Free Tool · No Sign-Up

Scam Website Checker: Is This Website Legit?

Got a link in an email or text and not sure it's real? Paste it below. Our free scam website checker looks at the domain's age, brand lookalikes, risky domain endings, free hosting platforms and other warning signs in seconds. If it's a scam, we can get it taken down.


Check a Website Get a Scam Taken Down
Free scam website checker: magnifying glass over a fake login site

Check a Website Now

    Looks like a scam? Don't just close it. We report it to the registrar, web host and email provider that can shut it down, and send you a case report.
    Get It Taken Down: C$49

    Don't open suspicious links to test them. Copy the address instead (right-click or long-press > Copy link). This checker runs in your browser and only sends the domain name to the public registry service rdap.org to look up its age. We don't store what you check. It looks for warning signs and can't guarantee a site is safe.

    How to Tell if a Website Is a Scam

    What the scam website checker looks at: domain age, brand lookalikes, risky endings, free hosting, https

    Before you log in, pay or download anything, check these:

    • Read the domain, right to left. In paypal.com.secure-login.top the real site is secure-login.top, not PayPal.
    • Look for lookalike spelling. paypa1, rnicrosoft, amaz0n.
    • Check the domain's age. Most phishing sites are days or weeks old. Real banks and stores have had their domains for years.
    • Be wary of odd endings like .top, .xyz, .shop or .icu on a site claiming to be a bank, the CRA or a delivery company.
    • Watch for free hosting such as web.app, pages.dev or netlify.app on a "bank" or "support" page.
    • Prices too good to be true, no real contact details, and payment only by crypto, gift cards or e-Transfer.

    Our checker looks at the first five automatically. You still have to judge the last one yourself.

    What to Do If a Website Is a Scam

    1. Don't enter anything and close the page.
    2. If you already entered a password, change it on the real site and anywhere you reused it, and turn on two-factor authentication.
    3. If you entered card or bank details, call your bank now.
    4. Report it. In Canada, to the Canadian Anti-Fraud Centre (1-888-495-8501) and fightspam.gc.ca. In the US, to the FTC at ReportFraud.ftc.gov.
    5. Get it taken down. Government reports rarely remove the site. The registrar and web host can. Here's how to report a scam website yourself, or we'll do it for C$49.

    Frequently Asked Questions

    How can I check if a website is legit?

    Look at how old the domain is, whether the name imitates a real brand, whether the address ends in an unusual domain ending, whether it is hosted on a free website platform, and whether the page asks for passwords, card numbers or one-time codes. Our free scam website checker looks at these signals for you in a few seconds.

    Is this scam website checker accurate?

    It looks for common warning signs, so it can catch many scam sites, but it can't prove a site is safe or a scam. New legitimate businesses can look risky and some scam sites live on old, hacked domains. Treat the result as a guide and never enter passwords or payment details on a site you are unsure about.

    What should I do if a website is a scam?

    Don't enter anything on it. Report it to the domain registrar and web host, to Google Safe Browsing, and in Canada to the Canadian Anti-Fraud Centre or in the US to the FTC. Our phishing takedown service does all of the reporting for you for C$49.

    I already entered my details on a scam website. What now?

    Change the password on the real account right away, and anywhere else you used it, and turn on two-factor authentication. If you entered card or banking details, call your bank immediately. Then report the scam to the Canadian Anti-Fraud Centre at 1-888-495-8501.

    Does the checker store the websites I check?

    No. The checks run in your browser. To look up the registration date, your browser sends only the domain name to the public RDAP registry service at rdap.org. Strategic Crypto Reserve doesn't receive or store what you check.

    Found a Scam? Get It Taken Down.

    Our phishing takedown service reports scam websites and emails to the registrar, web host and email provider that can remove them. C$49 per case or C$29 a month for up to five.

    See the Takedown Service

    Strategic Crypto Reserve is not the police or the RCMP and is not affiliated with them.