Free mini-course: five short steps in your browser
Check a suspicious website or login page in 5 stepswhat the page asks, another route in, the whole address, clues both ways, and a dated record
TimeBinder adds a layer of protection against AI and human fraud and disputes. A five-step routine for a website or login page that may be a clone or look-alike. Progress stays in this browser.
No checker on this page can reliably tell a clone from the real site. A TimeBind does not show that a page is genuine or fake. The steps are a routine, not a verdict on any one page.
Start the five steps
Each step is short and ends with one or two checks. Your progress is saved in this browser only. Nothing you choose is sent to TimeBinder. The course uses invented examples only, no real brand, person or site, and own-made diagrams.
Your progress is saved in this browser only. Choices stay on this device and are not sent to TimeBinder or tied to your name.
Step 1 of 5. 0 of 5 complete.
Step 1. Name what the page asks, the page and the path
A cloned or look-alike website is any page that borrows the look of a bank, shop, delivery firm, government service or workplace login in order to collect passwords, card details or personal information. Before you judge whether it looks right, write down three things. The ask is what the page wants from you: a login, a payment, a form, a code, a download. The page is what you are looking at and who it says it is. The path is how you got there: an email, a text, an advert, a search result, a QR code, a message from a contact or a link on another site. Keep the three apart. A page can look exactly like the real one and still be a copy, and a plain-looking page can be genuine. How polished it looks is the least reliable of the three. If you have not entered anything yet, do not.
Check 1. Match each part to what it means
Tap a part, then tap the meaning that fits it best.
Check 2. An invented message says a parcel fee is unpaid and links to a page that asks you to sign in
What is the best first move?
Step 2. Leave by another route
The most useful move is to stop using the link. The US Cybersecurity and Infrastructure Security Agency advises that if a message might be real you should not click a link or call a number in it, but look up another way to contact the organisation: go to its website by searching for it or typing the address yourself if you are sure you know it, and take contact details from the verified site. The UK National Cyber Security Centre gives similar advice: contact the organisation directly using details from its official website, or from paper statements or a card, rather than the numbers or addresses in the message. If the real site shows the same notice, message or payment problem after you arrive by your own route, that is support. If it shows nothing, that is information too. The FBI’s Internet Crime Complaint Center adds that sponsored search results are usually paid imitators of its own site, so even a search can lead to a copy. Use a bookmark or type an address you already trust.
Check 1. Which route is most useful?
Check 2. You arrive at the real site by your own route and it shows no such notice
What does that suggest?
Step 3. Read the whole address
Look at the entire web address, not just the first part of it, and compare it letter by letter with the address you already trust. CISA’s example of an incorrect address is a one-letter swap of a well-known shop name. Check for extra words, a different ending, hyphens and look-alike letters, and for the real name appearing in the wrong place, such as at the start of a longer address owned by someone else. For a United States government service the FBI’s advice is to check that the address ends in .gov and is typed exactly as published, and to avoid links whose address differs from the real one. Do not paste a suspect address into a search or a checker if that means opening it. The same care applies to links in adverts, in direct messages and behind QR codes: the UK NCSC says criminals increasingly use QR codes in phishing emails to send people to scam websites. A padlock or https in the address only says that the connection is encrypted, not that the site is run by who it claims to be.
Check 1. Which of these are sound things to do with an address?
Tick all that apply.
Check 2. The page shows a padlock and https
Step 4. Clues, both ways: pressure, polish and behaviour
Some clues justify stopping. CISA lists urgent or emotional language that threatens dire consequences, requests for personal and financial information, and incorrect addresses or links. The UK NCSC adds a claimed official sender, a short deadline, fear or curiosity, an offer in short supply and a message timed to the news. In an FBI notice about a spoofed government site, the copy had a single form step and every other link returned to the home page, which is the kind of behaviour worth noticing. Clues cut both ways, though. CISA notes that poor grammar used to be a common sign but that, in the era of AI, some messages now have perfect spelling and grammar. The NCSC says scams are getting smarter and some even fool experts. So a polished page, a convincing logo or a professional tone proves nothing, and odd wording does not prove a page is fake. This site cannot tell you reliably whether a page is a clone or whether it was made with AI. Say what you saw, what you could not confirm and what would change your mind.
