A practical online scam checker you can run by hand. Five signals — domain age, what SSL really proves, contact info, pricing, and payment methods — expose a scam site in under 30 seconds.
Bottom line up front: You do not need a security background to catch a scam site. Five checks — domain age, what the padlock actually proves, contact details, pricing, and payment methods — separate real businesses from fraud in about 30 seconds. You can run all five by hand, or paste the URL into an automated trust audit and let it do every check at once.
A friend sends you a link. A store you have never heard of is selling the exact headphones you wanted at 60% off. The page looks clean, the photos are sharp, and there is a padlock in the address bar. The “flash sale” timer is ticking down.
This is the moment most people get scammed — not because they are careless, but because the site is built to exploit the gap between looking legitimate and being legitimate.
Here is the good news: you only need five signals to catch the overwhelming majority of scam websites. This guide walks through how to check each one in seconds, using free tools, and how to know when a deal is too risky to touch. Think of it as a manual online scam checker you carry in your head.
Scam sites are disposable. They get registered, collect money for a few weeks, then vanish — and the same operator spins up a clone under a fresh name. A site that claims “trusted since 2015” on a domain registered six weeks ago is lying to your face.
How to check (free):
who.is or the ICANN lookup tool (lookup.icann.org).The nuance: Legitimate businesses do launch on new domains — rebrands, new product lines, regional stores. What you are hunting for is a mismatch: a brand-new domain pretending to be an old, trusted name. A real startup on a fresh domain will usually admit it is new and show some history of real activity.
This is the most common misconception in web safety, and scammers exploit it constantly. The padlock means the connection between your browser and the server is encrypted. It says nothing about whether the business on the other end is honest. Every phishing site on the internet has a padlock in 2026 — SSL is free through Let’s Encrypt and takes about 30 seconds to set up.
So treat the padlock as a floor, not a green light:
If you want to dig a layer deeper, click the padlock and open the certificate details. A Domain Validated (DV) certificate only confirms control of the domain — it is free, and nearly every scam uses one. Organization Validated (OV) and Extended Validation (EV) certificates require the issuer to verify a real company exists. Scammers rarely bother with that step. The absence of OV/EV is not proof of a scam, but its presence is a meaningful positive signal.
Real businesses want you to be able to reach them. Scam operations hide behind forms and throwaway handles because answering questions costs time and leaves a trail.
What to look for:
support@store.com), not a free Gmail or Outlook address.The red flag: the only contact method is a web form, a Telegram handle, or a WhatsApp number with no other business presence anywhere. A channel you cannot trace is a shield, not a way to help you.
A quick reputation search pairs well with this step: type [domain] scam or [domain] review into Google and check Reddit and Trustpilot. Real victim reports show up fast, and the absence of any mention for a site claiming thousands of customers is its own warning.
Prices that sit dramatically below every other retailer are bait. There are two outcomes and neither is good: either you pay and nothing ships, or you receive a cheap counterfeit that looks nothing like the photos.
You do not need precise market data — just triangulate the price against a couple of known sources.
| If the going price is… | …and the site offers… | …the likely reality |
|---|---|---|
| $200 everywhere (retail, Amazon, the brand’s own store) | $39 | Bait. Counterfeit or non-delivery. |
| $200 everywhere | $150–170 | Plausible sale or grey-market. Keep checking. |
| $99, launched last month | $19 | Bait. The product is a $3 knockoff. |
| $50 commodity item | $35 | Normal discount. Low risk on price alone. |
The pattern: when a discount runs past roughly half off the established market price on a branded or new product, assume fraud unless something else proves otherwise. Genuine liquidation sales exist, but a permanent “80% off everything” store is not liquidation — it is a lure.
This is the single most reliable signal in this whole list. Scammers need payment methods they can walk away with, which means methods with no buyer protection. Legitimate stores accept methods that let you reverse a bad transaction.
Walk away if the store only accepts:
Far safer to see:
A store that buries every reversible option and pushes you toward an irreversible one is engineered so you cannot get your money back. The payment page is where a website scam check gets decisive — if you can only pay in a way you cannot undo, the whole “deal” is a trap.
Here is the entire website scam check compressed into one table. Run down it in order.
| Signal | Check in… | Pass | Fail |
|---|---|---|---|
| Domain age | ~10s (WHOIS lookup) | Registered over a year ago | Weeks/months old but claims history |
| SSL | ~2s (address bar) | Present, ideally OV/EV | Absent — stop right here |
| Contact info | ~10s (footer + Maps) | Real address, working email/phone | Form-only, throwaway handles |
| Pricing | ~5s (compare 2–3 sites) | Within market range | More than ~50% below market |
| Payment methods | ~5s (checkout page) | Card / PayPal offered | Wire / crypto / gift cards only |
If two or more signals fail, do not enter your details. The math is simple: the cost of walking away from a fake deal is zero. The cost of getting it wrong can mean weeks of chargeback disputes — or the money is gone for good.
Running five checks by hand is fast, but it assumes you remember what to look for on a site that is actively trying to look trustworthy. The alternative is to let a tool run every signal at the same time and hand you the result.
Paste the URL into the Valdos trust audit. It pulls domain registration data, inspects the SSL certificate type and security headers, flags missing or fabricated contact signals, weighs pricing and monetization patterns, and checks payment and blacklist reputation — then returns a transparent 0–100 trust score with the specific reasons behind it.
You get the same five signals from this guide, automated, in about the time it takes the flash-sale timer to tick down once. If the score comes back low or several categories light up red, close the tab. Those headphones will be on sale somewhere honest next week.
Disclaimer: This article is for educational purposes and does not constitute legal or financial advice.
Check any website in 10 seconds
Paste a URL. Get a full trust audit — domain reputation, fraud signals, monetization analysis.
Run a free scan