A text arrives. Your parcel is on hold, there is a small fee, here is a link. Read it twice and you will find nothing in it that has taken anything from you yet. It is two lines and a doorway. The damage happens on the other side, on the fake website you land on after you tap. So this post is about that second step: how to judge the website itself, instead of arguing with the message that sent you there.
Is the message really the thing to check?
The message is the cheap part. Anyone can send a text or an email, and the wording can be copied from a real one in a minute. What the scammer needs from you happens later: a password typed into a form, a card number pasted into a checkout, a file opened. All of that lives on a website.
Malwarebytes reported something that fits this picture in a press release dated 5 October 2026. Its researchers found that malicious websites (phishing pages, counterfeit stores and malicious ads) outnumber every other scam delivery method, ahead of email and text messages.
Two caveats, because I would rather be straight with you. First, that is Malwarebytes' own finding, and the release gives no method, sample size or counts for it. Second, the coverage I found elsewhere is a rewrite of the same release, not a second study. Treat it as one security company's read of its own data, and a reasonable reason to look at the destination. 🤓
Why does judging the message not work any more?
First of all, because the message is the one part the scammer fully controls. Brand name, friendly tone, logo, a believable reason to hurry: all of it is copyable. The same Malwarebytes release says 85% of people say they can no longer reliably tell a scam from the real thing, up from 66% a year earlier. Same caveat applies (their own figure, no method given). The direction is still worth noticing. If people feel they can't read the message any more, the message is the wrong place to spend your effort.
The link text is no better. What a link says and where it goes can differ, and even hovering to preview the address has stopped being proof, which I covered in Hovering over a link no longer proves where it goes.
The destination is harder to fake. A scammer can write any message they like, but the site has to live at an address. That address has a name, a registration date, and a blocklist status. Those you can look up.
What can you actually judge about a website?
Four things, and none of them needs you to be technical.
| What you look at | What it can tell you | What it can't tell you |
|---|---|---|
| The domain name | Whether it is the brand's real address or a lookalike: a swapped letter, an extra word, a different ending. | Anything about a brand the check does not know. |
| Its age | A domain registered days ago, claiming to be a company with decades of history, is a mismatch. | Old is not innocent. Young is not guilty. |
| Google Safe Browsing | Whether Google's list of confirmed dangerous sites already contains it. A hit is a strong signal. | Anything about sites nobody has reported yet, which is where new scams start. |
| Where it is hosted | A "bank" served from a free site builder is an odd match worth a second look. | It is a hint. It is never a verdict. |
Each of these has its own post if you want the detail. The letter-swap trick covers lookalike spelling. What a domain's age tells you covers registration dates. What Google's dangerous-sites list catches covers Safe Browsing and its blind spots.
I also wrote a version for shops only, how to check a fake shop before you pay. This one is the general case: a login page, a "shared document", a prize page, a support page, a parcel tracker. Any site that arrived through a message you did not ask for.
paypal.comthe brand's own domainpaypal.com.account-check.example[.]comthis address belongs to example[.]com, not PayPalHow do you check the site you landed on?
- Stop before you type anything. Opening a page is rarely the damage. Filling in its form is. Close the tab if you are unsure.
- Read the address bar from the right. A brand's name sitting at the left is decoration. The owner is the last name plus ending before the first single slash (two names plus ending for things like co.uk). In the example above, that is
example[.]com. - Copy the domain, don't retype it. Retyping fixes a swapped letter without you noticing.
- Paste it into IP Tracker and read three things: whether it names a lookalike, whether Safe Browsing has flagged it, and when the domain was registered.
- Go around the message. Type the company's real address yourself, or open its app, and look for the same notice there. A real parcel fee or a real security alert will be waiting in your account.
And if you already typed a password into the page? Change it on the real site (typed by hand, not from the message) and anywhere else you reused it. If you entered card details, call your bank on the number printed on your card. Unfortunately, every hour counts here.
What does IP Tracker show you here?
IP Tracker is my free Chrome extension. Paste a domain or a full email address into the popup; you get 50 checks a day, with no account and no tracking. Only the value you paste is looked up.
For a site you landed on, it compares the domain with the official domains of roughly 125 widely impersonated brands (banks, couriers, payment services, big tech, government, crypto and streaming) and names the trick if it finds one. It also shows whether Google Safe Browsing has flagged the domain, how many security vendors on VirusTotal flag it, the registration date, DNS records and where the site is hosted. If another warning is already showing and the domain is under about 90 days old, the banner adds a "Registered N days ago" line as a supporting clue.
What can't it do?
This post would be dishonest without this section, so here are the real limits.
- If the impersonated brand is not among the roughly 125, the lookalike check will not catch it. A fake of your local credit union, a small online shop, a regional courier or a niche software company is not on the list. The check will stay quiet, and that quiet means nothing.
- It is not a spelling check only. Many scam sites do not need a name that looks like the brand at all. They can live at any address that sounds believable, so there is nothing for a lookalike comparison to bite on.
- A brand-new site has no history. It is not on Safe Browsing yet and security vendors have no detections yet. Zero detections on a five-day-old domain is the expected result, not a reassuring one.
- A hacked real site looks clean. A trusted, old domain with a bad page planted on it passes the name and age checks.
- It cannot see the page. It does not read the content, the login form, or what happens to what you type. It looks at the domain and its infrastructure, and it checks the address you give it. It does not follow redirects to the final stop.
- It does not stop anything. It flags and surfaces signals. You decide.
To summarize
- ✓ The message is the doorway. Judge the website behind it.
- ✓ Check the domain, its age and its Safe Browsing status before you type anything.
- ✓ Read each result as a signal, not a verdict.
- ✓ A quiet result on a new site, a small brand or a hacked site proves nothing.
- ✓ When in doubt, go around the message and open the real site yourself.
Happy careful clicking! 😉
Sources
- Malwarebytes, Malwarebytes Launches Free Scam Link Check So Anyone Can Verify a Link is Safe Before They Click (press release, 5 October 2026). Source of the "websites outnumber email and text" ranking and the 85% vs 66% figure. Both are Malwarebytes' own claims; the release gives no method or sample size.
- Help Net Security, Malwarebytes Scam Link Check analyzes URLs and explains potential risks (5 October 2026). A rewrite of the same release, not independent confirmation.