Is this website legit?

Purpose

Check a website before you buy or enter your details: whether it imitates a brand, when it was created, whether it’s well known and whether it appears in scam text campaigns. We tell you what we found, without promising it’s safe.

Requirements

Anyone can read these guides, no account needed. Some tools require Pro, as indicated in each guide.

Found a shop with unbelievable prices, or got a link by text? Paste it here before you buy or type in your details. We check the link with your country’s rules, when its domain was registered, whether it’s a well-known website and whether it appears in scam campaigns. We never open the website.

How to use it

1. 1

   Copy the link of the shop or the message and paste it, or type the website’s name (for example, example.com).

2. 2

   Press “Check the website”. We check the link with your country’s rules, ask the domain’s registry when it was created and see whether it’s a well-known website and whether it appears in scam text campaigns.

3. 3

   Read the result and what we checked. If there are red flags, don’t buy or enter your details; if there aren’t, follow the tips before you pay.

Synthetic example

https://[email protected]/login

Interpret the result

It appears in scam campaigns: Scam texts sent to many people lead to this website, and it isn’t a well-known one. Don’t buy anything, don’t enter your details and don’t tap links that lead to it. If you’ve already paid or shared your details, call your bank as soon as possible.

It has red flags: We found at least one sign that’s typical of scams: something odd about the link (it imitates a brand, uses a link shortener or hides the real website), a domain less than a month old or suspended, or scam texts that lead to it. Don’t buy or enter your details until you’ve checked it another way.

Be careful: We didn’t see clear signs of a scam, but the website is recent, or we don’t know its age and it isn’t well known. It may be genuine: check who is behind it before you pay.

We found no red flags: None of the checks turned up a sign of a scam. That doesn’t guarantee the website is safe: a new scam may have no history yet, and a well-known website can be hacked. Follow the tips below before you pay.

Neither the domain nor the domain it belongs to is in the Majestic Million. That’s normal for most genuine websites; it matters when we don’t know its age, or if the website claims to be a big brand.

The link starts with http://, not https://, so what you type isn’t encrypted. Real shops and banks use https.

The link has text before an @ that hides where it really goes: the website it opens is the domain shown above, not the name before the @.

The domain has accents or letters from other alphabets: check that it isn’t imitating a well-known website, because some letters look the same.

The link goes to a numeric IP address instead of a website’s name, which real shops and banks don’t do.

The link names an unusual port (a number after the domain), which ordinary websites hardly ever use.

Limitations

The link is sent to NoCall’s server to check it with your country’s rules, and we never open it; if you paste an email address, only its domain is sent. The domain’s registry only receives the domain name. We don’t store the link: we only note that a check was made and the verdict.

Type the shop’s address yourself or search for it, instead of tapping the link in a message or an ad.

Look for other people’s reviews and the company’s real details: name, address and phone number.

Pay by card or with a method that protects you, and be wary if they only take bank transfers, gift cards or cryptocurrency.

If the prices look too good to be true, they probably are.

Troubleshooting

That doesn’t look like a public website. Try something like example.com, or paste the whole link.

We can’t read that link. Check that it starts with http:// or https:// and has no spaces.

You’ve run a lot of checks in a short time. Wait a while and try again.

We couldn’t run the check. Check your connection and try again.

Use with the API

Is this website legit? The country’s link rules, the domain’s age, its popularity and the public SMS scam campaigns combined into reported_scam, warning, caution or no_red_flags, with the signals behind it. Never a safe verdict: no_red_flags is not a guarantee.

Send the JSON body to the tool's own route, or to POST /v2/tools with the tool field added. Both routes return the same result.

POST https://api.nocall.io/v2/website-legit
POST https://api.nocall.io/v2/tools  {"tool":"website-legit","url":"https://[email protected]/login","country":"ES"}

REQUEST_ID="$(uuidgen)" && [ -n "$REQUEST_ID" ] &&
curl --request POST 'https://api.nocall.io/v2/website-legit' \
  --header "Authorization: Bearer $NOCALL_API_KEY" \
  --header 'Content-Type: application/json' \
  --header "Idempotency-Key: $REQUEST_ID" \
  --data '{"url":"https://[email protected]/login","country":"ES"}'

import json
import os
import urllib.request
import uuid

api_key = os.environ.get('NOCALL_API_KEY')
if not api_key:
    raise SystemExit('Set NOCALL_API_KEY')

request = urllib.request.Request(
    'https://api.nocall.io/v2/website-legit',
    method='POST',
    data=json.dumps({'url': 'https://[email protected]/login', 'country': 'ES'}).encode(),
    headers={
        'Authorization': 'Bearer ' + api_key,
        'Content-Type': 'application/json',
        'Idempotency-Key': str(uuid.uuid4()),
    },
)
with urllib.request.urlopen(request, timeout=30) as response:
    result = json.load(response)
print(result['data']['result'], result['meta']['unitsCharged'])

import { randomUUID } from 'node:crypto';

const requestId = randomUUID();
const apiKey = process.env.NOCALL_API_KEY;
if (!apiKey) throw new Error('Set NOCALL_API_KEY');

const response = await fetch('https://api.nocall.io/v2/website-legit', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer ' + apiKey,
    'Content-Type': 'application/json',
    'Idempotency-Key': requestId,
  },
  body: JSON.stringify({ url: 'https://[email protected]/login', country: 'ES' }),
});
const result = await response.json();
if (!response.ok) throw new Error(result.error?.code ?? 'request_failed');
console.log(result.data.result, result.meta.unitsCharged);

{
  "data": {
    "tool": "website-legit",
    "result": {
      "domain": "example.net",
      "domainAscii": "example.net",
      "verdict": "warning",
      "official": false,
      "brand": null,
      "ageDays": 11381,
      "registered": "1995-08-31",
      "ranked": false,
      "rank": null,
      "campaigns": {
        "count": 0,
        "lastSeen": null
      },
      "signals": [
        "not_ranked"
      ],
      "linkFlags": [
        "userinfo"
      ],
      "attention": true,
      "checks": {
        "age": "ok",
        "popularity": "ok"
      }
    }
  },
  "meta": {
    "requestId": "req_example",
    "unitsCharged": 1,
    "usage": {
      "periodStart": "2026-10-01",
      "unitLimit": 20,
      "unitsUsed": 3,
      "unitsRemaining": 17
    }
  }
}

• API reference ↗

Frequently asked questions

Related guides

• How old is this website?
• Domain popularity check
• Check a link