Where Our Data Comes From
We don't hide how we evaluate websites. Here's every data source we use — and what each one tells us.
OpenPhish Threat Feed
We check every domain against OpenPhish, a widely-used, publicly verifiable feed of known phishing sites.
- •Detects domains involved in active phishing campaigns
- •Updated continuously by independent security researchers
- •A fully public feed, not a private or paid-only database
- •New phishing sites are typically added within hours of being reported
Domain Registration Records
We look up when the domain was registered and how long it has existed — because brand-new domains are more commonly used in scams.
- •Checks domain age — how old is this website?
- •Uses standardized WHOIS and RDAP registry data
- •Helps spot domains created hours or days ago
- •Domain age alone doesn't prove anything — it's one signal among many
SSL & HTTPS Validation
We verify whether the website uses encrypted connections — a basic security requirement that scam sites sometimes skip.
- •Checks if the site uses HTTPS (encrypted connection)
- •Validates that the SSL certificate is active and properly issued
- •Sites without HTTPS receive a higher risk score
- •Having HTTPS alone doesn't mean the site is safe — it just means data is encrypted in transit
Why We Check Multiple Sources — Not Just One
No single data point tells the full story. A website can have HTTPS and still be a phishing site. A domain can be new and still be completely legitimate. That's why we combine multiple signals — threat data, domain history, and SSL status — into a single balanced result.
For the free checker, all checks are automatic. For the Verified Badge Program, applicants also pass a one-time eligibility check against our published criteria, followed by ongoing automated monitoring — a layer of confirmation no database alone can provide.
- •A brand-new domain isn't automatically a scam — plenty of real businesses launch every day.
- •HTTPS doesn't guarantee the site is trustworthy — scam sites can get certificates too.
- •Threat intelligence feeds aren't instant — new scam sites take time to get reported.
- •That's why we combine everything — more signals mean a more accurate picture.
Understanding Each Data Source
Not all website safety checks are created equal. Some tools check a single database and call it done. Others run one signal — like SSL — and display a green tick that gives users false confidence. We take a different approach: every check runs multiple independent data sources simultaneously, and the result is only as strong as the weakest signal in the combination.
Threat Intelligence Feeds: What They Track and How
Threat intelligence feeds are continuously updated databases of known malicious internet infrastructure. Security organizations around the world — including academic institutions, browser vendors, and independent researchers — operate these feeds as a public service. We query OpenPhish, a widely-used, publicly verifiable phishing intelligence feed. When a new phishing website goes live, it typically gets reported within hours. When malware is spotted distributing through a particular domain, that domain gets flagged.
These feeds don't catch everything, and they're not instant. A brand-new scam site might operate for 24 to 48 hours before it appears in threat databases. That lag is a known limitation of any automatic system. It's one reason we also check domain age — because a site that's only 48 hours old is suspicious regardless of whether it's been reported yet. We only use publicly maintained, openly verifiable feeds. Everything we check is data you could verify independently.
Domain Registration Records: The Age Signal Explained
Every domain name has a public registration record showing when it was first registered. This data is accessible through WHOIS and RDAP protocols — standardized systems that allow anyone to look up domain history. When you check a website through our tool, we query these records to determine how long the domain has existed.
Domain age matters for a specific reason: scammers almost always use new domains. Running a long-term scam operation on the same domain is risky because reports, chargebacks, and fraud complaints accumulate. Instead, scammers register fresh domains for each campaign, run it for days or weeks, then move on. An established domain — registered for a year or more with no incident — is meaningfully less likely to be a scam than one registered last week.
What domain age cannot tell you: whether the business behind the website is honest, whether the site has been hacked since it was established, or whether the business claims are real. A legitimate business can have a new domain, and a scam can occasionally operate from an older one. Age is a signal, not a verdict.
SSL Certificate Validation: The Padlock Myth Debunked
SSL certificates protect data in transit between your browser and a web server. When a site uses HTTPS, it means your connection is encrypted — your data can't be intercepted while it travels over the network. For years, security educators taught people to look for the padlock as a sign of safety. That advice is now outdated.
Free SSL certificates became widely available in 2016 through services like Let's Encrypt. Today, virtually every website — legitimate or malicious — can have HTTPS enabled within minutes at no cost. The padlock no longer tells you anything about the trustworthiness of the website itself. We still check SSL because its absence is a serious red flag. But its presence is not a positive trust signal — it's just the baseline we'd expect from any website.
Why We Publish This Information
Most website safety tools operate as black boxes. They give you a score or a color without explaining what went into it. We publish our methods because we think users deserve to understand what a result actually means. If you know that our "Established" result comes from domain age plus SSL plus no threat matches, you can correctly interpret it: this domain isn't new and hasn't been reported. It does not mean someone personally vouched for the business.
That distinction matters when you're deciding whether to enter payment details. Full transparency about our methods also means full transparency about our limitations — and we publish both.
What We Don't Collect
Our checker only processes the domain name you enter. We never access, store, or transmit: