Tool 1.1

Is this a scam? Check a suspicious message or link

Paste a message or link you received and see its warning signs: brand look-alikes, new domains, short links, scam wording. Only links reach our server.

Online checkOnly the links found in the text go to our server (api.ethorns.com), which follows them and asks the domain's registry when it was registered; results are kept for up to 1 hour. The message text itself never leaves your browser.

An automated check; it doesn't guarantee security.

How to use it

Copy the whole message you received (text, WhatsApp, email or social media) and paste it in the box. A single link works too.
Press Check it. The text is checked in your browser. The first three links go to our server (api.ethorns.com), which follows each one to its final address and looks up how old its domain is.
Read the verdict and what we found, then follow the steps in What to do now.

Messages worth pasting here

The usual ones arrive by SMS or WhatsApp: a package held at customs that needs a small fee, a bank that will block your account today unless you “verify” it, a relative writing from a “new number”, a refund you never asked for, a traffic fine you can pay through a link. Paste the whole message, not just the link: the checker also looks for scam wording in the text.

It also catches scripts that look harmless at first: a job that pays you to like videos, a stranger who says they sent you money by mistake and asks you to return it, a loan approved without any checks.

Reading the verdict: a held-package text

Say you get: “ENVIOS YA: your package is held. Pay the $3,500 fee within 24 hours at entregas-ya.top/pago”. The checker finds the held-package wording and the deadline in the text. Then our server follows the link and asks the registry when entregas-ya.top was registered: 4 days ago. Three signs add up, so the verdict is red: 3 warning signs found. Red always needs at least two signs; one sign alone, however strong, shows amber.

The Links table shows where each link really goes and how old its domain is. Amber means weaker signs, or a single one, such as a shortened link, a domain a few months old, or a brand's name in an address that isn't on that brand's list: check through another channel first. Government and university addresses (.gov.co, .edu.co and the like) and domains registered more than two years ago are never treated as brand imitations. Every verdict is automatic and can be wrong in both directions: it describes the message and its links, not who runs a site. If the message names one of the roughly 120 banks, wallets, couriers, shops and government offices we know, mostly Latin American, you also get that brand's official domain to compare.

What the checker can't see

It judges the address, the age of the domain and the words of the message. It doesn't open the page or look at it, and it only follows the first three links. Redirects done with JavaScript aren't followed, and some scam links send servers like ours to a harmless page and only send phones to the real one.

It can't look up a phone number or a bank account, and it can't hear a call or a voice note. A young domain isn't proof of fraud on its own: a new neighborhood shop can have a two-week-old website. And if a message asks for a code, a password or a transfer, even a green result is a reason to stop and call the company on the number you already know.

FAQ

How does it decide what to flag?

It never calls a site a scam: it tells you how many warning signs it found. It adds them up: links that imitate a known bank, shop or government office; domains registered days ago; hidden or shortened links; and the wording of common scams, such as held packages, blocked accounts, prizes, fines, requests for codes or money sent by mistake.

If it says no warning signs, is it safe?

Not necessarily. It means we found none of the known signs. Scammers change their tricks, so if a message asks for money, codes or passwords, verify through an official channel you look up yourself.

Do you read or keep my messages?

No. The text is checked in your browser and never sent to us. Only the links go to our server, to follow them. The result is kept in memory for up to an hour, and the links aren't written to any log.

I already clicked or paid. What now?

Use our step-by-step guide for what to do after a scam or a hacked account, and call your bank as soon as you can: the earlier it knows, the more it can do.

Why does a real message from my bank show a warning?

The checker can't know who sent a message; it only sees signs. Real messages sometimes use alarming words (“your card was blocked”) or a shortened link, and those count. If you're not sure, don't use the link or the number in the message: open your bank's official app, or call the number printed on your card.

