When encountering an uncertain website, how do you usually determine if it is credible?
Many people rely on visual impressions; if the website looks professional, they feel it is okay, and if there is an HTTPS lock icon, they feel reassured. However, the cost of creating a scam website has become very low today. A glossy-looking website with an SSL certificate can be set up in a matter of hours, making visual judgment unreliable in this environment. The good news is that there are several concrete tools and methods for determining a website's credibility, all of which are free and require no technical background.
The First Tool: VirusTotal
URL:virustotal.com VirusTotal is a security analysis service under Google that allows you to submit a URL for analysis by over ninety different security vendors' scanning engines simultaneously to see if any vendor has flagged the URL as malicious or a phishing site. Using it is very simple: visit the VirusTotal website, switch to the URL tab, paste the URL you want to check, and within seconds you can see the results. The results page shows each security vendor's judgment on the URL, with green representing no issues detected, red indicating it is marked as malicious, and yellow indicating it is suspicious. If two or more vendors flag the same URL as malicious, that is a quite clear warning. It’s important to note that if a website is a newly launched scam, vendors' databases may not have been updated yet, so VirusTotal might show all green results but that does not mean it is safe. VirusTotal is a great confirmation tool, but its results need to be assessed alongside other methods.
The Second Tool: WHOIS Inquiry
URL:who.is WHOIS is a public service that queries domain registration information, allowing you to see when a domain was registered, which service provider manages it, and the contact information of the registrant (some information might be redacted for privacy protection). For determining scam websites, the most useful piece of information is the domain registration date. Scam websites are generally newly established. If a website claims to be the official website of a well-known brand but the domain was registered only a few weeks or months ago, this inconsistency is itself a clear signal. Real brand websites typically have domains that have existed for several years or even over a decade. If a site claims to be a large retailer or financial institution, but its domain was registered three months ago, the credibility of that site is seriously in question.
The Third Tool: Google Safe Browsing Status Check
URL:transparencyreport.google.com/safe-browsing/search Google's Safe Browsing service powers the phishing website detection mechanism behind Chrome, Firefox, and Safari, maintaining a database of known malicious websites. Through Google's Transparency Report page, you can directly check if any URL is marked in this database. Once on the page, paste the URL into the search bar, and Google will tell you whether the site is currently marked as unsafe and when it was last scanned. The judgment basis for this tool is that Google's crawler has actively scanned the site, so it has a high coverage rate for known scam websites, but it may also face delays for newly launched sites.
The Fourth Tool: ScamAdviser
URL:scamadviser.com ScamAdviser is a service specialized in assessing website credibility, incorporating multiple dimensions of information, including domain age, server location, website traffic, user reviews, and other technical indicators to provide a trust rating. By entering the URL into ScamAdviser's search box, you will see a numerical trust rating along with the main bases for that rating, such as a too-short domain age, server located in high-risk areas, or technical features similar to known scam websites. ScamAdviser is particularly suitable for checking unfamiliar shopping sites or services; its scoring logic is more comprehensive than merely looking at VirusTotal’s scan results and is better suited for general users to understand.
The Fifth Tool: Confirming SSL Certificates and Domain Details
This method requires no external tools and can be completed directly in the browser. Click the lock icon next to the URL field, choose 'Certificate' or 'Connection Security' to view details about the site's SSL certificate, including which organization issued the certificate, the domains covered by the certificate, and its expiration date. When assessing official websites, it is particularly important to check whether the domain covered by the certificate is fully consistent with what you see in the URL field. Scam websites sometimes use sub-domains containing the target brand name, such as google.phishingsite.com; this URL appears to include Google, but the actual domain is phishingsite.com, and the certificate pertains to this domain instead of Google. The details of the domain itself are also worth examining carefully; common deception tactics include replacing visually similar characters, such as using the number 0 in place of the letter O, or the letter l in place of the number 1, or adding seemingly official-sounding terminology after the official domain, such as paypal-secure.com or apple-support-id.com; these are not the real PayPal or Apple domains. Further reading:
Common Questions Users Ask About Website Verification
If all five tools give inconsistent results, which one should I trust?
When different tools provide different results, a safer approach is to use the most conservative judgment as the benchmark. If VirusTotal shows a vendor marking it as malicious, even if ScamAdviser's rating appears normal, this website should be treated with high suspicion. Additionally, if the WHOIS registration time of the domain is very short, even if all scanning tools show normal results, this inconsistency is still a signal that should not be overlooked. Any appearance of suspicious signs warrants a pause, and you should not become fully reassured just because other tools show normal results.
Can these tools be used to check apps? Or can they only check websites?
These five tools are primarily designed for websites and URLs. VirusTotal can check APK files or application installation packages; you can upload files to VirusTotal for analysis to view the scanning results from various security vendors. For assessing the credibility of apps, a straightforward method is to confirm whether the app is listed in the official stores of Google Play or Apple App Store, check ratings and download numbers, and ensure that the developer's name matches the official one. APK files downloaded from unofficial channels can be scanned with VirusTotal as a basic safety confirmation before installation.
Can these tools be used to check apps? Or can they only check websites?
These five tools primarily focus on website and URL design. VirusTotal can check APK files or application installation packages by uploading the files to VirusTotal for analysis, allowing you to see the scan results from various security vendors. For assessing the credibility of an app, a straightforward approach is to verify whether the app is listed in the official stores like Google Play or Apple App Store, check ratings and download counts, and confirm if the developer's name matches the official one. APK files downloaded from unofficial channels can be scanned via VirusTotal as a basic safety check before installation.
One Key Takeaway: To determine whether a website is a scam, you don't need to rely on intuition. By using VirusTotal, WHOIS, Google Safe Browsing, ScamAdviser, and the built-in SSL certificate verification in your browser, you can gain a fairly concrete understanding of an uncertain website within minutes.