What the check actually looks at
A scam email address rarely survives close inspection. This checker runs seven signals against public data and shows you what it finds:
- Age — the earliest date the address appears anywhere online. Scam addresses are typically weeks old; established people leave years of trace.
- Disposable domain — whether it's a known throwaway or temporary-inbox provider.
- Lookalike domain — whether the domain imitates a brand (paypa1.com, arnazon-support.net).
- Domain age — when the domain itself was registered. Registered last week is a classic scam tell.
- Mail setup — whether the domain is configured like a real sender (MX, SPF, DMARC) or barely set up at all.
- Linked identity — any public profile and verified accounts tied to the address.
- Role vs person — whether it's a personal address or a generic support@/admin@ shell.
No single signal is a verdict. The free check gives you the age headline; the $5 report shows all seven with the reasoning, and you can download it as a dated PDF.
Marketplace buyer or seller emailing you?
The classic Facebook Marketplace, Craigslist and Gumtree pattern: a "buyer" pushes the conversation off-platform, then a payment-confirmation email arrives from an address that looks official-ish. Before you ship anything, check the actual sender address. Fake payment confirmations almost always come from addresses created days earlier, on domains registered even more recently — the age check exposes both in one pass. A genuine buyer's personal address usually carries years of visible history.
Online dating match who moved to email?
Romance scammers move fast off the dating app and reuse addresses only until they're reported. A match whose email address is brand-new, on a throwaway provider, with no identity linked anywhere, doesn't match a person who claims decades of career and travel. Check the address they gave you — and if you're worried about someone else's online romance (a parent, a friend), the downloadable report gives you something concrete to show them instead of an argument.
Recruiter or job offer out of nowhere?
Real recruiters write from company domains with real mail infrastructure. Job-offer scams write from free webmail or from lookalike domains ("hr-amaz0n-careers.com") registered weeks before the campaign. Paste the recruiter's address: if the domain was registered last month and has no proper mail setup, you have your answer before you've sent a CV — let alone your passport scan or bank details for "payroll".
What a result can and can't tell you
An old, well-established address with linked identity is strong evidence you're dealing with a real, traceable person. A brand-new address isn't proof of fraud — people create fresh addresses for legitimate reasons — but it removes the benefit of the doubt, and combined with a young domain or disposable provider it's the standard shape of a scam. The report gives you the signals and the reasoning; the decision stays yours.