Log inSign up free

How we score websites

Every website starts at 50 points. Each signal below moves the score up or down, and the report shows you exactly which ones fired.

Strong negative signals

  • Phishing or malware blocklist (−45, score capped at 12): listed on the open-source Phishing.Database active list or, when enabled, Google Safe Browsing.
  • Brand impersonation (−38, capped at 22): the address uses or imitates one of 140+ heavily impersonated brands (banks, couriers, crypto wallets, marketplaces, tech companies) but is not one of that brand's real domains. Includes one-letter typos and look-alike characters (rn → m, 0 → o).
  • Brand-new domain (−26 under 30 days, −18 under 4 months, −8 under a year), from registry RDAP data or WHOIS.
  • Guaranteed investment returns, seed-phrase requests, fund-recovery offers (−20 to −30) found in page text.
  • Irreversible payment only (−14): a shop mentioning crypto, gift cards, Zelle or wire transfer without any card or PayPal option.
  • Community reports (−8 to −36) from people who were scammed.

Positive signals

  • Popularity (+10 to +34): rank in the Majestic Million list of the most-linked websites (CC BY 3.0). Very popular sites cannot be throwaway scams.
  • Domain age (+6 to +16) and multi-year renewals (+5).
  • Email protection (+3 to +6): a mail server, SPF and a strict DMARC policy.
  • Real contact details and store policies (+4 each), buyer-protected payment methods (+3), a valid SSL certificate (+4).
  • Verified owner (+6): the business proved it controls the domain.

What a score is not

A score is an automated opinion based on public technical signals at the time of the scan. A low score does not prove a site is fraudulent, and a high score does not guarantee a good experience. Always pay with a method that lets you dispute the charge. Site owners can request a review.

Data sources

Registry RDAP and WHOIS · DNS over HTTPS (Cloudflare, Google) · direct TLS handshakes · the site's own homepage, fetched from our servers · Majestic Million · Phishing.Database (MIT) · Google Safe Browsing (when configured) · LegitInformant community reports.