Scam Signal Checker

How it works

Paste a suspicious e-mail, SMS or chat message and/or links (English or German). The checker looks for documented warning signs — urgency, threats, gift-card or crypto payment, requests for passwords or codes, lookalike and punycode domains, brand/domain mismatches, URL shorteners, risky attachments — and gives a weighted, explained score. Links are analysed statically and never opened. It never declares a message safe.

• Nothing is fetched or clicked: links are parsed as text (WHATWG URL parser) and compared with rules.
• Each signal has a fixed weight; the score is the sum of the weights of the distinct signals found, capped at 100. Weights: urgency 15, threat 20, gift-card 30, crypto 25, wire 20, advance-fee 15, credentials 30, remote-access 25, prize 20, parcel-lure 10, generic-greeting 5, family-new-number 25, secrecy 10, investment 15, brand-domain-mismatch 30, lookalike-domain 35, punycode 25, shortener 10, ip-literal 25, at-in-url 25, display-mismatch 30, suspicious-tld 10, many-subdomains 10, no-https 10, sender-brand-mismatch 25, risky-attachment 30, double-extension 10.
• Verdict: ≥ 50 "high-risk signals", 20–49 "some warning signs", 1–19 "minor signals only", 0 "no common warning signs found". No level means "safe" — scams without these patterns exist.
• Brand checks use an editorial list of 67 frequently impersonated brands and their main official domains: lookalikes are detected by homoglyph normalisation (0→o, 1→l, rn→m, Cyrillic letters …) and edit distance (1 for names ≥ 5 letters, 2 for ≥ 9); brand names inside other domains or paths count as brand/domain mismatch.
• The suspicious-TLD list is a heuristic (.zip .mov .top .xyz .click .link .work .support .rest .fit .cfd .sbs .icu .buzz .cam .gq .ml .cf .ga .tk .monster .quest .lol .cyou .bond .shop .online .site .live .info .ru .su); plenty of legitimate sites use these endings, so the weight is low.
• Language rules cover English and German phrasing (e.g. "Ihr Konto wurde gesperrt", "Zollgebühr", "Paket", "Hallo Mama, das ist meine neue Nummer"). Each signal quotes the sentence, URL or file name that triggered it.

A low score never means a message is safe. This is a static pattern check, not a malware scan or a verdict on the sender. When in doubt, contact the company through its official app, website or phone number — never via links or numbers in the message.

Sources

• usefulweb.site list of frequently impersonated brands and their main official domains (usefulweb.site)
• Verbraucherzentrale Phishing-Radar (Germany)
• BSI – Phishing explained (Germany)
• ReportFraud.ftc.gov (USA)