Online Shop Scam Checker Live DNS and Archive Checks Plus a Risk Checklist

What this checker does

This tool takes the URL of an online shop and produces a three-part risk assessment. The first part is a set of live network checks that contact public DNS and archive services directly from your browser. The second part is an automatic analysis of the address itself — top-level domain, brand impersonation, link shorteners, and other URL patterns that show up again and again in fake shops. The third part is a manual verification checklist covering the things that only you can check once you have the shop open in another tab: the contact details, the return policy, the pricing, the payment methods, and the social media history.

The result is a single risk score between 0 and 100, with a plain-English recommendation. A score under 15 suggests the shop looks broadly normal, though it does not guarantee anything. A score between 15 and 34 suggests caution. A score of 35 or above suggests the shop has enough red flags that you should not enter payment details. A score of 60 or above strongly suggests fraud. A domain that does not resolve at all is treated as conclusive, and the tool flags it as very high risk regardless of the other signals.

Everything runs inside your browser. Your browser never contacts the shop itself. The live DNS and archive checks contact Cloudflare and the Internet Archive directly from your tab, not through an AfriWidget server. If you press the AI insight button, only an anonymous summary of the flag counts and risk score is transmitted to a small serverless function that runs once and then stops. The URL itself is never uploaded.

The live network checks

The tool runs two live checks when you press the button. Both run entirely in your browser and both are read-only lookups against public services. Neither contacts the shop.

DNS resolution check. The tool sends the domain to Cloudflare's public DNS resolver using the DNS-over-HTTPS JSON API, and reads the response code. If the resolver returns NOERROR, the domain exists and has at least one A record. If it returns NXDOMAIN, the domain does not exist at all — it was never registered, has expired, or has been taken down. A URL that does not resolve cannot be a real shop. This is one of the strongest single signals the tool can produce, and it is the reason the tool can now catch fake domains that look clean on the surface but do not actually exist.

Internet Archive history check. The tool queries the Internet Archive's Wayback Machine availability API for the domain. If the archive has at least one snapshot, the domain has a recorded history, which is a reasonable proxy for age and public presence. If the archive has no snapshots at all, the domain is either very new or has been deliberately kept off the archive. That is a weaker signal than NXDOMAIN, but it is still useful — most legitimate shops that have been running for more than a year will have at least a handful of archived pages.

If either check fails — because of a network problem, a browser restriction, or a service outage — the tool marks that row as "could not verify" and continues with the pattern and checklist scoring. Nothing is blocked, and no penalty is applied for a check that could not run.

How the URL pattern analysis works

The address bar contains more information than most shoppers realise. The checker reads the URL as structured text and looks for patterns that fraud prevention agencies around the world consistently flag.

The signals that carry the most weight are:

• Brand impersonation in the domain. If the hostname contains a well-known brand name (Amazon, Jumia, Takealot, MTN, eBay, Walmart, and so on) but is not one of that brand's official domains, that is a strong signal of a fake shop.
• Raw IP address as the host. Legitimate shops have domain names. A URL that points directly at an IP address like 192.168.1.1 is almost never a real store.
• Link shorteners. Bit.ly, TinyURL, and similar services hide the real destination. Shops that only share short links are trying to hide where you are going.
• Suspicious top-level domains. Some TLDs cost nothing to register and are heavily used by disposable scam sites. That does not mean every site on those TLDs is a scam, but it raises the odds.
• Punycode and lookalike characters. A domain containing "xn--" may use characters that look like Latin letters but are not, a technique called homograph spoofing.
• Excessive subdomains or multiple hyphens. Real stores rarely need four subdomains or three hyphens in the domain name.

Each of these signals adds a small number of points to the URL portion of the score. The URL portion is capped, so the address alone cannot push the total into the highest risk band. That is deliberate. A clean-looking URL does not make a shop safe, and a messy URL does not prove fraud. The URL is one input, not the verdict.

The manual verification checklist

The checklist covers the seven things that matter most when you are deciding whether to trust a shop. It is grouped by category so you can see at a glance which area is weakest.

Domain and age. New domains are cheap and disposable. Scam shops often run for a few weeks on one domain, take orders, then vanish and reappear on a new domain. A domain that has been active for years and has a long history of search results and reviews is much less likely to be a disposable fraud site.

Contact information. Real shops publish a physical address, a phone number, and a business email on a company domain. Scam shops often have only a contact form or a WhatsApp number, and if they do list an email, it is usually a free Gmail or Yahoo account.

Policies and security. Legitimate shops have a privacy policy, terms of service, a return policy, and a shipping policy. If any of those are missing, treat it as a warning. The padlock is a separate matter, covered further down.

Pricing and products. Prices far below any other seller, or many products at the exact same price, point to a scam. Reverse-image searching product photos is a fast way to spot copied listings.

Payment methods. This is the strongest single signal. Legitimate shops accept card payments or a recognised wallet with buyer protection. Scam shops usually accept only bank transfer, mobile money, or cryptocurrency, because once the money is sent it is very hard to recover.

Social presence and reputation. Look at the shop's social media. Are the accounts older than the website? Do they have real followers and real comments? Does a search for the shop name plus "scam" or "review" return only complaints?

Brand authenticity. If the shop claims to be a known brand, check the domain against the brand's official website. Fake shops impersonate well-known retailers because shoppers already trust the name.

Domain age and why it matters

Scam shops are usually short-lived. They are set up to run for a few weeks or months, take as many orders as possible, then disappear. That pattern means the domain is usually registered very recently, often within the last few weeks, and often for the shortest possible registration period.

The Wayback Machine check gives you a useful proxy for age without needing a WHOIS lookup. A domain with years of archived snapshots has been public and crawlable for years, which is a meaningful signal. A domain with no archive history at all is either brand new or deliberately kept out of the archive. You can also check domain age directly with any public WHOIS lookup tool — type the domain into a WHOIS service and look at the "Creation Date" field. Anything under six months old deserves extra caution.

You can also check the "Registrar" field. Some registrars are heavily used by scammers because they have minimal verification. That is not proof on its own, but it is one more signal to weigh.

HTTPS and the padlock myth

There is a very common misunderstanding about the padlock in the address bar. Many shoppers treat it as a sign that a website is trustworthy. It is not. The padlock means the connection between your browser and the server is encrypted. It does not mean the server belongs to who it claims to be, it does not mean the shop is legitimate, and it does not mean the products are real.

In the early days of the web, HTTPS certificates were expensive and required paperwork. Today they are free, automated, and issued in seconds by services like Let's Encrypt. Almost every scam shop now uses HTTPS. The British, American, and Australian fraud agencies all warn shoppers not to treat the padlock as a trust signal.

That said, a missing padlock is still a red flag. If the URL starts with http:// instead of https://, or if your browser shows a warning when you visit, do not enter any personal or payment details. But do not let the presence of a padlock reassure you either.

Suspicious pricing and too-good-to-be-true deals

The first thing a scam shop uses to draw you in is the price. Electronics, trainers, phones, gaming consoles, and fashion items are listed at 60 to 90 per cent below what any other store charges. The discount is the bait.

There are a few patterns that show up repeatedly. First, the same price across many different products — a scam shop often lists everything at one figure because the listings were bulk-copied. Second, the same product photos that appear on five different websites when you reverse-image search them. Third, descriptions that are copied word-for-word from a legitimate retailer, complete with that retailer's phrasing and formatting. Fourth, stock levels or countdown timers that never change, designed to push you into buying fast.

If a deal looks too good to be true, assume it is until you have verified the shop independently. A 90 per cent discount on a new iPhone is not a bargain. It is the price of learning a lesson the hard way.

Payment methods that scammers prefer

Every fraud prevention agency lists payment method as the most reliable signal of whether a shop is a scam. The reason is simple: cards and protected wallets give the buyer a way to reverse a fraudulent charge. Bank transfers, mobile money transfers, and cryptocurrency do not.

If a shop's only payment option is a direct bank transfer, a mobile money transfer, or a cryptocurrency payment, treat it as fraud and stop. There is no legitimate reason for a real online store to refuse card payments in 2026. Even small independent shops use Stripe, PayPal, Paystack, Flutterwave, Yoco, or a similar processor that accepts cards.

