How we check

What we check

When checking a link, we look at four things at once.

1. The address itself

• The name: whether it imitates a well-known brand or bank — with similar letters or an added word.
• The age: when the domain was registered. A site a few weeks old that takes money is a sign of its own.
• The security certificate: whose name it is in and when it was issued.
• Server and mail: where the site is hosted, whether it has a mail server, and whether it shares an “intermediary” with other sites.

2. The page itself

• Promises: if the page promises you a daily or weekly income, we calculate how much it would come to in a year. Such an amount is often arithmetically impossible.
• Withdrawing money: whether the page asks for an extra payment or for inviting new people before you can withdraw your own money.
• An invitation scheme: whether they pay you not only for the people you invite but also for the people they invite — the structure of a pyramid.
• A password form: where a typed password or card details are sent.
• Two faces: whether the site shows different visitors different pages.

3. Public lists

• Security services: Google Safe Browsing, VirusTotal and urlscan.io.
• Regulators' warnings: the lists of the French (AMF) and Hong Kong (SFC) financial supervisors on companies that are not licensed to handle money.
• Community lists: ScamSniffer's crypto-phishing list and BehindMLM's reviews. These are not official sources, so we weigh them separately and more carefully.

4. The history

In the Internet Archive's (Wayback Machine) old copies we check what the site used to say — a scheme often changes its name, but not its text.

A Telegram channel

We read the channel's public page — what anyone sees without joining: the description, the posts and the site the channel sends people to. We do not join the channel.

What the colours mean

• 🔴 Dangerous. Only when an official source (a regulator's or a security list) names the site as dangerous, or at least two strong signs, independent of each other, are confirmed. One word or one source can never give red.
• 🟡 Suspicious. We found signs that call for caution.
• 🟢 No danger signs found. This is not a guarantee — see below.
• ⚪ Could not determine. We could not collect enough facts: for example, the site blocks the check.

Every answer comes with its reasons, and each reason with an explanation of “what it means”.

What we do not do

• We do not fill in forms or open accounts — we read the site the way an ordinary visitor does.
• We do not get around a block. If a site blocks the check, the answer we write is “Could not determine”.
• We do not check the sites of Georgian state bodies — we do not send them a single request.
• We do not write people's names. We write about sites and facts.
• We do not guess with artificial intelligence. Fixed rules give the answer: the same facts — the same answer.

How accurate it is

We test every change on 96 genuine sites — Georgian and foreign banks, shops, exchanges, media — and on known fraudulent sites. Right now all 96 genuine sites are green. A change that causes a false alarm on a genuine site does not go in.

What we may miss: a brand-new site that is not on any list yet and blocks our check. In that case the answer will be “Could not determine”, not “Dangerous”.

How a site gets into “Suspicious links”

• A site gets onto the list only when our check rates it red twice, a few minutes apart, independently of each other.
• Never on the list: a state body's site, a genuine site in our measurement set, and a shared platform (for example, a forms or short-link service) where only one user's page is dangerous.
• Every site has its own page: what we found, what it means, the source and the date.
• If a site got there by mistake, its owner writes to us from the bottom of the page. The site is checked again automatically, and a person reviews the entry. A complaint does not delete the entry by itself.

What is stored and what is not — privacy.

Frequently asked questions