Is this website a scam? Paste the link.
You have a link and a bad feeling — an ad, a text, a marketplace listing, a store you have never heard of selling something at a price that does not make sense. This page does one thing: it reads that address live and tells you what it found, in plain English, before you spend anything. The score and the verdict are free.
A 0–100 risk score, a plain-English verdict, from “no red flags found” to “high risk”, and the two most serious red flags — each naming what we read and the day we read it. No email address, no card, no account.
The full $2report adds all five red flags with the evidence behind each, a 3-step “what to do now” list and a PDF you can forward. One payment, no subscription, nothing to cancel.
Written for the three questions people actually type — “is this website a scam”, “is this store legit”, “how to check if a site is fake”. Those are the questions this page is written to answer, in the words people use. We hold no keyword-volume data and make no claim about how often any of them is searched.
What we read before we give you a verdict
Five readings, taken at the moment you ask rather than pulled from a cache, and every red flag in the report names the one it came from and the day it was taken. That pairing is the product:
- The address itselfWhether the name resolves at all, what it answers with, and whether it publishes mail records — read at the moment you ask, not from a cache.
- The certificate on the connectionThe certificate actually served on port 443: when it was issued, when it expires, and whether it covers the hostname you typed. A padlock means the connection is encrypted. It has never meant the shop is real.
- The public registration recordThe domain's public registration event — the one and only place “how old is this domain” comes from here. When that record is unavailable, the report says so and scores without it rather than inventing a date.
- The page as served, cache bypassedWe fetch the page ourselves with caching switched off and read what came back: the status, the hostname you actually end up on after redirects, the title, sign-in and card-entry markers, irreversible-payment markers, and where its images are loaded from.
- Our own published record, if we hold oneIf the address is one we have already documented, the check quotes our published finding for it word for word, with the date of that check and its observed state — never re-worded and never strengthened.
How to check if a site is fake, yourself, for nothing
You do not need us for these. Each one comes out of our own published research, with the date it was recorded — run them on the address you are worried about before you spend a cent, here or anywhere:
1Read the reviews and ask what they are describing
A copied storefront pours generic praise into a catalogue it does not understand, so the reviews describe products the brand does not sell. In the 27 July 2026 teardown of one clone build we found this on 12 of 33 storefronts. The clone-kit teardown →
2Right-click an image and read the hostname
Open an image in a new tab and look at the address it loads from. When a suspected copy is serving the genuine brand's own hosted files, that is file-level copying rather than an imitated look — the strongest evidence class we publish. We observed exactly that on philipparoberts.shop, live, HTTP 200 on 6 October 2026, serving the real brand's own favicon, logo and February 2026 homepage banner from philipparoberts.com; on saboskirt.shop, which was serving the genuine brand's hero image, favicon and a category image when we last observed it serving, on 15 September 2026, and did not resolve when we checked it on 6 October 2026; and on foursigtics.com on 17 August 2026. The ten-second own-CDN check →
3Treat 65–70% off plus round-number bragging as one signal, not two
The build in that teardown ran a real brand's name, a copy of its catalogue, invented reviews, a boilerplate “10,000+ Happy Customers” block and 65–70% discounts together. No single element proves anything — a shared template is a template, and two sites that are not copies return the same signature. The combination is what we treat as probative.
4Check when the free score you found was calculated
A score is a reading with a date on it. On 2 September 2026 a free scanner's page for nomaticstore.com read “Likely Safe - we think nomaticstore.com is legit”, on an analysis that page itself described as 3 days old; our own cache-bypassed check the same day recorded the address live, HTTP 200, serving a Nomatic lookalike storefront with around 40 images loading from the genuine brand's own domain. We did not run their check, we cannot see what it measured, and we are not calling it wrong — the dates are the point. Both readings, side by side →
If those leave you unsure — and on a careful copy they often do — paste the link into the check above. The score, the verdict and the two worst flags cost nothing.
60 storefronts we have already documented
Below this are the 60 lookalike storefronts we have documented across 56 brands. Each one has its own page: what the address served, the artefacts we recorded, the state we observed and the date we observed it. If the link you are holding is one of them, you can read the whole record for free, right now, without paying us anything.
Of the 60 hostnames on this index: 31 were live, HTTP 200 when we last checked them; 19 do not resolve; 2 resolve but do not serve; 8 we could not re-check, because our own check failed. A hostname's state can change on any day, in either direction — one row on this list was observed “does not resolve” on 31 July 2026 and “live, HTTP 200” again on 2 September 2026. States below are as of our 6 October 2026 re-check, except for the rows where our own check failed — those keep their earlier finding and their earlier date, and say so.