Be especially careful of shops that show you a card payment form that then redirects you to a third-party page you have never heard of. That redirect can be a "phishing" page designed to capture your card details. If the address bar changes to a domain that does not match the shop, close the tab and do not enter anything.

Social presence, reviews, and brand impersonation

A genuine shop usually has an active social media presence with a real history. Look at the age of the accounts, the number and quality of posts, the level of engagement, and whether the comments are turned on. Scam shops tend to have brand new accounts, very few followers, and either no comments or comments that are clearly fake.

Reviews are the same. Scam sites often pad their testimonials with generic five-star reviews posted on the same day. Genuine reviews mention specific products, delivery times, and the occasional issue. Trust independent review sites and community forums more than the reviews on the shop itself.

Brand impersonation is the final layer. Scammers commonly register a domain that looks almost like a real brand — with an extra hyphen, an extra letter, or a different TLD — and set up a shop that copies the real brand's design. Always check the domain against the brand's official website. If the domain does not match, assume the shop is fake until you have proof otherwise.

Online shop scams in Nigeria, Ghana, South Africa, the UK, and the US

Fake online shops are a global problem, and every region has its own pattern.

Ghana's Cyber Security Authority has specifically warned about fake online shops that impersonate well-known brands. The pattern is usually the same: an advert appears on social media with a heavy discount, the link leads to a site that looks like the real brand, the checkout offers only mobile money or bank transfer, and the product never ships. Ghanaian shoppers are advised to check the shop's domain against the brand's official website and to refuse any payment method that does not offer buyer protection.

In Nigeria, the EFCC has warned repeatedly about fake shops that operate entirely through Instagram and Facebook, using only direct bank transfers or mobile money. The same warnings apply in South Africa, where the SAPS and the Southern African Fraud Prevention Service have flagged fake Takealot and Checkers storefronts using similar tactics. In the UK, Action Fraud records thousands of online shopping fraud reports every year, most involving fake shops advertised on social media. In the US, the FTC and the FBI's Internet Crime Complaint Center both report online shopping fraud as one of the fastest-growing categories of consumer fraud.

What to do if you think a shop is a scam

If the checker gives you a high score, or if you have simply lost confidence in the shop, here is what to do.

1. Do not enter any payment details. Close the tab. If you have already typed card details into a form, call your bank straight away and ask them to block or monitor the card.
2. If you have already paid by card, request a chargeback from your bank immediately. If you paid by bank transfer or mobile money, contact your provider and report the transaction as fraudulent.
3. Report the shop. Use the national fraud reporting body for your country: Action Fraud in the UK, the FTC or IC3 in the US, the ACCC Scamwatch in Australia, the EFCC in Nigeria, the Cyber Security Authority in Ghana, or the SAPS and SAFPS in South Africa. The report takes a few minutes and helps protect other shoppers.
4. Report the advert to the social media platform that promoted it. Facebook, Instagram, TikTok, and X all have reporting tools for fraudulent ads.
5. Warn your circle. Post a short warning in any WhatsApp or community group where the shop's link has been shared. A quick heads-up can save someone else the same loss.

Where this checker stops

This is a first-pass screening tool, not a verification service. It cannot confirm whether a shop is genuine, whether the products exist, or whether the company behind the site is registered. It can confirm whether the domain exists and whether it has archive history. Beyond that, it only tells you how many warning signs the address and the checklist throw up.

A low score does not guarantee safety. A live scam shop with a clean domain and a normal-looking site can pass every automated check and still take your money. The DNS check catches dead and fake addresses, not live fraud. The archive check catches brand new domains, not sophisticated operations that have been running for months.

Use the checker as one input alongside independent verification. The most reliable test remains the payment method: if the shop only accepts bank transfer, mobile money, or cryptocurrency, treat it as fraud regardless of what the score says. Card payments and recognised wallets with buyer protection are the single best line of defence you have.

Sources

The warning signs, verification advice, and regional guidance described on this page come from the sources listed below. Every source is public and can be checked directly.