Beware the Website Reputation Scam: How Online Extortion Targets Small Businesses

Across Central Pennsylvania, legitimate businesses are being targeted by fake ‘website reputation’ companies that falsely label them as scams and demand payment to remove the warning. Here’s how the scheme works—and how to protect yourself.

For every business owner, an online reputation isn't just a marketing tool—it is a sacred trust. At Harrisburg Shopping, that trust is the heartbeat of our mission. When we serve over half a million Central Pennsylvania residents and coordinate life-sustaining deliveries for our homebound, elderly, and disabled neighbors, our "safety" isn't just a rating; it’s a responsibility.

Lately, a predatory new scam has moved into our digital backyard. Much like the "review bombing" extortion seen on Google Maps—where scammers bury a business under fake 1-star reviews only to demand a "fee" to delete them—these scammers are now targeting entire websites.

We’ve recently encountered a wave of fraudulent “website safety” and “trust” platforms. These sites label legitimate local businesses like ours as “unsafe” or a “scam,” only to follow up with a demand for money to “restore” our reputation.

Below, we’re pulling back the curtain on how this extortion works, why we’re standing our ground, and how every business in the Harrisburg area can protect themselves from these digital pirates.

They call themselves:

• Website Reputation Scanner
• Website Safety Scanner
• Domain Safety Scanner
• Website Trust Scanner
• Website Security Scanner

(You get the idea)

What is the Website Reputation Scam?

The scheme usually begins when a third‑party “security scanner” or “trust platform” flags a legitimate business website as a “scam,” “suspicious,” or “very unsafe.” Shortly after the rating appears, the business receives a polished, official‑looking email offering to repair its reputation—for a fee.

This is a form of review extortion, and it is becoming increasingly common.

Although these sites present themselves as independent authorities on web safety, the reality is often much simpler. Many are run by individuals using automated website scripts that spider the internet for domains and automatically assign low “trust” scores, labeling sites as “dangerous” or “suspicious” with no real investigation or facts behind it.

In fact, these “website reputation” systems are so unreliable that they have even flagged major, well‑known websites (such as Google) as scams—underscoring how little credibility their ratings truly have.

The Anatomy of the Extortion Attempt

The False Positive: Your site is flagged as a "scam" by an automated "trust algorithm" with no specific evidence of wrongdoing.

The "Review Fee": You are told that to "verify" your business, you must pay a "manual review fee." These fees typically range from $2,500 to $5,000 USD.

The Identity Harvest: They demand copies of your Driver’s License, Passport, and confidential business incorporation papers (claiming they must have this information to "fix" your reputation review). There is no legitimate reason for a website scanner to require your Passport or Incorporation papers. This is a primary tactic for business identity theft.

The Threat: If you don't pay, they imply your reputation will suffer. One recent extortion attempt we faced from an overseas entity (ScamAdviser) explicitly stated in their email: "You pay us and save yourself the trouble, or you can suffer."

The Scammers Unmasked

Some of the "Reputation Check" websites doing this to businesses are:

• Gridinsoft: Even though their website looks professional, the business itself is a total fraud. A well-known Russian company, easily found on Yandex.ru (the Russian "Google"), that, after 14 years, mysteriously claimed their "offices" were now located in Ukraine following the 2022 invasion. Strangely, they chose as their "offices" a children's gym and a dance studio.   

  Gridinsoft claims their offices are at "Lesya Kurbasa Ave, 7, Kyiv, Ukraine, 03194" and yet at that location is:

  KDgym, a gym. Their website is https://www.kdgym.com.ua/en (Will open in a new window)

  Dance Studio Luna. Their website is https://lunadance.com.ua/ (Will open in a new window)

  Here is the outside of the building Gridinsoft claims it has "offices" in.

  
  

  
  

  When contacted, both KDgym and Dance Studio Luna stated they are the only businesses located in the building have no idea who Gridinsoft is.

