Scam URL Checker
Scam URL Checker
The Scanner is the main tool. Paste a domain, get a forensic report in under a minute.
What gets checked
Every scan runs the full pipeline: antivirus engines, blacklists, regulator lists, SSL, WHOIS, hosting, and a live render of the page. Every signal feeds into the Trust Score.
Reading the result page
The hero
The top of /scan/{domain} shows the essentials:
- Trust Score (0 to 100) and verdict pill
- Live status: is the site online right now
- Last scanned: when the data was refreshed
- Badges: quick links to the most severe findings (e.g. "3 regulator warnings", "blacklisted by 4 sources")
The Overview tab
This is where most users stop. It shows every check as a widget:
| Widget | What it tells you |
|---|---|
| Preview | Live screenshot of the homepage + reachability |
| Blacklist | Hits across Google Safe Browsing, Cloudflare and 4 community feeds |
| SSL | Certificate validity, issuer, expiry |
| VirusTotal | Detection count across multiple antivirus engines |
| Regulators | Official warnings from financial authorities |
| IOC | Indicators of compromise: emails, phone numbers, wallet addresses |
| Score history | How the score evolved over previous scans |
The Network tab
A live force-directed graph of every domain linked to this one through shared infrastructure, code signatures or regulator co-listing. Domains are coloured by their own Trust Score, sized by activity, and connected by typed edges.
The graph is generated from the Neo4j model, the same data that powers the Networks and Signals registries.
The Forensics tab
Lower-level detail for researchers: page timing, network requests, redirect chain, cookies, and the full scan history timeline.
What the verdict pills mean
The Trust Score maps to five bands. The colour of the hero score follows the same thresholds.
- Minimal Risk (85 to 100): clean signals across the board
- Low Risk (70 to 84): a few minor flags, nothing critical
- Moderate (45 to 69): mixed signals, verify before trusting
- Elevated Risk (25 to 44): multiple warning chains triggered
- High Risk (0 to 24): strong scam or malware signals
- Unknown: too little data to score (new domain, parked, unreachable)
The full algorithm is documented on the Trust Score page.
Limits worth knowing
- Snapshot, not real-time. Results reflect a scan done up to 10 days ago. A site can change between two refreshes. The page tells you exactly when it was last scanned.
- No scanner is perfect. A Minimal-Risk verdict means no source flagged the domain; it does not prove the business behind it is legitimate.
- Brand new domains have low confidence. A two-week-old domain with clean signals can still be a scam in setup. Treat low-data scans with caution.
Re-running a scan
The "New Scan" button on any scan result forces a fresh full pipeline. Use it when a site has changed visibly or when you spot something the old scan missed. Cached data older than 10 days re-runs automatically.
Reporting an inaccurate scan
Website owners or visitors who believe a score is wrong can submit context via our contact form. Reviews are handled manually.