Every scan runs through six independent detection layers in parallel — threat-intelligence lookups, public registration records, live certificate checks, email authentication, AI content analysis, and a community scam-pattern database. The layers are combined into a single 0–100 risk score and a verdict.
This page describes the engine as deployed today, including its measured accuracy and its limitations. Written and maintained by the IsThisAScam Research Team.
Weights show each layer's share of the composite score. When a layer doesn't apply (e.g. no URL in the message), its weight is redistributed proportionally among the layers that ran.
Every URL found in the submission is checked against four independent threat-intelligence services in parallel. Google Web Risk covers malware and social-engineering flags, VirusTotal aggregates 90+ antivirus engines, PhishTank tracks community-verified phishing URLs, and URLhaus tracks malware distribution. A confirmed blocklist hit is the strongest single signal we have.
We query public RDAP records for the domain’s registration date and registrar, resolve its DNS (mail and nameserver records), and open a live TLS connection to inspect its certificate. Scam domains are disproportionately days or weeks old; legitimate businesses rarely run on a domain registered last Tuesday with no mail records and an invalid certificate.
For email submissions, we verify the sending domain’s SPF, DKIM, and DMARC policies. A message that fails all three is very likely spoofed — this triggers a scoring override regardless of what the other layers say.
The full text is analyzed by a large language model trained to recognize manipulation tactics: manufactured urgency, impersonation of brands and authorities, requests for gift cards or crypto, too-good-to-be-true offers, and dozens of other patterns. This is the highest-weighted layer and the only one that understands meaning rather than metadata. It runs on every scan.
For screenshot submissions, we analyze the extracted text for visual-deception patterns such as fake login prompts and spoofed payment interfaces.
Each scan is fingerprinted (a similarity hash — no raw content is stored) and compared against patterns from previous confirmed scams. Scammers reuse scripts; if a near-identical message was already flagged, that history counts against it.
The composite score is a weighted average of the active layers. Safety overrides then apply on top: a confirmed blocklisted URL floors the score at 80, an email failing SPF, DKIM, andDMARC floors it at 70, and a high-confidence AI determination can override a diluted average. Overrides only ever push the score toward caution, never toward "safe".
Scores map to four verdict bands: safe (low risk), suspicious, likely scam, and confirmed scam (blocklist-verified). When the engine is uncertain, it is designed to err toward caution — we consider a false alarm far cheaper than a missed scam.
On our internal benchmark of 157 hand-labeled real-world cases (scam emails, phishing URLs, smishing texts, and legitimate messages that commonly trigger false alarms), the engine caught 100% of scams (zero false negatives) and placed 96.8% of all cases in the correct verdict band, with 1 legitimate message incorrectly flagged. Last evaluated July 1, 2026.
This is a benchmark result, not a guarantee. Real-world scams evolve constantly, and no automated system catches everything. Treat every verdict as a strong signal, not a substitute for your own judgment.
Our public domain trust reports aggregate the domain-level technical findings above (never the content of anyone's scan). Every report is an automated algorithmic assessment that refreshes as new scans arrive.
If you operate a domain and believe its report is inaccurate, email [email protected] — we review every dispute and re-scan on request.
Guides and scam alerts published on our blog are written by the IsThisAScam Research Team, drawing on patterns observed in scans, published advisories from the FTC, FBI IC3, and national consumer-protection agencies, and the threat-intelligence sources listed above. Articles show their publication date and are updated when a scam pattern changes. We do not accept payment for coverage, and no advertiser or brand can influence a verdict.
IsThisAScam is operated by Zeplik, Inc., a Delaware C-Corporation.