|
| Language | Python 3 |
| Web Crawling | Requests |
| HTML Parsing | BeautifulSoup4 |
| Browser Automation | Playwright |
| Domain Intelligence | python-whois, dnspython, tldextract |
| Data Models | Python Dataclasses |
| Reporting | JSON, Rich |
Merchant Website
│
▼
Website Extraction ──▶ Structured Evidence
│
▼
External Correlation (WHOIS · DNS · SSL)
│
▼
Rule Evaluation Engine
│
▼
Risk Scoring & Categorisation
│
▼
Merchant Risk Report (JSON + Console)
Each module has a single responsibility — evidence flows one direction, making the system easy to extend.
Input Website │ ▼ Website Crawl │ ▼ Evidence Extraction │ ▼ External Correlation │ ▼ Rule Evaluation │ ▼ Risk Score │ ▼ JSON Report
Prerequisites: Python 3.11+, Playwright, Git (optional)
git clone https://github.com/sarbeshmallick/MerchantGuard.git
cd MerchantGuard
python -m venv .venv
# Windows: .\.venv\Scripts\Activate
# Linux/macOS: source .venv/bin/activate
python -m pip install -r requirements.txt
playwright installpython risk_evaluator.py https://example.comEach run produces a structured JSON report under outputs/ plus a console summary of triggered findings, risk score, and rating.
MerchantGuard produces a structured console summary alongside a machine-readable JSON report.
Merchant risk engines are almost always proprietary. Companies like Stripe, Razorpay, Adyen, Visa, Mastercard, and PayPal treat their underwriting rules as a competitive advantage — publishing the exact logic would let fraudulent actors learn how to bypass it. That's why there's no widely-studied open-source "Stripe risk engine" to reference. The same pattern shows up in insurance underwriting, loan approval, AML, KYC, and vendor/supply-chain risk — proprietary by design, not by accident.
Several open-source tools solve adjacent problems, but none do merchant risk scoring specifically:
| Project | Focus | Gap vs. MerchantGuard |
|---|---|---|
| urlscan.io | Website analysis, screenshots, infra intel | Doesn't score merchant risk |
| SpiderFoot | Automated OSINT collection | General-purpose OSINT, not underwriting-focused |
| OpenCTI | Cyber threat intelligence platform | Threat intel, not merchant evaluation |
| Wappalyzer | Technology fingerprinting | Identifies tech stack, no risk logic |
| Nuclei / OWASP ZAP | Vulnerability scanning | Security testing, not business risk rules |
MerchantGuard sits specifically at the intersection of backend development + web scraping + security automation + risk analytics + rule engine design + OSINT — combined into one explainable pipeline aimed at merchant underwriting, a niche that open source largely hasn't touched.
MerchantGuard combines backend engineering, web intelligence, OSINT, browser automation, rule-engine design, and explainable risk analytics into a single merchant evaluation pipeline.
- Businesses vetting a merchant, partner, or vendor before onboarding them
- Individuals doing due diligence on an unfamiliar online store before purchasing
- Students/engineers learning rule-engine design, OSINT automation, or explainable scoring systems
- Researchers studying explainable risk assessment patterns
- Based solely on publicly available information — no transaction history, chargeback data, or behavioral analytics
- Deterministic rule engine, no ML component yet
- Public search correlation depends on what's indexed
- Merchant identity can't always be independently verified from website content alone
- Scoring weights are simplified for demonstration, not calibrated against real fraud outcomes
- Rule thresholds and scoring weights are intentionally configurable and should be calibrated using production fraud data.
- YAML-based configurable rule packs (so non-technical users can adjust rules)
- Business registry / company registration verification
- Reputation feeds, certificate transparency logs, ASN enrichment
- REST API + web dashboard for report viewing
- Docker support, CI/CD, unit/integration tests
Issues and PRs welcome — new rules, extraction techniques, intelligence sources, or documentation improvements.
MIT