How to check whether an AI website or app is real

Start from the claimed provider, not the unfamiliar page

The strongest first step is to find the AI provider through an address, documentation page or app-store listing that you already know or can verify independently. Then use that provider's own links to reach its products.

Do not let the suspicious page prove itself by linking to other pages that it also controls.

Check the exact domain

Read the hostname carefully. Look for:

• extra words added before or after the brand;
• spelling changes that are easy to overlook;
• unrelated registered domains with a familiar brand in a subdomain or page path;
• redirects that move you to a different hostname;
• a domain that does not appear in the provider's own documentation.

You can run the URL through the ScamMark checker to collect registration, DNS, redirect and page-identity signals. Treat those findings as supporting evidence, not certification.

Verify the app publisher and download source

For desktop/mobile apps, browser extensions and installers, confirm the publisher through the provider's own website and official store links.

A search result, advertisement, code repository or third-party download site can be useful for discovery, but it should not be the final authority for who published the software.

OpenAI, for example, publishes direct links to its authentic apps and a list of official domains/accounts. Other providers may offer similar official documentation.

Compare what the site claims with what the provider says

Check whether the unfamiliar service claims to be:

• the official product;
• an authorized partner;
• a reseller;
• an independent tool using an API;
• a browser extension or desktop wrapper;
• a discounted or lifetime subscription provider.

Those are different claims. Verify the specific claim rather than assuming that use of a logo or product name means affiliation.

Treat payment and credential requests as separate verification events

Before entering a password, payment-card number or other sensitive information, verify that the domain and service are the ones you intended to use.

If a site offers unusually cheap access to an expensive subscription, lifetime access that the provider does not normally sell, or payment to an unrelated entity, pause and verify the commercial relationship independently.

Never run a command to “verify” yourself

A CAPTCHA or normal human-verification step should not require you to open Run, PowerShell, Command Prompt, Terminal or another system shell and paste or execute commands.

If you see that instruction, do not continue. Read the ScamMark ClickFix guide.

What a clean technical check does not prove

An older domain, valid HTTPS, normal DNS and professional design are all compatible with legitimate websites — but none proves legitimacy. Likewise, an automated checker may receive different content from what a particular visitor sees.

Use the technical result to identify questions, then verify the operator, publisher and distribution path independently.

For shopping websites suggested by AI assistants, rather than sites claiming to be AI products, see how to verify an AI-recommended retailer. These are two different verification problems.