How we score a shop

The score, in one paragraph

Every scan runs 150+ individual deterministic checks — you watch each one stream live during the check, and every verdict lists all of them. They roll up into a risk score from 0 to 100: deterministic infrastructure and page signals add points (capped at 75 combined), an AI review of the rendered page contributes at half weight (up to ~43 points), and deterministic trust indicators — evidence the operator pays for legitimate services — subtract points (capped at −12, deliberately less than one verdict band, so faked trust signals can never move a verdict a full level). If an authoritative source flags the site (Google Safe Browsing, a public threat blocklist, a urlscan.io "malicious" verdict, or the page itself displaying a phishing block), the score is floored at 85 regardless of anything else — trust indicators can never buy that down.

Domain & infrastructure controls

Deterministic lookups against public records — no AI involved. This group is capped at 70 points.

† Also triggers the authoritative floor: the final score cannot fall below 85 (urlscan "suspicious" adds points but does not trigger the floor).

How we determine domain age

Where the registry publishes a creation date (most global TLDs, via RDAP) we use it directly. Some registries — including Australia's .au — publish no creation date at all. For those we fall back to the domain's earliest observable footprint: its first TLS certificate in public Certificate Transparency logs, then its earliest Internet Archive snapshot. These proxies only prove the domain existed by that date — public certificate logs only reach back to around 2013–2015 — so we always report proxy-based ages as "at least this old", and a long-established domain may be far older than the floor we can prove.

Page-content controls

Deterministic pattern matches against the rendered page's visible text. This group is capped at 60 points; combined with the infrastructure group above, the deterministic total is capped at 75.

These are deliberately mild individually — a legitimate store running a sale is not condemned; they matter when they stack with other signals.

AI forensic review

A language model reviews the rendered page for storefront-scam patterns we cannot express as fixed rules: brand impersonation on a lookalike domain, heritage claims ("since 1932") that contradict the measured domain age, and deep sitewide discounts on branded goods on a very new domain. Its assessment contributes at half weight:

The AI can only raise or lower within these bounds — it cannot flag a site on its own past the "elevated" band without deterministic signals alongside it, and its findings are always shown as hedged observations.

Trust indicators — evidence of a real business

Throwaway scam storefronts almost never pay for business services or pass identity checks. Each indicator below is deterministic — DNS records, certificate fields, or the real SDK URLs embedded in the page (never logo images or text, which are trivially faked) — and subtracts points. The combined credit is capped at −15, and can never override the authoritative floor.

Free trackers (Google Analytics, Meta Pixel, …) are shown for context but earn no credit — they cost nothing to add, so they say nothing about legitimacy. Combined credit is capped at −12 — less than one verdict band.

Scam-tell controls

Deterministic patterns that fake storefronts exhibit and legitimate ones don't. Each is individually small; the group is capped at +35 so no single lane can condemn a site alone.

The full list of every check, with its live determination, is shown during each scan and on every verdict.

Honest limitations

• Checks are automated and point-in-time. Sites change; data sources can be stale, incomplete or wrong.
• A low score is not a guarantee of safety, and an elevated score is not an accusation — it means several signals we associate with unsafe storefronts are present.
• Some sites block automated inspection; when we cannot load a page we say so rather than guessing.
• Sophisticated fraud can imitate some trust indicators; that is why credits are small, capped, and keyed on things that cost money or identity verification.
• Wrongly flagged? Appeal — a human reviews every case, and corrections update the published verdict.