Verifying a seller's domain in about thirty seconds

Why this is the check that actually costs people money

Cloning a website is close to free. The styling, images, copy and price tables of any public page can be pulled down and rehosted in an afternoon, and the result is not an approximation, it is the same page. So when people say a fraudulent site looked convincing, they are describing the normal case rather than an unusually sophisticated one.

What the clone cannot copy is the infrastructure underneath: the age of the domain, the history of its certificates, and where money goes when you press pay. Those are the things worth ten seconds of attention, and they are also the things nobody looks at.

The IPTV market is targeted more heavily than most for a straightforward reason. Buyers already expect an unconventional purchase, sometimes involving crypto, from a company with no high street presence and no regulator. Every warning sign a scammer would normally have to explain away is, in this category, roughly what a customer was braced for anyway.

Start from a source the brand controls

The most reliable check requires no tools at all: reach the checkout page from somewhere the company demonstrably owns, rather than from wherever you happen to be. Type the domain from memory, use a bookmark saved on a previous visit, or open the brand's own social account and follow the link posted there.

What this rules out is the entire category of interception. Search advertisements can be bought against a brand name by anyone, including whoever registered a hostname one character away from it. Forum links rot and get edited. Direct messages offering a discount code are the oldest approach in the market and still the most effective.

For this brand, the addresses we run are published on the official domain page. Anything not on that list is somebody else's website, whatever it looks like and whoever sent it to you.

Read the address itself, character by character

Look at the hostname rather than the page, and read it deliberately. Substitutions are chosen to survive a glance: a lowercase l where an uppercase I belongs, rn standing in for m, a doubled letter, a hyphen inserted, or a different top-level ending on an otherwise correct name.

A subtler version uses characters from another alphabet that render almost identically to Latin ones. Browsers defend against this by displaying such addresses in an encoded form beginning with xn--, so an address bar showing that prefix on what appears to be an ordinary English word is a strong signal to stop.

One more habit worth building: check where the domain actually ends. In an address like smartiflix.com.checkout-secure.example, the real destination is the last part before the first slash, not the brand name sitting at the front. Read from the right.

Check the age, which is where clones give themselves away

Fraudulent checkout pages are short-lived by design, usually surviving weeks rather than years, so age is the single most informative fact about an unfamiliar domain. A legitimate seller has a trail; a clone was registered recently and will be gone before anyone can act on it.

Start with a registration lookup through ICANN's own service, which shows the creation date of the domain. Many owners hide their contact details behind privacy services, and that alone is not suspicious, but the creation date is usually still visible and is the field that matters.

When the record is masked entirely, certificate transparency is the better route and it is difficult to evade. Every certificate issued for a domain is written to public, append-only logs, searchable through tools such as crt.sh. The earliest entry approximates when the site first went live. A checkout page asking for card details whose oldest certificate appeared last month is not one to use, however finished it looks.

Ignore the padlock, and look at the certificate

The padlock icon means that traffic to that server is encrypted. That is all it has ever meant. Certificates are issued free, automatically and within seconds by several public authorities, which is excellent for the web and useless as a trust signal, because a fraudulent site obtains one as easily as anyone else.

What is worth a glance is the certificate itself, which any browser will show if you click the padlock. Check that the name on it matches the domain you intended to visit, and note how recently it was issued. A brand that has operated for years typically has a certificate history stretching back years, visible in the transparency logs described above.

It is also worth checking whether the site is already flagged. Google publishes the current status of any URL through its Safe Browsing diagnostic, which will not catch a site registered yesterday but does catch established fakes.

Watch how it wants to be paid

The payment step is where a clone's economics become visible, because it needs money that cannot be pulled back. Requests for gift card codes, transfers to a personal account, or a crypto payment to an address pasted into a chat rather than generated at checkout are all the same signal.

A legitimate checkout hands you to a recognisable payment processor, and the address bar changes to that processor's own domain when it does. Smartiflix takes card and PayPal alongside crypto, and choosing a reversible method costs nothing while preserving a dispute route if something goes wrong. The pre-payment checklist covers the rights that come attached to each method.

Urgency belongs in the same category. A subscription is digital inventory that cannot run out, so a countdown timer or a claim that only a few slots remain is not describing scarcity. It is discouraging you from doing exactly the checks on this page.

The thirty-second routine

In practice you will not run a full investigation every time, so here is the compressed version, which catches almost everything and fits in the time it takes a kettle to boil.

Read the hostname from the right and confirm the spelling. Check it against a list the brand publishes, which for us is the official domain reference. Glance at the certificate date. Confirm the payment step hands you to a named processor rather than asking for a transfer. If any of the four is wrong, close the tab; if all four are fine, you have done more diligence than most buyers ever do.

One thing to do afterwards, once you have paid on an address you trust: bookmark it. Nearly every clone incident starts with somebody searching for a site they had already used successfully, and a saved bookmark removes that risk permanently.

If you have already paid a site you now doubt, move to the recovery steps, which covers evidence, disputes and where to report. Speed genuinely matters there, so start with that rather than reading further here.