How to check whether a website or online store looks legitimate

Before doing the manual checks below, you can also run the free ScamMark Website & Domain Risk Checker to collect domain-registration, DNS, redirect, page-identity and security signals. Treat its findings as supporting evidence, not a verdict.

Start with the exact domain

Read the domain from right to left around the final registered name. Scammers can use subdomains, extra words, look-alike characters and spelling changes that are easy to miss at a glance.

If the site claims to be a known brand, navigate to that brand independently rather than through the link you received.

Check the business, not just the website

A legitimate-looking storefront is cheap to build. Look for a business identity that can be verified independently: legal/business name, physical location where relevant, working contact routes, consistent social presence and policies that fit the jurisdiction and type of sale.

Be cautious when:

• prices are implausibly low;
• the site was introduced through an urgent ad or message;
• payment is restricted to hard-to-reverse methods;
• contact information is missing or inconsistent;
• policy pages look copied, contradictory or unrelated to the business;
• product images and descriptions appear copied from established stores.

What a padlock proves — and what it does not

HTTPS means traffic between your browser and the site is encrypted. It does not prove that the operator is honest. Scam sites can obtain valid TLS certificates too.

A real domain can still contain a malicious page

A trusted service can contain compromised pages, user-uploaded documents, deceptive application links or redirects to an unrelated destination. Domain history, the padlock, a recognized company name and a clean-looking checker result are never proof of safety for this specific page or request. Independently verify the expected recipient and action. See legitimate-domain phishing examples and a verification checklist.

If the site claims to be an AI service

Branding, search position and a polished interface are not enough to establish that an AI service is official. Use the AI website and app verification guide to verify the claimed provider, exact domain, publisher and download path independently.

If the page asks you to open Run, PowerShell, Command Prompt, Terminal or another system shell and paste or execute commands as part of “verification,” stop and read the ClickFix guide.

Use automated checkers as supporting evidence only

Domain age, reputation feeds and technical signals can reveal useful red flags, but they can also produce false positives and false reassurance. Read the underlying reasons and combine them with manual verification before making a consequential decision.

For purchases, continue with the step-by-step online-store verification guide and its interactive pre-purchase checklist. If an AI assistant supplied the seller link, use the AI-recommended website verification method.