How we check a website
Every check runs live against public sources when you submit a URL. Completed reports are saved to our database and listed in the directory, but we do not record who ran the check. Here is exactly what happens, in order.
- 01Validating the address
- 02Reading domain registration
- 03Inspecting the HTTPS certificate
- 04Analysing domain name patterns
- 05Loading the website
- 06Looking for business details
- 07Checking social links on the site
- 08Searching for profiles elsewhere
- 09Searching Trustpilot
- 10Searching Reddit mentions
- 11Checking archive history
- 12Reading the evidence with AI
- 13Calculating the score
How the score is calculated
We start at a deliberately sceptical 50/100, because the absence of bad evidence is not the same as the presence of good evidence. Each finding then moves the score by its weight.
Negative findings pull harder than positive ones push, since one hard red flag matters more than several soft green ones. Both directions use a saturating curve, so twenty weak signals can never outweigh two strong ones. The result is clamped from 1 to 99. We never claim total certainty in either direction.
| Signal | Weight | Why |
|---|---|---|
| Domain age & registrationThe single most reliable free predictor. Scam storefronts are usually days or weeks old. | Highest | The single most reliable free predictor. Scam storefronts are usually days or weeks old. |
| Brand impersonation in the domainA well known brand inside a domain that is not the official one is the classic phishing structure. | Highest | A well known brand inside a domain that is not the official one is the classic phishing structure. |
| Reddit scam complaintsReal users reporting non delivery or fraud is direct, firsthand evidence. | High | Real users reporting non delivery or fraud is direct, firsthand evidence. |
| Trustpilot rating with volumeHard to fake cheaply at scale, and sustained low scores are meaningful. | High | Hard to fake cheaply at scale, and sustained low scores are meaningful. |
| Published company or VAT numberTies the site to a legal entity you can verify in a national register. | High | Ties the site to a legal entity you can verify in a national register. |
| Contact routes & policy pagesLegally required for traders in most countries, and effort scammers skip. | Medium | Legally required for traders in most countries, and effort scammers skip. |
| Archive historyIndependent corroboration that the site has existed under this name. | Medium | Independent corroboration that the site has existed under this name. |
| Social profilesA LinkedIn company page implies real staff; an empty Instagram link implies little. | Medium | A LinkedIn company page implies real staff; an empty Instagram link implies little. |
| HTTPS certificateNearly every scam site has a free certificate too. Only organisation validated certificates carry weight. | Low | Nearly every scam site has a free certificate too. Only organisation validated certificates carry weight. |
Where AI fits in
The score itself is deterministic. The same evidence always produces the same number, with no model in the loop. AI is used only at the end, to read the gathered signals and explain in plain language which ones mattered and why.
The model is instructed to reason only from the supplied evidence and never to invent facts, ratings or company names. If no model is configured, or the call fails, we fall back to a rules based summary and label it as such on the report.
What we deliberately don't do
- We don't call a site a scam. We report what public evidence shows.
- We don't penalise a business for being new or small beyond the weight domain age carries.
- We don't store your searches, build profiles, or sell data.
- We don't scrape behind logins, bypass blocks, or submit forms on the site being checked.
- We don't claim completeness. Plenty of legitimate signals exist that we cannot see.