One report, cut into seven pieces.
This shop, its findings and its dates are fictional. The order and the structure are how a real report works.
- You entered
- harbour-lane-outlet.test
- Where it ended up
- https://harbour-lane-outlet.test/
First, exactly what was checked
A check covers one exact website. A redirect to another domain is recorded as an observation and moves nothing across. A similar name never merges with this one, and sharing a host doesn't share a reputation.
Some concerns to investigate
Two supported findings are worth checking before you pay.
Checked on 2 November 2026
The result is a sentence
No percentage, score or model confidence appears anywhere in a report. Written rules pick the band from the evidence, and the date stays beside it because evidence expires.
- Independent sourceThe website states “Harbour Lane Outlet Ltd, 14 Quay Street”. The register lists that company at a different address.
The two sources disagree. We don’t say why.
Company register entry, observed 2 November 2026
A contradiction shows both sides
Each card shows the observation, the type of source, a link, the date and the context. You can always tell what a source says from what we drew from it.
- First-party statementThe website states “Payment accepted by gift card or Bitcoin only.”
Checkout was not tested.
Returns page, observed 2 November 2026
The site’s claims stay the site’s claims
A model finds the passage and points to its exact words. Code confirms those words are on the page, and a separate check confirms they support the finding. If either fails, the result is unknown.
- Technical factThe domain was registered 41 days ago.
Context only. This doesn’t affect the result.
Domain registration record, observed 2 November 2026
A context fact adds no concern
You might want to know it, so it's shown. It doesn't count against the site, and the same goes for https and hosting facts.
5 of 5 required checks completed
- Valid, accessible website
- Supported site type and language
- Identity and contact details
- Delivery, returns and payment terms
- Independent threat check
Which checks ran is its own question
Coverage is tracked apart from concern. “4 of 5” tells you a check didn't finish. It never means 80% of anything.
First-hand experiences
No experiences yet. These are shared by members and are kept apart from the findings above.
Challenge a finding
People’s experiences sit in their own section
Experiences never feed the assessment. Glowing ones can't cancel a finding, and angry ones can't create one. Anyone can challenge a specific finding, with no account.
AI reads. It never picks the band.
Website text is treated as hostile. Models work on small, bounded jobs, and everything they return is tested before it counts.
What AI is never allowed to do
- Reads a whole site and gives a verdict
- Decides guilt or makes a legal judgment
- Changes the rules, the budget or its own tools
- Takes instructions from a page it’s reading
- Code
Confirms the exact website
Works out the address, the final destination and what the check covers.
- Code
Computes the technical facts
Dates, counts and DNS results.
- AI
Pulls out single observations
One claim at a time, each tied to a source and its exact words. It may answer “unknown”, and it has to when the page doesn’t settle the question.
- AI
Drafts the explanation
Plain wording for a finding, limited to what the evidence supports.
- Code
Tests every quote and claim
Checks the format, the target, the dates, the quote and its relevance. An exact match only proves the words exist, so support is tested separately.
- Code
Sets the band
Written rules, applied the same way to every website.
What each stage does, and where it gives up.
If a stage fails, that failure is recorded. You see the real stage while it runs, with no invented percentage.
Confirming the exact website
Scope and destination
- What it does
- Accepts public web addresses only and strips tracking parameters. A fresh, compatible check of the same website is reused.
- Gives up when
- Unsafe or invalid input is rejected with no public report. An unclear boundary on shared hosting gives a limited result.
Reading public pages
A capped set of pages
- What it does
- The home page, then the pages that matter most: contact, about, delivery, returns, terms and payment explanations. Each page is classified by type and language.
- Gives up when
- A challenge, parking or maintenance page doesn’t count as reading the site, even if it loaded. No forms, logins or checkout.
Checking technical facts and outside sources
Facts and approved sources
- What it does
- Code computes the technical facts, then approved independent sources are queried for this exact website.
- Gives up when
- An unavailable source counts as unknown. It’s never treated as a clean result.
Pulling out observations
Each one tied to its source
- What it does
- AI extracts single typed observations, each pointing at its evidence and exact words, then every one is validated.
- Gives up when
- Low agreement or low confidence gives unknown. Text aimed at AI quarantines what it affects.
Assessing the evidence
Rules, then publication checks
- What it does
- Code applies the rules. A warning publishes only after fresh source support, a check of the source’s context and a challenger pass. The report is then saved as a fixed version.
- Gives up when
- If the checks can’t agree, the interpretation is withheld with a reason, and the case ends as Not enough evidence.
Four families can raise a concern.
Only current, validated signals about this exact website count. Within a family the strongest signal is used once, so related facts can't pile up. Good signs never subtract, and we don't publish a score.
- ThreatSerious on its own
- A current phishing or malware listing for this exact website, from an approved independent source
- IdentitySerious when documented
- Documented impersonation of a separately confirmed real identity
- A material contradiction between the operator details claimed and a reliable independent source
- TransactionStated terms
- Commerce terms that demand irreversible payment only
- Delivery or refund terms that materially contradict each other on the site’s own pages
- TransparencyA limitation
- Contact or refund information missing after those pages were successfully searched. This alone can never produce an adverse band.
