Is this website legit? Check an online shop

How to use it

1. Copy the link of the shop or the message and paste it, or type the website’s name (for example, example.com).
2. Press “Check the website”. We check the link with your country’s rules, ask the domain’s registry when it was created and see whether it’s a well-known website and whether it appears in scam text campaigns.
3. Read the result and what we checked. If there are red flags, don’t buy or enter your details; if there aren’t, follow the tips before you pay.

What each result means

It appears in scam campaigns

Scam texts sent to many people lead to this website, and it isn’t a well-known one. Don’t buy anything, don’t enter your details and don’t tap links that lead to it. If you’ve already paid or shared your details, call your bank as soon as possible.

It has red flags

We found at least one sign that’s typical of scams: something odd about the link (it imitates a brand, uses a link shortener or hides the real website), a domain less than a month old or suspended, or scam texts that lead to it. Don’t buy or enter your details until you’ve checked it another way.

Be careful

We didn’t see clear signs of a scam, but the website is recent, or we don’t know its age and it isn’t well known. It may be genuine: check who is behind it before you pay.

We found no red flags

None of the checks turned up a sign of a scam. That doesn’t guarantee the website is safe: a new scam may have no history yet, and a well-known website can be hacked. Follow the tips below before you pay.

What each signal means

• Uses a link shortener that hides the real website.
• The link imitates a company’s name but isn’t its official domain.
• The link uses an extension common in scams (.xyz, .top, .info…).
• Urgent language or a request for login details.
• Mentions a well-known company alongside an urgent request.
• A parcel or delivery excuse combined with an urgent action.
• Names a company, but the link doesn't go to its official website.
• Contains wording NoCall has flagged in known scam campaigns.
• The link starts with http://, not https://, so what you type isn’t encrypted. Real shops and banks use https.
• The link has text before an @ that hides where it really goes: the website it opens is the domain shown above, not the name before the @.
• The domain has accents or letters from other alphabets: check that it isn’t imitating a well-known website, because some letters look the same.
• The link goes to a numeric IP address instead of a website’s name, which real shops and banks don’t do.
• The link names an unusual port (a number after the domain), which ordinary websites hardly ever use.
• Registered less than 30 days ago. Most scam websites are days or weeks old.
• Registered 30 to 179 days ago.
• The registration expires within 30 days, or has already expired. It’s for information only: many websites renew at the last moment.
• The registry or the registrar has suspended the domain (client hold or server hold): it doesn’t work on the internet, which often follows an abuse report.
• The domain is being deleted (pending delete or redemption period).
• The registry has no details for this domain or the domain it belongs to: it isn’t registered, or the registry doesn’t publish it.
• The registry of this extension doesn’t publish its data over RDAP, the public domain lookup service, so we don’t know how old it is. It isn’t a red flag.
• Public scam text campaigns link to this domain or to the domain it belongs to.
• Neither the domain nor the domain it belongs to is in the Majestic Million. That’s normal for most genuine websites; it matters when we don’t know its age, or if the website claims to be a big brand.

Related tools

• Is this QR code safe?
• Is this email real?

Which websites it covers

Works with websites from any country. The link rules are those of your NoCall edition, with the same brands, official domains and link shorteners as “Check a link”. The age comes from each domain’s official registry (some, such as those for .es, .de or .it, don’t publish it), the popularity from the Majestic Million, and the campaigns from scam texts seen by several NoCall users.

The link is sent to NoCall’s server to check it with your country’s rules, and we never open it; if you paste an email address, only its domain is sent. The domain’s registry only receives the domain name. We don’t store the link: we only note that a check was made and the verdict.

Frequently asked questions