Whenever a well-known website disappears, imitations follow. Torrent indexes are a particularly common target because their old users keep searching for the name. Some imitations are simply low-quality copies. Others are built to spread malware, collect passwords or push visitors towards scams. This guide shows how to tell the difference before you click anything.
It is written for anyone who has met a RARBG-named domain, but the checks work for any site. For our overview of one such domain, see the Rarbgget.org homepage.
Why Clone Sites Exist
A famous name brings free traffic. Registering a similar domain costs little, copying a layout is easy, and advertising networks pay for every visitor. That is why, after RARBG closed in 2023 (see what happened to RARBG), dozens of domains appeared using its name. Their owners do not need to be the original team, and in practice none of them has shown that they are.
Check 1: Read the Address Carefully
Clone sites rely on people not looking closely at the address bar. Watch for:
- Extra or swapped letters, for example an added “get”, “go” or “x”, or a doubled letter.
- Unusual domain endings that the original never used.
- Look-alike characters, such as a capital I in place of a lower-case l, or letters from other alphabets.
- Long sub-domains that put a famous name in front of an unrelated domain.
A familiar name in the address proves nothing about who owns the site.
Check 2: Look Up the Domain’s Age and Owner
A WHOIS or RDAP lookup, available free from domain registrars and from ICANN’s lookup service at lookup.icann.org, shows when a domain was registered. A site claiming to be a long-running service on a domain registered recently is a red flag. Hidden owner details are common and not proof of wrongdoing, but combined with other signs they should make you more careful.
Check 3: Run a Free Reputation Scan
Two free tools can tell you whether a site is already known to be harmful:
- Google Safe Browsing site status in Google’s Transparency Report, which shows whether Google currently flags a site as dangerous.
- VirusTotal, which checks a web address against dozens of security vendors at once.
A clean result is not a guarantee, because new threats take time to be detected. A bad result is a clear reason to leave.
Check 4: Do Not Trust the Padlock Alone
The padlock icon and “https” only mean the connection between you and the site is encrypted. Certificates are free and quick to obtain, so scam sites use them too. HTTPS tells you nobody in the middle can read the traffic; it tells you nothing about whether the site itself is honest.
Check 5: Watch How the Page Behaves
Harmful clone sites tend to behave in recognisable ways:
- New tabs or windows open when you click blank areas of the page.
- Several competing “Download” buttons, often in bright colours.
- A prompt asking you to allow notifications before you can continue.
- A “verification” or “human check” that asks you to press keys or paste something into a system dialog. Real sites never ask you to run commands.
- Pages that move or reload so you click something you did not intend to.
If you see any of these, close the tab rather than trying to find the “real” button.
Check 6: Recognise Phishing Pages
A login form on a clone of a site that no longer exists has no legitimate purpose. Be especially wary of pages that ask you to sign in with an email or social media account, that request payment for “premium” or “VIP” access, or that ask for card details to “verify your age”. Use a password manager: it will not fill in your saved password on a domain it does not recognise, which makes look-alike pages easier to spot.
Check 7: Treat Downloads as Suspect
Malware often hides behind familiar file names. Warning signs include a video that ends in .exe, .scr or .msi; a tiny file for what should be a full-length film; an archive protected by a password that you must fetch from another site; or a message saying you need a special player or codec. Do not run any of these. Windows users can turn on “Show file extensions” in File Explorer to see the real file type.
A One-Minute Checklist
| Check | Good sign | Warning sign |
|---|---|---|
| Address | Matches a name you have verified | Extra letters, odd endings |
| Domain age | Consistent with the site’s claims | Registered recently |
| Reputation scan | No flags | Flagged by Safe Browsing or VirusTotal |
| Page behaviour | Calm, no pop-ups | Redirects, notification prompts |
| Log-in or payment | Not requested | Requested without a clear reason |
| Files | From an official, licensed source | Executables disguised as media |
What to Do Instead
The simplest way to avoid fake mirrors is to stop needing them. Licensed services and public-domain archives offer a large amount of free, legal viewing; our guide to free legal streaming sites lists the main options. If you want to understand how torrents themselves work and where the privacy risk comes from, read how BitTorrent works. And for the specific domain that brought many readers here, the Rarbgget.org homepage has the full picture.
A Worked Example: Checking a RARBG-Named Domain
Imagine you find a domain that uses the RARBG name and an almost identical layout. Start with the address: does it add a word or change the ending compared with the original? Next, look up the registration date. If the domain was registered after May 2023, it cannot be the site that closed. Then paste the address into Google’s Safe Browsing status page and VirusTotal. Finally, open it in a fresh browser window, without logging in to anything, and watch what happens when you click a blank part of the page. Pop-ups, redirects or a notification prompt are enough reason to close it. If you would like to read how these checks apply to one well-known domain, the Rarbgget.org homepage walks through it.
Frequently Asked Questions
How can I tell if a torrent mirror site is fake?
Check the exact address, the domain’s registration date and a reputation scanner such as Google Safe Browsing or VirusTotal, then watch for pop-ups, fake buttons, notification prompts and login requests.
Does HTTPS mean a website is safe?
No. HTTPS only encrypts the connection. Many scam and malware sites use valid certificates.
What should I do if I clicked a fake download button?
Close the tab, do not open any downloaded file, remove notification permissions you granted, and run a full scan with up-to-date security software. Change any password you entered.
