How does the scam link checker work?
Paste a link that someone sent you. The checker reads the real domain from the link and runs a set of tests on it. You get one of three results:
- Known phishing (red): the domain is on an open list of Steam and Discord phishing sites.
- Suspicious (amber): the domain shows warning signs, like a lookalike spelling of a real site.
- Safe-looking (green): we found no warning signs. This does not prove the site is safe.
Each result lists the reasons, in plain words, so you can see why a link was flagged.
Does the checker open the link?
No. We never load the pasted link. The spelling tests run in your browser. To check the phishing list, only the domain name (like example.com) is sent to our server, never the full link. That keeps you safe and keeps any tracking codes in the link private.
What checks does it run?
| Check | What it catches | Example |
|---|---|---|
| Official match | The real Valve domains and their subdomains | store.steampowered.com |
| Phishing list | Domains reported as Steam or Discord scams | Domains on the DevSpen list |
| Lookalike spelling | 1 or 2 letters changed, added or removed | steamcomminity.com |
| Lookalike letters | Numbers or letters from other alphabets | st3amcommunity.com, a Cyrillic "е" |
| Hidden letters | Addresses that start with xn-- (punycode) | xn--stamcommunity-x3k.com |
| Extra words | A real name with words added | steamcommunity-trade.com |
| Wrong ending | The real name on another domain ending | steamcommunity.ru |
| Subdomain trick | The real name placed before the true domain | steamcommunity.com.ru |
| @ trick | Text before an @ that the browser ignores | steampowered.com@evil.example |
| Number address | A bare IP address instead of a name | http://203.0.113.5/login |
Steam itself warns about this. Its Mobile Authenticator FAQ says: "Bad guys often try clever mis-spellings to make links look like they come from Valve. If you're in doubt, don't click on them."
Which domains are real?
These are the Valve domains the checker treats as official:
steamcommunity.com, the Steam Community and Community Marketsteampowered.com, includingstore.steampowered.comandhelp.steampowered.comcounter-strike.net, the Counter-Strike 2 website
Subdomains of these count as real, so login.steampowered.com passes. Marketplace domains are added as we add each marketplace review, taken from the site address in our review data.
Where does the phishing list come from?
We use the open DevSpen/scam-links list on GitHub. It collects phishing and malicious links that focus on Steam and Discord scams, and it is released into the public domain under the Unlicense. A script downloads the list into our site, and the checker shows the date of the last download.
The list is community-run, so it can miss brand new domains. That is why the spelling checks matter. A fresh scam domain will not be on any list yet, but it still has to look like the real thing to fool you.
How does lookalike detection work?
The checker takes each part of the domain and compares it with the real names, like steamcommunity and steampowered. It counts how many single-letter changes turn one into the other. One or two changes is a classic scam trick, so it gets flagged.
Before comparing, it swaps common lookalikes back to plain letters. The number 0 becomes o, 1 becomes l, 3 becomes e, and "rn" becomes m. Letters from the Cyrillic and Greek alphabets that look like Latin letters get swapped too. So steamcornmunity.com and a version with a Cyrillic "е" are both caught.
Worked example 1: a fake trade offer link
A stranger sends you https://steamcommunity.com.ru/tradeoffer/new/ and says "check my trade offer". This domain is a real entry on the phishing list we downloaded on 24 Sep 2026.
- The site you would really visit is
steamcommunity.com.ru, a Russian address. It is notsteamcommunity.com. - The checker sees
steamcommunity.cominside the address and flags it as a subdomain trick. - It then finds the domain on the phishing list.
Result: Known phishing site. A real Steam trade offer link always lives on steamcommunity.com itself.
Worked example 2: a real Steam link
A friend sends you https://steamcommunity.com/tradeoffer/new/?partner=123.
- The domain is exactly
steamcommunity.com. - That is an official Valve domain, so the result is Official Valve domain (green).
Even then, stay careful. A real trade link can still be part of a scam, for example a trade that swaps a valuable skin for a cheap one. Read the trade window before you confirm.
What should I do if a link is flagged?
Do not open it, and never type your Steam login or Steam Guard code on it. If you want to visit Steam, type the address yourself or use the Steam app.
If you already logged in on a fake page, act fast. Change your password from the Steam app or client, check your Steam Guard settings and look for trade offers you did not make. Our guides explain what to look for:
- How to spot scam trading sites
- Fake Steam login pages
- Steam API key scams
- How to secure your Steam account
When should I use this checker?
Use it every time a link asks you to sign in through Steam, especially links from chat, comments, Discord or friend requests. Use it before you log in to any trading site you have not used before.
If the site passes and you plan to sell there, compare what you would keep with the marketplace fee calculator. And if a trade goes wrong, the trade hold calculator shows how long CS2 Trade Protection lets a trade be reversed.