Check 1. The page is polished and its wording is flawless
Check 2. The page looks a little plain and one sentence reads oddly
Step 5. Document what happened and decide next steps
Honest outcomes include “reached the real site by my own route and it matched”, “could not confirm, so I did not enter anything” and “entered details and acted quickly”. Write down the address you were sent, how you got it, the date and time, what the page asked and what you did. Keep the original message and an exact saved copy, such as a screenshot or saved page file, and do not open or re-save the only copy. If you entered a password or card details, contact the real organisation using details you already trust, and report the page: CISA advises reporting phishing through the report options in your mail or messaging app, the FBI asks people to report incidents at ic3.gov, and the UK NCSC points to its own reporting routes. In the EU, report through your national authority or bank. A TimeBind records that an exact saved file existed no later than a recorded time, and that a later copy still matches its SHA-256 fingerprint, anchored to Bitcoin. It does not show that a page is genuine or fake, who ran it, or that a claim on it is true. First Pooled TimeBind is free, then from US$5. An ASAP TimeBind is US$15.
Check 1. What can a TimeBind show about a page you saved?
Check 2. You entered a password before you doubted the page. What now?
You have finished all five steps
Progress stays in this browser. You can revisit any step above. If you already entered a password or payment details on a page you now doubt, contact the real organisation using details you already trust, and use the official reporting route in your country.
How do you check a suspicious website or login page? The short answer
Work through five steps: write down what the page asks for, who it claims to be and how you got there, and do not enter anything yet; leave by another route, such as an address you already trust, a bookmark or contact details from a card or statement, instead of the link you were sent; read the whole web address and compare it with one you trust; treat urgency, odd payment requests and strange behaviour as reasons to stop, and remember that a polished look and perfect grammar prove nothing; then record the address, route and date, keep an exact saved copy, and contact and report through official routes if you entered anything.
None of this tells you for certain whether a page is a clone, and a padlock shows only that the connection is encrypted. A TimeBind of an exact saved file can show that it existed no later than a recorded time and still matches. It does not show that a page is genuine or fake, who ran it, or that a claim on it is true.
Why this course, in November 2026
Search suggestions checked on 13 November 2026 show steady interest. “fake login page” returned 8 suggestions (including “fake login page detection”), “is this website legit” returned 10 and “how to tell if a website is a scam” returned 10. Suggestions show what people type, not volumes. Public bodies are also warning that copies of real sites are being promoted with AI-generated video: an FBI Internet Crime Complaint Center notice dated 20 July 2026 describes AI-generated videos used to steer people to a spoofed complaint site.
Sources: FBI IC3, public service announcement (20 July 2026), CISA, “Recognize and Report Phishing” (page marked as archived content) and UK NCSC, “Phishing scams: how to spot and report them”. The CISA page is archived, so please check current advice. Rules and reporting routes differ by country.
This is the fifteenth course in the series. The first, Spot AI fakes in 5 short lessons, is a general introduction, Verify a chat or email screenshot covers messages, and Check a suspicious celebrity or expert video ad covers a video offer. This one is narrower: a website or login page that asks you to enter something, where the key moves are leaving by another route and reading the whole address. It sits under the public guide to protecting yourself from AI forgeries.
