GDE-075 |
Scam website checks | |||||||
Digital infrastructure | ||||||||
October 2026 | ||||||||
01
What it is
A scam website checker is any tool or test that shows whether a website is likely to be a fraud, by checking its reputation, its domain age, its history and the business it claims to be. Together they tell an investigator whether a site can be trusted.
No single scanner gives that answer, because reputation services only list sites someone has already reported. The reliable method layers independent signals: when the domain was registered, what the site looked like before, whether the company behind it exists, and whether its text and images were copied from elsewhere.
Journalists use these checks to test impostor news sites and fake fundraisers. Fraud researchers and due diligence teams use them on shops, investment platforms and suppliers.
| When to use this guide
|
02
How do you check if a website is a scam?
Eight free tools and seven steps take you from a suspect link to a documented verdict.
All eight tools are free to use, and every check in this guide works without an account.
Google Safe Browsing site status: Free, no login. Shows whether Google currently lists a URL as unsafe, the same list behind browser warnings in Chrome and other browsers.
VirusTotal: Free, no login for URL checks. Runs a URL against more than 70 antivirus scanners and blocklisting services. Submitted pages may be shared with premium VirusTotal customers.
urlscan.io: Free, no registration needed to submit from the website. Loads the page from its own servers and records a screenshot, redirects and every domain the page contacts. Public scans are visible to anyone; unlisted scans are visible only to vetted urlscan Pro customers, and private scans only to people who have the scan ID.
ScamAdviser: Free, no login. Returns a trust score for a domain. Treat the score as a prompt for further checks, not as evidence.
ICANN Lookup: Free, no login. Returns a domain's registrar, creation and expiry dates and name servers from current registration data.
crt.sh: Free, no login. Searches certificate transparency logs for the TLS certificates issued to a domain, with issue dates.
Wayback Machine: Free, no login to search. The Internet Archive's captures show what a site displayed on earlier dates.
OpenCorporates: Free web search. Brings together company records from more than 140 government registries, so you can test a company name or number a site displays.
| Before you begin Stop at the login. Every tool here works without an account. Never create an account, log in or enter personal or payment details on the site you are testing. Legal considerations. Viewing and scanning public pages is low risk, but do not probe the site's forms, checkout or security. Buying from a suspect site to test it is an editorial and legal decision to make before you act, not during the check. |
Copy the link as text rather than clicking it. Find the registered domain, the part just before the ending such as .com, so that yourbank.com.account-check.example is read as account-check.example. Look for swapped letters, added words, hyphens and the xn-- prefix that marks a domain written with non-ASCII characters, such as Cyrillic letters that mimic Latin ones.
Check the URL in Google Safe Browsing site status, VirusTotal and ScamAdviser and screenshot each result. A flag is a strong lead. A clean result only means nobody has reported the site yet.
Submit the URL to urlscan.io, with private visibility if the URL itself is sensitive. Record the final URL after redirects, the screenshot and the domains the page contacts.
Look up the domain in ICANN Lookup and record the registrar and creation date. A site that claims decades of trading on a domain registered weeks ago has a contradiction to explain.
Search crt.sh for the earliest certificate and the Wayback Machine for the earliest capture. An old domain that showed a different business until recently may have expired and been bought by someone new.
Take the company name, number and address from the footer, contact and terms pages. Search them in OpenCorporates or the national registry, and check that the registered address, directors and trading name match what the site shows.
Search a distinctive sentence from the About page in quotation marks, and run product or staff photos through reverse image search. The same text or photos on unrelated sites point to a copied template, often reused across a network of scam sites.
|
03
Where scam website checks go wrong
Most errors come from reading one signal as a verdict, in either direction.
Clean scam website checker result read as safe: Reputation lists only hold sites that someone has already reported, and a newly launched fraud site may not have been reported yet. A clean scan is an absence of evidence. Verifying check: the site passes on positive grounds as well: a domain age, archive history and registry record that all match its claims.
Low trust score read as proof of fraud: Automated scores mark down new domains, small businesses and hidden registration details, all of which are common on legitimate sites. Verifying check: find a specific fraud indicator, such as a false registry claim, copied content or a redirect to an unrelated payment domain, before you call the site a scam.
Padlock read as a legitimate website: The padlock means the connection is encrypted. Basic certificates are issued free and automatically, so fraud sites use them as routinely as real ones. Verifying check: rest the verdict on the business and history checks, not on the certificate.
Old domain read as an established business: An expired domain can be bought and reused, keeping its age, links and search history while the business behind it changes completely. Verifying check: the Wayback Machine shows the same business on the domain without a break, up to the present.
Real company number read as the operator: Fraud sites copy the names and numbers of real companies to borrow their credibility. Verifying check: the contact details, address and trading name on the registry record match the site, or the registered company confirms the site is theirs.
Chain of custody: Scam sites can change or go offline without notice. Capture each check as you run it, with the date and time, so an editor, regulator or court can see what you saw and repeat it.
Save the full URL and every redirect as text with the date and time of each check
Screenshot each scanner result with the URL, tool name and date visible
Archive the home, contact and terms pages in the Wayback Machine before you make contact
Keep the urlscan.io report link and note its visibility setting
Hash saved files and log each hash in the case notes
04
Go deeper
Two reference cards and one Methods tutorial for the infrastructure behind a suspect site.
CARD · DIG-001
WHOIS investigation: from domain name to attribution chain
ViewDNS, SecurityTrails and crt.sh, pivoted from a registrant email to mapped domain infrastructure.
CARD · DIG-002 · SIGNAL TIER
Geolocate, fingerprint and attribute IP infrastructure
IPinfo, Shodan and BGP.tools, taken from an IP address to cross-referenced, hashed documentation.
METHODS · T35 · SIGNAL TIER
Website infrastructure analysis: WHOIS, DNS and SSL
WHOIS, DNS history, certificate transparency and BuiltWith, mapped to ownership and hosting history.
Evidentiary standard
Signal & Shadow operates to the LST-001 evidentiary standard. All claims are graded against the LST-001 v1.0.3 confidence tiers (Confirmed, Corroborated, Reported, Alleged) per the canonical voice and structural specification.
About Signal & Shadow
Signal & Shadow is an independent forensic investigation and methodology practice publishing tutorials, reference cards, and forensic dossiers for working practitioners. Founded by Derek Bowler.