Every day millions of people receive messages they are not sure about. A text from their bank warning of a suspicious charge. An email from a courier with a parcel on hold. A WhatsApp from a family member from an unknown number asking for money urgently. The question is always the same: is this a scam or is it legitimate?
An online scam detector is a tool that analyses that message and gives you an answer based on technical evidence, not guesswork.
🔍 Suspicious message?
Analyze senders, links or files in real time with our scanner.
Why common sense is no longer enough
For years the advice was always the same: look for spelling mistakes, be suspicious of odd links, check that the domain is correct. That advice is still valid, but scammers know it too.
Modern phishing campaigns have no spelling mistakes. They use domains registered two days ago that look visually identical to the real thing. They send messages from legitimate bank sender IDs. And in some cases, as we saw this week, they host malicious content directly on trusted platforms like Claude.ai or Google Sites, where the URL is completely genuine.
The human eye cannot detect these techniques. A forensic engine can.
What a scam detector analyses under the hood
When you paste a message into ORTSLAB, the engine does not just look for suspicious keywords. It analyses more than 40 technical signals simultaneously:
- Sender authentication — verifies whether the SPF, DKIM and DMARC digital signatures are valid. A legitimate bank always has these signatures correctly configured. A scammer, almost never.
- Real message origin — traces the IP address of the server that sent the email and compares it against the declared domain. If they do not match, it is a spoofing signal.
- Link analysis — follows the redirects of every URL to its final destination and checks whether it changes domain along the way. A link that appears to go to your bank but ends up on a server in another country is fraud.
- Domain age — checks when the sender's domain was registered. Phishing domains are registered hours before the attack to evade blacklists.
- VirusTotal reputation — cross-references the domain against international threat databases. If it has already been used in fraud, the engine knows.
- Homoglyphs and typosquatting — detects domains that visually imitate well-known brands through character substitution:
rnicrosof†.cominstead ofmicrosoft.com. - Attachment analysis — detects PDFs with embedded JavaScript, Office documents with macros and malicious QR codes.
When to use a scam detector
You do not need to wait until you have serious doubts. These are the most common situations where a forensic analysis can save you from a nasty surprise:
- You have received a text from your bank warning of a charge or an account block.
- You have received an email from a courier — Royal Mail, DHL, FedEx or Amazon — about a parcel on hold.
- You receive a notification from a government agency outside the usual deadlines.
- A supplier or client notifies you of a bank account change by email.
- You receive an unexpected job offer or prize notification.
- A family member messages you from an unknown number asking for urgent money.
What to do if the result is DANGER
If the analysis confirms the message is a scam, three immediate rules:
- Do not click any links and do not download any attachments if you have not already done so.
- Do not reply or call any number that appears in the message.
- If you have already shared banking details, contact your bank immediately to block any potential charges and change your passwords.
You can report the scam to your national police force or cybersecurity agency. In the UK, report to Action Fraud. In the US, to the FTC at reportfraud.ftc.gov.
If you need to document the fraud
For formal complaints or legal proceedings, the ORTSLAB analysis can be complemented with a signed forensic report by a certified judicial IT expert, with evidentiary validity before courts. The report includes the chain of technical evidence, identification of the real sender and a forensic assessment of the message.
If you are in that situation, contact Oscar Orts directly.