What each step can show, and what it cannot
The honest job of this routine is to slow you down before you enter anything and leave you with notes that your bank, employer or a report can use. It is general guidance, not security or legal advice. See also synthetic media and existed no later than in the glossary.
| Step | What it can show | What it cannot show |
|---|---|---|
| 1. Ask, page and path | What the page wants, who it claims to be and how you reached it. | That the page is genuine, or that it is a clone. |
| 2. Another route | Whether the real organisation shows the same request when you arrive by your own route. | That a page is fake because nothing matches, or genuine because something does. Each is one input. |
| 3. The address | What the full address says and how it differs from one you trust. A padlock shows only an encrypted connection. | Who runs the site, or its intent. A familiar-looking address can still be a copy. |
| 4. Clues, both ways | What pressure, payment requests and odd behaviour suggest. Polish and perfect grammar are easy to copy. | Whether a page was cloned or AI-made. A clean look settles nothing, and neither does odd wording. |
| 5. Document and decide | What you saw, did and left open, and that an exact saved file existed no later than a recorded time, with a later copy still matching its SHA-256 fingerprint. | That a page is genuine or fake, who ran it, or that a claim on it is true. |
If a page may matter later
If a page could become part of a complaint, a bank dispute or a report, a dated record of the exact files you hold helps:
- Keep the original message and take a screenshot or saved copy of the page and its address without entering anything. Add notes on how you got there, when and what you did.
- Make a TimeBind of each file. The fingerprint is made in your browser and the file stays on your device. You can later download a Proof of Time Certificate.
- Store the files, the certificates and your notes together. Use the file date and metadata inspector or the file-changed answer to compare a copy later.
First Pooled TimeBind free, no card, then from US$5. An ASAP TimeBind is US$15. A TimeBind does not show that a page is genuine or fake. Whether it helps in a dispute is for the other party, your bank or the forum to say.
First Pooled TimeBind free, no card, then from US$5. An ASAP TimeBind is US$15.
What a TimeBind shows, and what it does not. It shows that an exact file existed no later than a recorded time and that a copy shown later still matches its fingerprint. It does not show who made the file, who owns it, that its contents are true, or whether AI was used to make or edit it. This is general information, not legal advice.
Check a suspicious website or login page: FAQ
Can this course tell me whether a website is a clone?
No. No checker on this page, and no tool on this site, can reliably tell a clone or an AI-made page from the real one. The steps help you leave by another route, read the whole address and weigh clues both ways. “I could not confirm it, so I entered nothing” is a valid result.
Is a padlock or https a sign that a site is safe?
Not on its own. It indicates that the connection is encrypted, not who runs the site or that it is the one you meant. Keep reading the address and check by another route.
Do poor spelling and grammar show that a page is fake?
Not any more. CISA notes that poor grammar used to be a common sign but that, in the era of AI, some messages now have perfect grammar and spelling. Look at the address, the request and the route instead.
What if I already entered my password?
Contact the real organisation using details you already trust, not those on the page, and report the page through the official route for your country. Ask the organisation or your bank what to do about the account or card. This is general guidance, not security advice.
Does a TimeBind show that a page is real?
No. A TimeBind shows that an exact saved file existed no later than a recorded time and that a later copy still matches its fingerprint. It does not show who ran the page, that it is genuine or fake, or that a claim on it is true.
Where is my progress saved?
In this browser only, using localStorage. Choices are not sent to TimeBinder and are not tied to your name. Clearing site data, or using another browser, starts the steps again.
Is the course free?
Yes. The five steps and the checks run in your browser at no charge. If you later make a TimeBind, the first Pooled TimeBind is free, then from US$5. An ASAP TimeBind is US$15.
Related guides and tools
- Protect yourself from AI forgeriesThe public guide for everyday readers
- Verify a chat or email screenshotWhen the request arrived as a message
- Check a suspicious celebrity or expert video adWhen the page came from a video advert
- Verify an AI-generated receipt or invoiceWhen the item is a payment document
- Spot AI fakes in 5 short lessonsThe first mini-course: labels, reverse image search, voice scams and more
- Real or AI? quizPractise on own-made and public-domain images
- File date and metadata inspectorSee what a file’s own details say
Date the exact files you keep
Add a layer of protection against AI and human fraud and disputes: a dated, checkable record of the exact file, kept while you still have it.
- Open the app and sign in with email or Google.
- Add your files. They stay on your computer.
- Seal them and download your Proof of Time certificates.
First Pooled TimeBind free, no card, then from US$5. See pricing.