Fraudulent domains share a small set of operational fingerprints: very young WHOIS records, mismatched DNS, fresh free SSL certificates, and clean-by-newness reputation scores. Here's how to spot them.
No single check is conclusive — a legitimate startup can also be under 90 days old. Combine age + DNS hygiene + certificate freshness + lookalike pattern. Three matching signals is a strong verdict.
Run through these steps in order. Each step links to the right diagnostic tool.
Domain age. The vast majority of phishing and scam domains are under 90 days old when used.
Free certificates are issued in seconds with no identity verification. SSL proves the connection is encrypted, not that the operator is legitimate.
Reactive blacklists lag the first wave of abuse. Use age, DNS hygiene, and SSL freshness together — they catch fraud the reactive feeds haven't seen yet.
Save the verification sequence as a workflow and resume it on any suspicious URL or domain. Mature teams run it from a saved monitoring workspace.
Monitor it continuously
Save this check, get alerts on changes, and track multiple domains in one dashboard.