New signals need a definition, counterexamples, source permission and evaluation before they're added. Text that tries to instruct AI quarantines what it affects, and it isn't an accusation.
Six things we refuse to count.
Each of these feels like a clue. Applied automatically to every website, each one would accuse honest businesses or wave fakes through.
A young domain
Registration age is shown as context and adds no concern. It says when a domain was registered, and nothing about who runs it. A penalty would land on every honest new shop.
A low price
Sales, clearance and cheap sellers all look alike to a machine. A price can appear as context. It’s never an automated fraud claim, so weigh it yourself.
A country or language
Where a business is, or what language it writes in, tells us nothing about one website. An unsupported language gives Not enough evidence.
The web ending or the design
A .shop address and a dated layout aren’t evidence, and a polished one isn’t reassurance.
Search results
Generic snippets and the number of hits for “domain scam” aren’t evidence. Copied warnings count once, however many sites repeat them.
Reviews, claims and accounts
Experiences, complaint volume, a business claim and account age never enter the assessment.
Seven rules, in order. The first match wins.
The rules are the same for every website, whoever asks, whatever its reviews say and whether or not it has been claimed.
Invalid or unsafe input
Rejected. The request produces no public report.
No report
A dispute, a suspected change of owner, or an injection that affects the evidence
Evaluation runs for a limited time. Facts it doesn’t affect stay visible. If it can’t be resolved, it ends as Not enough evidence.
Automated assessment in progress
The evidence has expired
The old result stays as dated history. It’s never current clearance.
Check out of date
A certified threat listing or documented impersonation, or serious evidence across more than one family, including threat or identity
Publishes only after the source and challenger checks. This can show even with unrelated gaps, and those gaps stay listed.
Evidence raises concerns
A required check is missing, the language or site type is unsupported, or material evidence conflicts
The report names what’s missing. No reassuring band is shown.
Not enough evidence
Enough supported concern, with coverage complete
Specific reasons with their sources, after the same publication checks.
Some concerns to investigate
Little or no concern, and every required check completed
Always shown with its limitations. Any limitations found stay visible.
No notable concerns found in this check
Not enough evidence
Silence earns an empty meter.
Every required check must finish before a report can say no notable concerns were found. Take a clean new shop and remove the threat check: it comes out as Not enough evidence, even though nothing looks wrong.
“Policy not found” after a successful search completes that check and shows a limitation. A failed fetch completes nothing.
Technical states, never scam labels
- Unavailable
- The site couldn’t be reached.
- Parked
- The domain has no real website on it.
- Challenge
- A bot check stood between us and the site.
- Could not complete
- A provider failed or time ran out.
- A valid, accessible website
- A supported site type and language
- Identity and contact coverage
- Delivery, returns and payment terms
- An approved independent threat result
- A valid website
- A supported site type and language
- Identity and technical coverage that applies
- An independent threat check
What our sources can’t see.
Sources have to be approved first
A source is switched on only once its rights, exact-match rules, freshness and failure behaviour are recorded. So some evidence that exists online will never be used.
We respect the locks
The check follows source terms and doesn’t bypass access controls. A site that blocks us stays unread.
Copies count once
Sites repeating one original warning form a single origin. Ten copies aren’t ten confirmations.
Absence has to be earned
“Not found” needs a successful search. A timeout is unknown, and a source being down says nothing about a website.
Language has limits
Unsupported languages are never read as “nothing there”. Translations are labelled, with access to the original. High-impact claims need competent checking in the original language, or they’re withheld.
Specialist claims are out of scope
We don’t assess whether a finance, health or gambling service is properly licensed or legitimate.
How we keep the AI honest.
- A second model isn’t a second witness
- Agreement between models is a consistency check. It never counts as independent evidence.
- Versions are pinned
- Each report is tied to its model, prompt and rule versions. Changes go through offline tests and a trial alongside the live check before they reach anyone.
- AI can’t publish on its own
- A model failure can’t change a policy or a public record. Page text gets no tools, no secrets and no route into system instructions.
- No accuracy figure
- We test against labelled examples, including honest small shops and hostile pages, by category. That set isn’t the real world, so we don’t advertise a percentage from it.
“No notable concerns” is not a guarantee.
A patient scammer could earn every line of this fictional report. The blue notes are ours, added for this page.
No notable concerns found in this check
- Independent sourceNo current listing from the approved threat source.
Threat check, observed 2 November 2026
A new fake may not have been reported yet.
- First-party statementThe website states a business name, street address and phone number.
Contact page, observed 2 November 2026
Stated details can be borrowed from someone else.
- First-party statementThe website states a 30-day returns policy.
Returns page, observed 2 November 2026
A policy on a page says nothing about what happens in practice.
- Technical factThe site uses https.
Connection check, observed 2 November 2026
Context only. Fake shops have https too.
It never buys anything.
No basket, checkout or test order. It can’t tell you whether a parcel arrives.
It doesn’t detect every scam.
It checks the evidence available about one website. Some scams leave none.
It leans towards unknown.
Weak support ends as unknown, which keeps out false accusations and lets some real problems through.
It’s a dated snapshot.
Evidence expires, warnings fastest. A site can change the day after a check.
Now read one for a real site.
Enter the address and follow the stages. Already paid? Start here instead.