Scam URL Checker
The Scanner is the main tool. Paste a domain, get a forensic report with the available findings and their dates.
What gets checked
Every scan runs the full pipeline: antivirus engines, blacklists, regulator lists, SSL, WHOIS, hosting, and a live render of the page. Every signal feeds into the Trust Score.
Reading the result page
The hero
The top of /scan/{domain} shows the essentials:
- Trust Score (0 to 100) and verdict pill
- Availability: whether the site responded at its latest recorded check
- Last scanned: when the data was refreshed
- Badges: quick links to the most severe findings (e.g. "3 regulator warnings", "blacklisted by 4 sources")
The Overview tab
This is where most users stop. It shows every check as a widget:
| Widget | What it tells you |
|---|---|
| Preview | Live screenshot of the homepage + reachability |
| Blacklist | Hits across Google Safe Browsing, Cloudflare and 4 community feeds |
| SSL | Certificate validity, issuer, expiry |
| VirusTotal | Detection count across multiple antivirus engines |
| Regulators | Official warnings from financial authorities |
| IOC | Indicators of compromise: emails, phone numbers, wallet addresses |
| Score history | How the score evolved over previous scans |
The Network tab
A live force-directed graph of every domain linked to this one through shared infrastructure, code signatures or regulator co-listing. Domains are coloured by their own Trust Score, sized by activity, and connected by typed edges.
The graph is generated from the Neo4j model, the same data that powers the Networks and Signals registries.
The Forensics tab
Lower-level detail for researchers: page timing, network requests, redirect chain, cookies, and the full scan history timeline.
What the verdict pills mean
The Trust Score maps to five bands. The colour of the hero score follows the same thresholds.
- Minimal Risk (85 to 100): clean signals across the board
- Low Risk (70 to 84): a few minor flags, nothing critical
- Moderate (45 to 69): mixed signals, verify before trusting
- Elevated Risk (25 to 44): multiple warning chains triggered
- High Risk (0 to 24): strong scam or malware signals
- Unknown: too little data to score (new domain, parked, unreachable)
The full algorithm is documented on the Trust Score page.
Limits worth knowing
- Snapshot, not real-time. Results reflect the recorded checks and may include older archived data. A site can change between two refreshes. The page tells you exactly when it was last scanned.
- No scanner is perfect. A Minimal-Risk verdict reflects a high score from the available signals; it does not prove the business behind it is legitimate.
- Brand new domains have low confidence. A two-week-old domain with clean signals can still be a scam in setup. Treat low-data scans with caution.
Re-running a scan
The "New Scan" button on any scan result forces a fresh full pipeline. Use it when a site has changed visibly or when you spot something the old scan missed. Opening a result page alone does not guarantee a refresh. Queued scans and unavailable sources can delay new findings.
Reporting an inaccurate scan
Website owners or visitors who believe a score is wrong can submit context via our contact form. Reviews are handled manually.