How to identify a fake website: 8 red flags anyone can spot

Look-alike domains are the oldest trick and still the most effective. Check for:

• Misspellings and homoglyphs. arnazon.com (rn instead of m), paypa1.com (1 instead of l), or Unicode homoglyphs that look identical in the browser bar.
• Extra subdomains or paths. secure-paypal.com.signin.ru: the registered domain is the rightmost pair (signin.ru), not the brand name.
• Suspicious TLDs. Brands rarely use .tk, .ml, .top or .store for their primary operations.

When in doubt, type the brand's known domain manually instead of clicking a link.

HTTPS is no longer a trust signal: every phishing kit has it. What matters is who issued the certificate and when:

• Click the padlock icon in your browser bar and view the certificate. A legitimate enterprise usually uses a well-known CA (DigiCert, Sectigo, GlobalSign) with an organisation-validated (OV) or extended-validation (EV) cert.
• A brand-new Let's Encrypt certificate issued yesterday to a supposed bank is a red flag.
• Check the certificate's subject alternative names (SANs). If the cert covers fifty unrelated domains, it may be from a shared hosting provider used by scammers.

Legitimate businesses want to be found. Scam sites want the opposite:

• No physical address or a fake one (search it on Google Maps: many scam sites list residential addresses or demolished buildings).
• Generic email only. A support address at @gmail.com or @proton.me for a supposed corporation is a hard stop.
• Missing company registration number. In the EU, a valid VAT or trade-register number is legally required and easily verifiable.
• No phone number or a number that goes to voicemail in a different country.

Before buying from an unfamiliar store, search the domain plus one of these keywords:

• site:reddit.com [domain] scam
• site:trustpilot.com [domain]
• [domain] review fraud

Be wary of sites with only five-star reviews posted within the last week, or reviews that repeat the same phrases. Many scam stores populate their own review sections with LLM-generated text.

Cloned stores reuse assets from the original brand, but clones are never perfect:

• Right-click an image and search with Google Lens. If it appears on a dozen unrelated sites, it is stock photography, not original product shots.
• Copy a product description into a search engine. Identical text across multiple domains is a hallmark of template scam shops.
• Check the footer copyright year. A site claiming to be established in 2015 with a footer saying "© 2022" has not been maintained: or is a recently deployed kit.

Payment preference is one of the strongest signals:

• Bank transfer only. Scammers prefer irreversible transfers (SEPA, wire, crypto) because chargebacks are impossible.
• PayPal "Friends & Family". A request to use the non-goods option removes buyer protection: always refuse.
• Only crypto. A store that accepts only Bitcoin or Ethereum and offers a "discount" for crypto is almost always fraudulent.
• Fake checkout flows. Some kits simulate a checkout page but never actually process a card. If you enter fake card details and the order "succeeds", the site is a data-harvesting frontend.

Trust badges are copy-paste decorations on most scam sites:

• Hover over a "Norton Secured" or "McAfee SECURE" badge. If it is not clickable, or clicks to a generic homepage instead of a verification page, it is fake.
• Check the social media icons. On many scam sites they are static images that do not link anywhere, or they link to the real brand's account (which has no posts about the promotion).
• Live-chat widgets that repeat the same scripted greeting are often bots, not support staff.

If a site passes the first seven checks but still feels off, paste the URL into Blackwall's scam check or submit a report. The AI Triage engine scores the domain for phishing, malware and fraud indicators in under a minute, using signals you cannot see from the surface:

• Domain age, registrar reputation and nameserver history
• Hosting provider abuse history and ASN reputation
• Blocklist status across Google Safe Browsing, PhishTank and SURBL
• SSL certificate anomalies and redirect chains

A low score does not guarantee safety, but a high score is a strong signal to stop and report.