In short. The most reliable tells of a fraudulent site are technical ones that can't be faked quickly: the domain was registered weeks ago (check via WHOIS), the address differs from the official one by a single letter or a different zone, a cheap certificate carries no organization data, and contacts and legal details are hidden. The check takes two minutes: look at the domain's age, compare the spelling of the address carefully, open the SSL certificate details, and search for legal information. No single sign is a verdict — weigh them together. Below is the full 12-point checklist with tools.
Why the padlock guarantees nothing
The most persistent myth: "there's HTTPS and a padlock, so the site is safe." The padlock means only one thing — the connection is encrypted and no one can intercept the data in transit. Who sits at the other end of that encrypted channel — a bank or a fraudster — the padlock does not say.
The padlock in the address bar confirms the channel is encrypted. It says nothing about who is at the other end of that channel.
A free DV (Domain Validation) certificate is issued automatically in minutes and proves only control of the domain. According to the Anti-Phishing Working Group (APWG), the vast majority of phishing sites have long run over HTTPS — with a valid padlock. So the padlock is a hygiene minimum, not a trust badge: its absence is unambiguously bad, its presence means nothing.
Technical signs: what to check in 2 minutes
1. Domain age
The main "unfakeable" sign. A real shop or bank lives on its domain for years; phishing sites live for days — they get blocked, so fraudsters register new ones by the batch. Open a WHOIS lookup and look at the registration date (Creation Date). Two weeks old, yet the site claims to be an "official dealer since 2010"? Close the tab. How to read the remaining fields is in the WHOIS guide.
2. The address spelling: swapped letters and zones
A phishing classic is typosquatting: an address differing from the real one by a single character. The tricks: swapped letters (paypal → paypall), transposition (amazon → amaozn), a different zone (.com → .com.co, .online, .shop), hyphens and prefixes (amazon-sale24). A separate trick is homoglyphs: a Cyrillic "о" is visually identical to a Latin "o," and the browser will show such an address as xn-- gibberish (punycode). A well-known 2017 demonstration by Xudong Zheng: an "apple.com" spelled entirely in Cyrillic, with a valid certificate.
3. SSL certificate details
Open the SSL check and look not at "valid/invalid" but at the details: who it's issued to, by whom, when. Issued days ago, type DV, Organization field empty though the site poses as a large company? Real banks and corporations usually carry OV/EV certificates with a legal entity inside. The difference between types is in the certificate types article; that's also where you'll see why the full certificate history of a domain is visible in CT logs.
4. Where the link actually leads
The link text and its address are two different things. Hover (without clicking) and read the real URL in the status bar. In emails and messengers fraudsters hide the address behind shorteners — expand it without visiting via the redirect chain analyzer.
5. IP and hosting geography
A "local online store" turns out, on an IP check, to sit on bulletproof hosting in an offshore jurisdiction? For a local business that's odd. Not a verdict, but another minus in the pile.
6. The security of the page itself
Run the address through the security scanner: a hastily thrown-together phishing page usually has neither protective headers nor properly configured cookies — a one-day site doesn't invest in what makes no money.
Behavioral signs: how the site acts
7. Bait prices and pressure timers
70% off a scarce item, "2 left in stock," a 15-minute countdown, a flashing banner. The goal is one — to switch off critical thinking and make you pay before you start checking.
8. Prepayment to a personal card only
A real store takes payment via merchant acquiring to a legal entity, offers cash on delivery or pay-on-receipt. A transfer "to John's card" or to an e-wallet is a stop sign: such a payment is nearly impossible to dispute.
9. No legal details or real contacts
Look for a registration number, legal name, address, phone. Found a company number — verify it in the public business registry: does the company exist, what does it do, is it dissolved? Only a contact form and a messenger is a bad sign.
10. Freshly created reviews
Perfect five-star reviews, all from the past week, with stock photos. Search the site's name together with "reviews" and "scam" — victims usually manage to post on third-party platforms.
11. Broken text and borrowed design
Machine translation, mixed layouts, a neighboring brand's logo with a changed name, dead links in the footer — a one-day site has no time for polish.
12. Requests for excessive data
To pay for a purchase you need neither an SMS code "to confirm your identity," nor a PIN, nor full passport details, nor a "verification transfer." A request for extras is phishing's signature move: the fraudster needn't hack you if you enter everything yourself.
A fraudster doesn't need to hack your bank. A page that looks like the bank and three minutes of your inattention are enough.
A quick verification protocol
1. Address: compare spelling character by character, zone vs the official one
2. WHOIS: /whois → domain age, registrar
3. SSL: /ssl → issued to whom, type (DV/OV/EV), issue date
4. IP: /ip → country and hosting
5. Hygiene: /security → headers, cookies
6. Legal: company number → check in the public registry
7. Reviews: "name + reviews," "name + scam"Points 2–5 take under two minutes and require no special knowledge — every tool is free and runs in the browser.
What to do if you've already entered data or paid
- Payment details: block the card in your banking app immediately and reissue it. Report the compromise to the bank — a fresh report improves the chances of a chargeback.
- Password: change it everywhere you reused it, starting with email. Turn on two-factor authentication — how to do it right.
- SMS code: call the bank at once — the account may already be draining, and minutes count.
- Report: capture screenshots, the site address, the payment details, and file a report with the police. Submit the site as an abuse complaint to the domain registrar and to browser reputation services — a blocked phishing page won't collect its next victims.
Frequently asked questions
Can I trust a site because it ranks first in search?
No. Fraudsters buy ads on brand queries, and a phishing page can appear above the real one — marked "ad." It's safer to open the official site from a saved bookmark or the address on the back of your bank card.
Is there a single blacklist of fraudulent sites?
No single one, but the ecosystem works: browsers keep their own lists (Safe Browsing), regulators and CERTs trigger takedowns of tens of thousands of phishing resources a year, and registrars have an abuse-complaint process. The problem is speed: days pass between a site appearing and being blocked — and that's exactly how long phishing needs to live.
What checks a site automatically?
The technical minimum in two minutes: WHOIS (age), SSL (who and when the certificate was issued), IP (where it's hosted), security scanner (headers and cookies). For your own site it's worth going further and watching for clone domains — typosquatters register look-alikes of other brands long before the mailings begin.
Checklist to remember
- A padlock ≠ safety: it confirms encryption, not the owner.
- The most reliable signs are domain age, exact address spelling, and certificate details.
- Weigh the signs together: one minus is a reason to pause, three is a reason to close the tab.
- Prepayment to a personal card + a pressure timer = almost certainly fraud.
- Already paid — block the card and call the bank now, not "tomorrow."