Guide
Is this website legit? Here's how to tell.
You don't need to be a security expert to size up an unfamiliar site before you buy something, sign up, or enter your card details. Most of what matters is visible in under a minute if you know where to look.
About a 5-minute read · 60 seconds if you just run the checklist
Check a website now
Look up a domain on AboutUs for dated, sourced facts — domain age, HTTPS, mail authentication, and independent authority signals — while you run the checklist below.
The 60-second checklist
Run through these in order — the fastest, cheapest checks come first. None of them alone proves a site is safe or unsafe; together, they build a picture.
1.Read the URL and domain, letter by letter
Lookalike domains swap a letter, add a hyphen, or use a different ending — paypa1.com, amaz0n-support.net, yourbank-secure.info. Type the address yourself or use a saved bookmark instead of a link from an email, text, or ad.
2.Check how old the domain is, and who registered it
A brand-new domain is not automatically a scam. But a company that claims to be long-established while running on a domain registered last month is a mismatch worth noticing. Domain age, registrar, and registration date are public — a WHOIS/RDAP lookup such as who.is shows them.
3.Confirm HTTPS, but don't stop there
The padlock means the connection is encrypted, not that the business behind it is legitimate. Any site — including a scam one — can get a free HTTPS certificate in minutes, so treat it as a minimum, not a stamp of approval.
4.Look for who actually runs it
A real business usually publishes a legal or trading name, a physical address, and a phone number or support email you can reach — not only a contact form. If none of that is findable, that absence itself is worth weighing.
5.Check reviews off the site itself
Testimonials on the site's own page can't be verified. Search the business name on independent platforms — Google, Trustpilot, the Better Business Bureau — and read recent, specific complaints rather than only the star average.
6.Pay with a method that protects you
A credit card gives you dispute and chargeback rights if something goes wrong. Wire transfers, gift cards, and cryptocurrency generally don't — a checkout that only accepts one of those is a signal on its own.
7.Be skeptical of too-good-to-be-true pricing
A steep, unexplained discount on something normally expensive — especially paired with urgency like a countdown timer or "today only" — is one of the most consistent signals of a fake storefront.
8.Verify emails that claim to be from them
Check the sending domain, not just the display name — a spoofed "from" name is trivial to fake. Legitimate senders publish SPF, DKIM, and DMARC records; most email providers let you view a message's full technical headers to check.
What AboutUs checks automatically — and what it doesn't
Facts, not verdicts. An AboutUs report is a dated set of public signals, not a certification. A new domain shows as limited history, not a red flag — new isn't the same as unsafe.
What an AboutUs report checks
- Domain registration and age signals, where publicly available
- DNS and mail-authentication presence — whether SPF and DMARC records exist
- HTTPS / TLS certificate presence
- Hosting and network infrastructure (ASN, geography) where it's a public signal
- Independent authority signals — Tranco ranking and Open PageRank
- A dated timestamp on every report, so you know exactly when the check ran
What it does not check
- Whether a business is legally registered or licensed to operate
- The identity of the people actually running the site
- Whether any specific transaction, checkout, or offer is safe
- Pass or fail — Authority and Safety are two separate, capped scores built from public signals, not a single trust verdict
- Anything in real time — a report reflects what was true as of its stated date, not this exact second
Read more in the full scoring methodology →
If something looks wrong
If you already paid, shared card details, or think you've been scammed, act fast and in this order:
- 1.
Your bank or card issuer
Already paid or shared card details? Call the number on your card and ask to dispute the charge or freeze the card — do this first, before anything else here.
- 2.
FTC — reportfraud.ftc.gov
The US Federal Trade Commission takes consumer fraud reports here. Outside the US, your country's consumer-protection agency is the equivalent.
- 3.
Google Safe Browsing
Report a phishing or malware page so Chrome, Firefox, and Safari can warn the next person who visits it.
- 4.
FBI Internet Crime Complaint Center (IC3)
If money was sent and lost to an online scam, file a report here — it feeds federal investigations.
- 5.
The domain's registrar
A WHOIS/RDAP lookup shows who registered the domain and which registrar controls it — the registrar's published abuse contact can suspend or investigate it.
Ready to check a site?
Search any domain for a dated, sourced AboutUs record — Authority and Safety signals, a full report, and a link to correct the record if you're the owner.