Skip to main content

What to do now

Is this website legit? How to spot a fake shop or lookalike domain

Last checked

Fake shops and lookalike sites copy real brands well enough that the page itself proves nothing. Check the address, the business behind it and the way it wants to be paid.

Already paid? Start with step 6.

Do this now

  1. Read the address, not the page

    Look at the words just before the first single slash: in paypal.com.account-check.example/login they are account-check.example, so that is the site you are on, not paypal.com. Watch for swapped letters (typosquatting), characters borrowed from another alphabet (a homoglyph attack), extra words and an unusual extension.

  2. Search for the shop’s name with “scam” or “review”

    Look for complaints outside the site itself: reviews on the site can be invented.

  3. Check the domain’s age and listings

    Paste the domain into the checks below. A shop selling well-known products from a domain registered a few weeks ago deserves suspicion.

  4. Find out who runs it

    Look for a company name, a postal address and a way to reach the business other than a contact form. A shop that hides who runs it leaves you no one to turn to if the order never arrives.

  5. Pay by credit card, never by transfer, crypto or gift card

    Pay by credit card where you can: it can be disputed with your card issuer. A bank transfer, cryptocurrency or a gift card usually can’t be recovered, and a shop that accepts only those is a red flag.

  6. Already paid? Call your bank and keep the proof

    Ask whether the payment can be disputed or stopped, and keep the order confirmation, the product page and your messages. In the US, the FTC says to call your credit card company immediately and write to it so the letter arrives within 60 days of the first bill showing the charge.
On this page07

Check it with isMalicious

isMalicious compares what you paste with the threat intelligence sources it collects. It does not scan your device and cannot undo what already happened.

Domain reputation check

Paste the domain into the domain reputation check. The report shows whether threat sources list it and, when WHOIS returns a record, the registration date and a warning for a name in non-Latin characters, which can imitate a brand.

What it does not mean
Not listed is not proof of safety: a fake shop is often a few days old and on no list yet.

Domain age checker

The domain age checker shows when the domain was registered.

What it does not mean
Some registries publish no creation date, and a young domain is not a scam on its own: every new business has one.

URL scanner

If a link in an email, an ad or a message brought you to the site, paste it into the URL scanner.

What it does not mean
Not listed is not proof of safety.

Report it

Keep the message, the link or the number until you have reported it: you will need them. These are the services that handle each case.

In the United States

In the United Kingdom

Wherever you are

Somewhere else? Report to your national police or your country’s cybercrime reporting service.

In France? The French version of this guide lists the French services.

How to spot the next one

  • Prices far below every other shop, on products that are usually scarce or expensive.
  • Payment by bank transfer, cryptocurrency or gift card only.
  • No company name, no postal address, or contact through a form only.
  • A brand name wrapped in words such as outlet, official or sale, or under an extension the brand does not use.
  • Reviews only on the site itself, all recent and all perfect.

Questions

The site has a padlock (https). Isn’t that enough?

No. The padlock means the connection is encrypted, not that the site is honest. The FBI’s IC3 advises not to trust a website just because it shows a lock icon or https.

How do I find out who owns a domain?

A WHOIS lookup shows the registrar and the registration dates. The owner’s details are often hidden by a privacy service, which legitimate sites use too.

I paid and nothing arrived. Can I get my money back?

Contact your bank or card issuer straight away: depending on how you paid, it may be able to dispute the payment. A card payment gives you the best chance; a transfer or crypto rarely comes back.

Is a recently registered domain always a scam?

No: every new business starts with a new domain. Age is one signal among several. Together with prices that are too low and payment by transfer only, it is a strong one.

Related guides

Sources

The steps follow these official pages, read on :

Free account

Keep checking with a free account

Without an account, checks stop at 10 an hour. With a free account you skip that wait and can run up to 60 a minute, and you can save up to 10 reports every 30 days.

Create free account

No credit card required