A client forwards you a link — "is this legit?" — or worse, mentions they already clicked it and wants to know if they should be worried. Either way, you need a fast, honest answer, not a guess. This is the sequence: five checks, each telling you something different, building toward a composite judgment rather than a single verdict.
Step 1: WHOIS — how old is this domain, really?
Run the domain through WHOIS Lookup and check the creation date. A domain registered days or weeks ago is a real red flag when the site is claiming to be an established company, a well-known brand, or a business with any kind of history — legitimate, longstanding organizations don't typically operate on brand-new domains. A domain that's years old doesn't clear it either, since a genuinely old domain can still be compromised or repurposed, but a suspiciously recent registration is one of the strongest single signals in this whole sequence.
Step 2: SSL Checker — does the certificate match the story?
Run the same domain through SSL Checker. Look at two things: how recently the certificate was issued, and whether the issuer and details look generic versus matching the organization the site claims to be. A certificate issued the same week as a "we've been in business for 10 years" claim is worth noting — though be fair here too, since automatic certificate issuance and renewal (common with services like Let's Encrypt) means even a completely legitimate site can show a recently-issued cert; this is a soft signal to combine with the others, not a standalone flag.
Step 3: Headers Checker — a soft signal, not proof
Run it through HTTP Headers Checker. A well-run, established organization's site usually has at least some basic security headers configured — it's not universal, but it correlates with a team that's actually maintaining the site rather than a throwaway page stood up quickly. A completely bare response with nothing configured leans slightly toward "hastily built," but plenty of legitimate small business sites also have nothing configured here, so treat this as the weakest signal in the sequence, not a disqualifying one.
Step 4: IP Lookup and ASN Lookup — legitimate hosting, or throwaway infrastructure?
Run the site's IP through IP Lookup and ASN Lookup. You're looking for the same kind of distinction covered in the VPN/proxy detection guide, applied to a website instead of a login: is this hosted on a recognizable, legitimate business hosting provider or CDN, or on infrastructure more commonly associated with quickly-spun-up, disposable sites? This won't name an attacker, but a mismatch between "this claims to be a major retailer" and "this is hosted on infrastructure with no relationship to that retailer's usual footprint" is a meaningful data point.
Building a composite judgment, not a verdict
None of these five checks, alone, proves anything. A new domain can be a genuine new business. A fresh certificate can be routine renewal. A missing header can just mean an under-resourced but honest small business. The value is in the pattern across all five: a domain registered last week, with a certificate issued the same day, hosted on generic infrastructure with no security headers configured, claiming to be a bank or a major retailer, is a very different picture than any one of those facts alone. Weigh them together, and be honest with yourself about how strong or weak the overall signal actually is before you say anything to a client.
What to tell the client
Report the pattern, not just a yes-or-no:
- Lead with the overall read, then the specifics. "This has several signals that don't match a legitimate [claimed organization] site — worth avoiding" is more useful than a list of technical findings with no conclusion attached.
- Be honest when it's genuinely ambiguous. If the checks come back mixed or mostly clean, say so plainly rather than manufacturing false confidence in either direction — "nothing here rules it out, but nothing confirms it either, so treat it with caution" is a legitimate, honest answer.
- Give a concrete next step. "Don't enter anything there, and if you already did, change that password" is actionable. A list of ASN numbers and certificate dates isn't, on its own.
Bookmark this page — it's built to be the fast reference you pull up any time a client hands you a link and needs a real answer, not a guess.