Check something suspicious.

What ScamMark can check

ScamMark currently supports two evidence-led checks: websites/domains and pasted message text. They use different methods because the safest useful analysis depends on what you are checking.

For a website or domain, ScamMark can collect a limited set of objective public and technical signals without logging in, submitting forms or probing for vulnerabilities. Depending on what is publicly available, that can include:

• domain registration information through authoritative RDAP, with compatibility and limited WHOIS fallbacks where needed;
• approximate domain age and registrar information;
• DNS records, including web and email-related records;
• whether the target resolves to public internet addresses;
• HTTP/HTTPS accessibility and redirect behavior;
• the page title, description, canonical address and declared site identity where visible in ordinary HTML;
• common security headers such as HSTS and Content Security Policy;
• limited non-executing inspection of retrieved HTML for strong fake-verification or command-execution patterns.

For a pasted message, email, SMS or set of instructions, ScamMark runs deterministic and heuristic rules inside your browser. It can identify patterns such as requests to run system commands, requests for credentials or recovery phrases, remote-access instructions, unusual payment methods, urgency or threats, suspicious job/payment-request patterns, and links embedded in the text.

ScamMark Safety Rule: verification should not require system commands

A legitimate CAPTCHA or ordinary human-verification step should not require you to open Run, PowerShell, Command Prompt, Terminal or another system shell and paste or execute commands.

That pattern is associated with ClickFix-style social engineering used to make people run malicious commands themselves. If a page or message tells you to do this, do not run the command. Close the prompt and verify the site or service through a channel you found independently. Read why fake verification pages ask you to run commands.

How to interpret the result

Treat every result as investigation support, not a verdict. ScamMark deliberately avoids a fake-precision scam score and separates different kinds of evidence.

A result may identify:

• verified facts — information obtained directly from an authoritative/public source;
• observed technical signals — behavior ScamMark directly observed, such as a redirect or missing security header;
• deterministic rules — a defined pattern that was actually present, such as verification instructions that ask you to run a system command;
• heuristic warning signals — language or combinations that deserve attention but have legitimate uses too;
• unavailable or unverified information — something the checker could not establish;
• limitations or absence of evidence — what the automated check cannot see or prove.

A technically polished website can still be deceptive. An old domain can change hands. A new domain can belong to a legitimate organization. HTTPS protects the connection; it does not prove the operator is trustworthy. A message that triggers no rule can still be deceptive.

The most useful question is usually: what should I verify independently before I act?

Privacy for pasted messages

Pasted message analysis is designed to remain local to your browser. ScamMark does not need the full message text to apply the current rules. If the text contains a URL, the result can offer to check that URL separately; only the URL you choose to check is sent to ScamMark's website-checker Worker.

Do not paste passwords, one-time codes, recovery phrases, private keys, private account links or other secrets into any checker.

What the automated checker cannot determine

A technical or text-pattern check cannot reliably establish the real identity or intent of a sender, whether a company registration is genuine, whether an address is occupied by the claimed business, whether every customer complaint is accurate, or whether an investment, job, product or relationship is legitimate.

Website checks are also limited to the HTML ScamMark can safely retrieve. Some malicious sites change what they show by visitor, location, browser or time. Not observing a suspicious pattern is not proof that the pattern never appears.

ScamMark may separately publish editorial research pages about some domains when there is a clear public-interest reason, but ordinary checker submissions are not automatically published.

Checking a purchase or an AI-recommended shop?

The technical checker cannot confirm whether a shop will deliver an order. After entering the store URL, use the interactive pre-purchase checklist, follow the online-store guide, or read how to verify a retailer recommended by an AI assistant. The checklist records your own judgments locally; it does not certify a seller.

Checking a Facebook or Instagram profile?

ScamMark cannot look up the operator or reputation of an account. Use the six-point social-profile verification worksheet for independent identity checks, copied images, account behavior, messages and reporting. The website checker only checks an external public URL/domain; the message checker only examines the text you paste locally.

Check manually too

Automated signals should be combined with independent verification. For unfamiliar sites, use the manual website checklist. For suspicious messages, use the message verification guide and 60-second scam check.

If you already ran a suspicious command, granted remote access, paid, clicked a suspicious link or shared sensitive information, start with recovery guidance immediately.