Example result
The address https://example.com, checked on 2026-10-19.
- Reading
- No risk indicators found, confidence medium
- Address signs
- None found
- Domain age
- example.com: registered 31 years ago (11,389 days), on 1995-08-14
- Warning list
- Not listed (CERT Polska Warning List of malicious domains, data of 2026-10-18)
Captured 2026-10-19.
How it works
- Paste a web address, or just a site name. Whatever you paste is trimmed and read right away in your browser.
- The address is scanned for look-alike letters, brand names in the wrong place, numeric hosts, shorteners and similar signs. Then the domain age and the warning list are checked together.
- You get one of four bands, a confidence band, and the findings that produced it, with the signs from the address listed first.
What this check reads
Three things: the characters and structure of the address, the date the domain was registered (from the registry that runs its ending), and the CERT Polska warning list of malicious domains. It does not open the page, take a screenshot or read what the site says.
A site can look wrong and still be harmless, and a harmful site can have an ordinary address. That is why the page gives a band built from several signs, and never a yes or no.
How the band is built
Each sign carries a weight: critical is 8 points, strong 4, moderate 2 and weak 1. 6 points or more is high risk, 3 to 5 is medium risk, 1 to 2 is low risk, and no signs at all reads as no risk indicators found. A warning list match is critical on its own.
Confidence is a band, not a percentage. It is high when the warning list names the domain, or when all three checks ran and several separate signs agree. It is medium when all three ran. It is low when a check could not answer, and the page says which one.
What no risk indicators found means
It means none of these checks found a warning sign. It does not describe the site. A domain that has existed for years and sits on no list can still be run by a bad actor, and a hacked site can keep an old, clean-looking address.
Before you pay or share details, look for who runs the site: a company name, a postal address, and reviews you find yourself rather than ones linked from the site.
How the address checks work
The registered domain is found with a short list of common multi-part endings that we keep, such as co.uk and com.au, not the full public suffix list. An uncommon ending is cut at the last dot, and a site on a platform's own domain is read as the platform's domain, so its age is the platform's age.
The look-alike check compares the registered domain with a short list of 50 widely used domains that we chose. Only names of 5 or more letters before the ending are compared, so short names do not match by accident.
The list of cheap endings that appear often in abuse reports is also ours. It is a statistical signal about a group of domains, and it carries the lowest weight.
Addresses longer than 2,048 characters are not accepted. Only http and https addresses are read.
The signs this check looks for, how each one is read, and its weight
| Sign | How it is read | Weight |
|---|---|---|
| Domain on a public warning list | The domain, or a parent of it, appears on the CERT Polska warning list of malicious domains. | Critical |
| Registered within 30 days | The registry shows the domain was created 30 days ago or less. | Strong |
| Name before an @ sign | The address puts text and an @ before the real host, so the first name looks like the site but the browser goes to the name after the @. | Strong |
| Well-known brand in a subdomain | A brand from our short list appears left of the registered domain, as in paypal.com.example.net, where the registered domain is example.net. | Strong |
| Look-alike characters | Swapping look-alike letters (Cyrillic or Greek letters, rn for m) turns the domain into a domain on our reference list. | Strong |
| Mixed alphabets in one name | One name part mixes Latin with Cyrillic or Greek letters, which can make a name look like another. | Strong |
| Registered within 180 days | The registry shows the domain was created more than 30 and at most 180 days ago. | Moderate |
| One edit from a well-known domain | The registered domain is one typo, swap, extra or missing letter from a domain on our reference list (domains of 5 or more characters). | Moderate |
| Brand joined to other words | A brand from our short list is hyphenated with other words in the registered name, as in brand-login.com. | Moderate |
| Numeric address instead of a name | The host is an IP address, written out or as a single number, rather than a domain name. | Moderate |
| Link shortener | The domain is a known link shortener, so the final destination is not visible in the address. | Moderate |
| Non-English letters in the name | A name part is written in punycode (xn--), meaning it holds letters outside basic Latin. Many real sites do this. | Weak |
| Many subdomain levels | 4 or more name parts sit left of the registered domain. | Weak |
| Plain http | The address starts with http:// so the connection is not encrypted. | Weak |
| Ending often seen in abuse reports | The domain ends in one of a short list of cheap endings that show up often in abuse reports. A statistical signal, not proof. | Weak |
| Long, hyphen-heavy host | The host is 35 or more characters and holds 2 or more hyphens. | Weak |
| Sign-in style words in the path | The path or query holds one of: login, verify, secure, update, wallet, claim. | Weak |
Sources
- CERT Polska, Dangerous websites Warning List read 2026-10-19
- IANA RDAP bootstrap file, the list of registry lookup services used for domain age read 2026-10-19
- FTC Consumer Advice, How to recognize and avoid phishing scams read 2026-10-19
- RFC 3986, Uniform Resource Identifier: Generic Syntax (the user information part before an @) read 2026-10-19
- RFC 3492, Punycode: encoding of internationalized domain names read 2026-10-19
- Unicode Technical Standard #39, Security Mechanisms (mixed-script and confusable characters) read 2026-10-19
This tool is run by LookValid. It is not connected to any agency, company or service named on this page.
Frequently asked questions
Does this tell me whether a website is real?
No. It reports warning signs and gives a risk band. A result of no risk indicators found only means these checks found nothing, and the page says so in the result itself.
Does it open the website?
No. The address is read in your browser, and only the site name goes to the domain age and warning list checks. Nothing on the page can run, and no screenshot is taken.
Why does a new domain raise the band?
Registering a domain costs little, and many abuse campaigns start on a fresh one. A domain registered 30 days ago or less is a strong sign, and one registered 180 days ago or less is a moderate one. Plenty of honest new businesses are young too, which is why age alone never reaches high risk.
What if one of the checks fails?
The signs found in the address still show, and the page names the check that could not answer, for example that domain age could not be read right now. Confidence drops to low when a check is missing.
Why is domain age sometimes not available?
Some endings have no public registry lookup service, and a name that is not registered has no date to read. The page says which case applies and counts neither as a warning sign.
What is the @ trick in an address?
Text before an @ in a web address is a login name, not the site. An address such as https://paypal.com@example.net takes your browser to example.net, though the first name is the one that catches the eye.