Guides for this tool

G7Someone sent me money by mistake: is it a scam? What to doA stranger sent money to your account "by mistake" and wants it back at another number? Why you shouldn't return it yourself, and how your bank can.
G8Loans in my name? Check your credit report and phone linesCheck for free whether someone took a loan or a phone line with your ID, in Colombia, Mexico and more, and how to dispute it and prevent it next time.
G9Fake rental listings: how to spot one before you payCopied photos, an owner who is abroad, a deposit before any visit: how to check a rental listing and its booking page, and what to do if you already paid.
G10“Hi Mum” scam: new number messages and cloned voicesHow the “Hi Mum, this is my new number” scam works, how a voice can be copied from short clips, and how to check before you send any money.
G12Where to report a scam in Colombia and Latin AmericaThe official places to report online scams and hacked accounts in five Latin American countries, what to prepare first, and what happens after.
G16How to tell if a payment QR code is fake before you paySpot payment QR codes pasted over a shop's code or sent by chat, see who a QR really pays, check the name in your app, and what to do if you paid.
G17Fake payment receipts: how shops can check they were paidA customer sends a transfer screenshot and says "I already paid". Why a receipt proves nothing, how to check in your app, and a routine for your shop.
G18Work-from-home task scams: paid to like videos on WhatsAppPaid to like videos or write reviews, then asked to deposit money to unlock tasks? How task scams work, the warning signs and what to do if you paid.
G19Package held text scam: how to check a delivery messageA text says your parcel is held and asks for a small fee or your address? How to check it with the courier, read the link, and what to do if you paid.
G21Fake DIAN emails: how to spot them and check what you oweA message says you owe DIAN, face an embargo or your RUT will be suspended? How to check it, see your real tax status, and what to do if you clicked.
G22Lost or stolen cédula: what to do and how to get a duplicateWhat to do in the first hours after losing your Colombian cédula or having it stolen, how to get a duplicate, and how to keep others from using your ID.
G23Nequi or Daviplata account stolen? What to do nowHow Nequi and Daviplata accounts get stolen with fake support, code requests and SIM swaps, how to block yours fast, and the one rule that prevents it.
G24How to read email headers and spot a fake emailFind an email's raw headers in Gmail, Outlook or Apple Mail, read the Received lines and the SPF, DKIM and DMARC results, and spot a fake sender.

1.2Scammed or hacked? What nowSteps for the first hours after a scam or a hack: a bad link, a shared code, a stolen WhatsApp, money sent.
1.3Is this file safe?See what a file from WhatsApp or email really is and spot attachment tricks: disguised programs, macros, PDF scripts, SMS-reading apps.
1.4Short link expanderSee where a short link (bit.ly, t.co, tinyurl…) really goes before you click it: every redirect, the final URL and warning signs.
1.5Website security scanPassive check of a website's homepage: HTTPS redirect, TLS certificate, HSTS, CSP, clickjacking, cookie flags and security.txt, with a grade and fixes.
1.6SSL certificate checkerCheck any site's SSL/TLS certificate: whether it's valid, when it expires, who issued it, which names it covers and the TLS version in use.
1.7Lookalike domain detectorCheck a link or domain for look-alike tricks: letters from other alphabets, digits for letters, a hidden real domain.
1.8Domain age checkerSee when a domain was registered, when it expires, its registrar and nameservers.
1.9Password generatorRandom passwords (8 to 128 characters) or passphrases, made in your browser with its cryptographic generator.
1.10Certificate decoderPaste a PEM certificate to read its subject, issuer, validity dates, SANs, key type and size, and its SHA-256 and SHA-1 fingerprints.
1.11Leaked password checkCheck if a password appears in known data breaches without sending it: with k-anonymity only 5 characters of its hash leave your device.
1.12Link cleanerStrip utm_, fbclid, gclid, si and other tracking parameters from links before you share them.
1.13Watermark an ID copyStamp who a copy of your ID is for, and the date, across the whole photo or PDF, then download a smaller copy with no photo data.
1.14Encrypt textEncrypt and decrypt messages or notes with a password (AES-256-GCM) in your browser.

╌╌ END ╌╌