Domain age is the strongest single clue
Scam sites are built to be used briefly and thrown away: once complaints accumulate the domain is abandoned and a new one registered. An address created less than a month ago is therefore worth pausing over. One kept running for years is at least not something thrown together yesterday. Plenty of new domains are perfectly legitimate, so read this alongside the other signals.
Watch for names that imitate real ones
Swapping the digit 1 for a lowercase L, or 0 for the letter O, produces addresses that look almost identical to well-known ones — and almost nobody notices after clicking a link. This check looks for names a single character away from widely recognised brands. For banks and payment sites, the safest habit is to type the address yourself rather than follow a link.
There is plenty this cannot see
Only externally visible information is examined here. A domain can be old and perfectly configured while the content is still a scam, and a genuine new service can trip several signals. That is why this tool never says "this site is safe". It shows the evidence; the decision stays with you.