- aersfshop.com
- brchhome.shop
- bronzeartist.shop
- carrollsirishhome.shop
- chamberlaincoffeeshop.com
- coyuchi.shop
- diggs.live
- drinktrade.shop
- ecobagsfashion.shop
- ekstershop.com
- epauletbrandstyle.shop
- exultplanetstore.shop
- featherstoneoutdoorgear.shop
- featherstoneoutdoorhq.shop
- flamingoestate.shop
- foursigtics.com
- glowrecipeshop.com
- highcountrygardensco.shop
- jaxxonshop.com
- johnderian.shop
- keywaydesigns.shop
- kytebaby.shop
- kytebabyshop.com
- littlesleepies.xyz
- luxebitesstore.shop
- michaelangeloskitchen.shop
- microkickboardglobal.shop
- moxievinyls.shop
- muhouse.shop
- myfashionbrandcompany.shop
- myredneckblinds.shop
- naturium.us
- noguhq.shop
- nomatic.shop
- nomaticstore.com
- officialnestbedding.shop
- onceagaingoods.shop
- philipparoberts.shop
- poshpeanut.shop
- repfitness.shop
- saboskirt.shop
- seamatetech.shop
- secondnaturebrandshq.shop
- shopelitesports.shop
- shopkimirica.shop
- shoplorenacanals.shop
- shopparkseed.shop
- shopriverbendhome.shop
- stixyarnstudio.shop
- studioadornhq.shop
- teamsportsamericastore.shop
- theappointed.shop
- theecobags.shop
- themissamara.shop
- thewinfieldcollectionco.shop
- tillmansmeatsonline.shop
- toirocollection.shop
- truetreasuresinchome.shop
- wovenwoodhome.shop
- yearlycojewelry.shop
The same list, grouped by the brand each one copies, is the documented fake-store index. We describe what each page serves; we make no assertion about any registrant’s intent or criminality, and nothing here is legal advice.
Recognise your own brand in that list?
Those rows are other people's stores, copied under names a shopper would misread at a glance. If the brand being copied is yours, the question changes from “is this one link a scam” to “what else is out there under my name” — and that is a different sweep, run against your own domain rather than one address.
How many lookalikes of your name are answering right now?
Free, no email and no card: we generate the lookalike and typosquat names for your domain, resolve them, fetch the ones that answer and grade them against your own page — then show you the counts, two of the rows in full, and the rest withheld. We generate the lookalike and typosquat names from your domain — different endings, hyphenated forms, single-character swaps and drops, and the shop / store / outlet / sale / official patterns our own documented corpus is full of. Only hostnames we confirm resolving are counted as resolving — a name nobody has registered is counted, never padded into a list.
No email, no card, no account. The sweep runs live and usually takes under a minute.
Know what you need already? The $29 report is right here. The $29 report names every hostname behind these counts, with the dated readings for each, the copying evidence where we found it, a risk rating derived in code, our own published record where we already hold one — and the takedown request drafted for you to send.
- Lookalike and typosquat candidates generated from your own domain — different endings, hyphenated forms, character swaps, drops and doublings, and the -shop/-outlet/-store/-sale/-official patterns our own documented corpus is full of
- Every candidate resolved, and everything that resolves fetched live with cache bypassed — only hostnames we confirm resolving are listed, so a name nobody registered is counted rather than padded into your report
- Per hostname: the date-stamped readings behind it — DNS, the HTTPS certificate served, the public registration record, and the page as served
- Per hostname: a risk rating derived in code from what was observed, and the copying evidence where we found it — your own hosted files being served, your image filenames, your catalogue handles or part numbers, or your title wording reproduced
- Where we already publish a dated record for a hostname, our own published finding, quoted verbatim
- A ready-to-send takedown request with your details in square brackets, plus the dated evidence index it refers to
- Delivered the moment the reads finish — the checks run live when you pay, so there is no research queue in front of it
What this is not: the Evidence Report is the researched tier — it adds the registrar and the true upstream host per domain, a filing drafted separately for every desk, and research beyond the patterns generated here. The audit is the deterministic sweep of your own name plus live reads, delivered without a research queue.
This is a point-in-time audit of publicly observable information, not legal advice and not monitoring. We assemble the evidence and draft the request; on this tier you send it. We do not file on your behalf, we do not contact the registrant, and no outcome or timeline is promised — that decision belongs to each registrar, host and platform.
A verdict is a date, not a permanent label
The same rows, counted over ten weeks: 20 of them changed state between two dated checks, in both directions — one address went quiet and was serving the same build again weeks later. That is why every line on this site carries a date, and why a screenshot you took last month is a record of last month.
