Is this website legit?

About to buy from an online shop you’ve never heard of, or got a link in WhatsApp, SMS or email that looks a bit off? Paste the website address or link below and press Check. FernTool looks at the warning signs scam sites usually have, without you opening the site yourself.

Try: takealot.com · fnb.co.za · wikipedia.org

✓ No common scam signs found.

Website checked: wikipedia.org (“Wikipedia”), reached after 1 redirect from the link you pasted.

✓ wikipedia.org has been registered for 25 years. Scam sites rarely last that long.
✓ The connection is encrypted (HTTPS). Note: scam sites have HTTPS too, so the padlock alone proves nothing.
✓ wikipedia.org has proper email set up, protected against fake emails (DMARC).

Warning signs only: no checker can prove a website is honest. Not a malware scan. Look up who owns wikipedia.org · see every redirect · check again

JSON

{
  "ok": true,
  "checked_at": "2026-11-11T14:59:12.258Z",
  "input_url": "https://wikipedia.org/",
  "final_url": "https://www.wikipedia.org/",
  "domain": "wikipedia.org",
  "redirects": 1,
  "final_status": 200,
  "final_title": "Wikipedia",
  "domain_created": "2001-01-13T00:12:14.754Z",
  "domain_age_days": 9433,
  "registrar": "MarkMonitor Inc.",
  "brand_lookalike": null,
  "receives_email": true,
  "email_protected": true,
  "verdict": "no_signs",
  "headline": "No common scam signs found.",
  "signs": [
    {
      "level": "good",
      "text": "wikipedia.org has been registered for 25 years. Scam sites rarely last that long."
    },
    {
      "level": "good",
      "text": "The connection is encrypted (HTTPS). Note: scam sites have HTTPS too, so the padlock alone proves nothing."
    },
    {
      "level": "good",
      "text": "wikipedia.org has proper email set up, protected against fake emails (DMARC)."
    }
  ],
  "note": "Warning signs only: no checker can prove a website is honest. Not a malware scan."
}

What we check

How old the website is: the domain’s registration date from the official registry (RDAP). Scam shops are usually only days or weeks old.
Fake brand names: names like fnb-secure-login.co or takealot-sale.shop that copy a bank, shop, courier or SARS but aren’t the real website.
Look-alike letters (special characters that imitate normal ones), bare IP addresses and scam words such as “verify”, “refund” or “parcel” in the name.
Where the link really goes: every redirect, so a short link can’t hide the real site.
Encryption (HTTPS) and whether the page loads at all.
Email: whether the domain can receive email and is protected against fake emails. Real businesses nearly always have working email on their own domain.

Signs of a scam online shop (that no tool can check)

Prices that are too good to be true: 70–90% off popular brands, PlayStations, air fryers or sneakers.
Only EFT or crypto accepted, or a “discount” for paying by EFT. Card payments and services with buyer protection can be disputed; an EFT usually can’t.
No real contact details: no physical address, no landline, only a WhatsApp number or a contact form.
Copied or odd text: spelling mistakes, other shops’ photos, and returns policies that mention another country.
Pressure: countdown timers, “only 2 left”, “closing-down sale”.
Social media ads only: the shop appeared out of nowhere in a Facebook or Instagram ad.

A quick extra check: search the shop’s name plus “scam” or “reviews”, and look at sites like HelloPeter for South African businesses. No reviews at all for a shop with “thousands of happy customers” is a red flag.

Fake bank and SARS login pages

Banks, SARS and couriers don’t send links asking you to “verify” your account, pay a small “customs fee” or confirm an OTP. If a message pushes you to a login page, close it and open your banking app or type the real address yourself (for example fnb.co.za, capitecbank.co.za, sars.gov.za). Never share an OTP or PIN, even with someone who says they’re from your bank. More examples in how to spot WhatsApp and SMS scams.

Honest limits

This tool shows warning signs, not a guarantee. It doesn’t scan for viruses, can’t see a site’s stock or delivery record, and an old website can still be hacked or run by a dishonest seller. Treat “no warning signs” as “passes the basic checks”, and still pay in a way you can dispute. Results are kept for 60 seconds.

Frequently asked questions

How can I tell if a website is legit?

Check five things: how old the domain is (scam shops are usually weeks old), whether the name copies a big brand, whether the prices are unrealistically low, whether there’s a real physical address and phone number, and what other people say about it (search the name plus “scam” or “reviews”). This checker does the technical part for you in one click.

Does a padlock (HTTPS) mean a site is safe?

No. HTTPS only means the connection is encrypted. Free certificates mean almost every scam site has a padlock too. It tells you nobody can snoop on the connection, not that the people running the site are honest.

Why does the age of a website matter?

Scam shops and fake login pages are usually set up quickly, used for a few weeks and then abandoned once they get reported. A domain registered last week selling heavily discounted goods is a classic scam pattern. A domain that’s been around for years is a much better sign.

The checker found no warning signs. Is the site definitely safe?

Not definitely. It means the site doesn’t have the common technical warning signs. An older site can still be hacked or run by a dishonest seller. Pay with a credit card or a payment method with buyer protection, and avoid paying a new online shop by EFT.

I already paid a scam website. What now?

Call your bank’s fraud line straight away (the number on the back of your card) and ask them to stop or dispute the payment. Change any password you typed on the site, and report the site to Google Safe Browsing so it gets blocked for others. In South Africa you can also open a case at your local SAPS station.

Related tools and guides

API: GET /api/website-legit?url=example.co.za · MCP tool check_website_legit.