Read the decay study — the same 60 rows counted across the whole window: every state change, which direction it went, the gap between the two checks either side of it, and the rows we could not re-check. We never describe an address as removed, suspended or taken down: we read back no registry status for these rows.
What this check will never tell you
This list is the important half of the page. What you cannot verify for yourself is exactly what we must not overstate:
- A link that is not on our index is unchecked, not clean. Our index is a record of what we have looked at, and it has never been a claim that nothing else exists.
- A verdict is a point in time. We read the address on the day you ask and we do not watch it afterwards — there is no monitoring, no alerting and no feed behind this check.
- We describe what an address serves. We make no assertion about who registered it, why, or whether anything about it is criminal, and nothing here is legal advice.
- We name no registrar, hosting provider, network or IP address on this page or in the report — that attribution belongs to the researched brand tiers, and this check is not priced on it.
- We do not file anything, we do not get anything removed, and we do not recover money. A report is evidence you can read, keep and forward.
- A reading we could not take is reported as a reading we could not take. A blocked fetch or a registry that answers nothing is a fact about our own check, and we would rather print that than fill the gap with an estimate.
New to us? Who we are, how each check is run, and what we refuse to promise.
The short version
- How do I check if a website is a scam?
- Paste the address into the check at the top of this page. We read it live — whether the name resolves, the certificate served on the connection, the public registration record, and the page itself fetched with caching switched off — and return a 0–100 risk score, a plain-English verdict, from “no red flags found” to “high risk”, and the two worst red flags, free. You can also run three checks yourself in your own browser: read whether the reviews describe products the brand actually sells, open an image and see whether it loads from the genuine brand's own domain, and check the date on any free score you have already found. Every result is a point-in-time assessment of public information, not advice.
- Is this store legit — can you just tell me yes or no?
- The check answers with one of four lines — “No red flags found in this check”, “A few risk signals — worth a closer look”, “Suspicious — multiple risk signals” or “High risk — matches the pattern we see on scam storefronts” — and shows the readings behind it with the date each was taken, which is as close to yes-or-no as an honest automated check gets. What we will not do is treat an absence of findings as a clean bill of health: an unchecked link is unchecked, not clean. We make no assertion about who is behind any address or why.
- What does the $2 report add that the free check does not?
- The free check returns the score, the verdict and the two most serious red flags. The $2 report adds all five, each with the evidence behind it — the reading it came from and the date it was read — plus a 3-step “what to do now” list and a PDF you can keep or forward. One payment, no subscription, no account.
- Do I need an account or an email address?
- No. The score, the verdict and the two red flags appear on screen with no email address, no card and no account. If you buy the full report, payment is a single card payment and there is no subscription to cancel.
- I already paid the site. Can you get my money back?
- No. We do not recover funds, we do not contact anyone on your behalf on this product, and we make no promise about any outcome — that decision belongs to your bank or card issuer. What we can give you, if the address is one we have already documented, is the dated record of what it served on the day we checked it.
- Is a site safe if it does not appear in your index?
- No. Our index holds the 60 hostnames we have documented across 56 brands, and it is a record of what we have checked — never a statement that nothing else exists. A link that is missing from it has not been cleared by us; it has not been looked at. That is what the check at the top of this page is for.
- Does a site stay dangerous once you have documented it?
- A state is a date, not a permanent property. Across our own record, 20 documented hostnames changed state between two dated checks over ten weeks, in both directions — one stopped resolving and was serving the same build again at a later check. We report the state we observed with the date we observed it. We never describe an address as removed, suspended or taken down: we read back no registry status for these rows.
Still holding that link?
Paste it in and read the verdict before you decide. Free, on screen, no email and no account.
Check the link freeScam Detective — pay-per-use scam intelligence. One-off checks, no subscription, no account. Published 10 September 2026.
Every check here is an automated assessment of publicly available information at the moment it runs. It is not advice, it is not a statement about anyone's intent, and it is not a guarantee about anything that happens next.
Every finding here is an assessment of publicly available information at the time of the check, and is not legal advice. We produce the evidence and the correctly addressed request; on a Takedown Engagement we submit it to the abuse desks as the customer’s authorized agent, which is an administrative act and not legal representation. We do not monitor continuously and never contact the registrant on a customer’s behalf, and no outcome or timeline is guaranteed. Confirm your own trademark position before sending anything adversarial.
Think we have something wrong, here or on any record? scam-detective8@mail.acoco.ai — we re-check it and record what the re-check found, alongside the original entry.