  This is a classic location scam used by many fraud businesses all over the world. If you have ever spent time on Google maps scrolling around, you'll see random things posted, such as a "tattoo parlor" in the middle of the woods. I've even found a bakery in the middle of the Atlantic Ocean. Non-real businesses do this to appear on Google maps so they get extra search engine help from Google, and map submissions aren't regulated or checked, they are only verified after a report to Google is made about a fraudulent business address (like Gridinsoft).

  
  

• MyWOT (Web of Trust): Originally a Finnish project, it has faced multiple public privacy scandals when it was proven in a German Court of Law MyWOT uses the site "exclusively" for harvesting and selling its user's data and admitted it does not actually provide any type of website security at all. In 2017, Google and Mozilla famously removed the extension from their browser stores due to "severe violations of privacy policies". 

  The NDR investigation discovered that while you have the MyWOT extension installed, extensive data collection is going on in the background. MyWOT not only collects and records data on a per-user basis, it then analyzes and sells it to third parties. The MyWOT Privacy Policy states that your IP, geographic location, device type, operating system, browser history, the date and time, Web addresses, and overall browser usage are all collected.

  MyWot now claims they sell "online reputation management tools".

  
  

• Scam-Detector.com: While they claim to operate out of Puerto Rico, technical traces point to web hosting in Morocco—hardly the transparent behavior you’d expect from a "trust" site. Like other "website reputation scanners", they demand copies of your Driver’s License, Passport, and confidential business incorporation papers, stating they must have this information to "fix" your reputation review, because they need to "prove" you are the owner of the business or they can't change the score.

  
  

• ScamDoc.com: They present a French face to the public (Their address on Google maps shows a water tank in Paris), yet their web hosting and owners reside in Algeria. They also operate Signal-Arnaques.com and Scamwatcher.com.

  
  

• ScamAdviser.com: The "KING" of the scam website reviews, it has thousands of negative reviews on TrustPilot that expose ScamAdviser for wanting money to change their fake security reviews.

  They list their location as "Keurenplein 41 - UNIT A6311, 1069CD, Amsterdam, Netherlands" which is a hardware store in Amsterdam, Netherlands, and yet, the hardware store on their own website stated they had no connection to these people.

  See here -> TRUSTPILOT REVIEW FOR SCAMADVISER  (TrustPilot itself has a warning about this website and its malicious phishing tactics)

The Irony: These websites represent the very scam they warn people to be being wary of.

Don't Be Fooled by the "5-Star" Illusion

When you look up these "safety scanners" on independent review platforms like Trustpilot, you might see two very different stories.

First, you will find the truth: hundreds of one-star reviews from real business owners reporting the exact same extortion tactics.

But look closer at the positive ratings. You will often see hundreds of suspicious 5-star reviews from far-away locations, often written in broken English like "This site good very" or "Best service." These are "Review Farms." The scammers use bots and paid accounts to flood their own profiles with fake feedback. This creates a "veneer of legitimacy" designed to trick a worried webmaster into thinking the platform is a real authority.

Why You Should NEVER Pay a "Review Fee"

It is tempting to pay the money just to make the "Warning: Unsafe" badge go away. However, giving in to these internet pirates is dangerous:

It’s a Bottomless Pit: Once you pay, you are marked as a "payer." They may flag you again in six months for a new "security audit."

Identity Theft Risk: Sending copies of your Passport or ID to unverified "rating sites" is a massive security risk. These documents can be used for corporate identity theft.

Non-Existent Support: Many of these sites list support emails that simply bounce back as "unknown inbox." There is no real person behind the "review process"—only a script designed to take your money.

SEO Checklist: What to Do If Your Site is Flagged as a Scam

If your business is being targeted by a reputation extortion scheme, follow these steps:

Do Not Engage: Do not reply to high-pressure emails. Engaging often leads to more aggressive threats.

Document the Evidence: Take screenshots of the false rating and save the extortion emails (including headers).

Run a Real Security Scan: Use legitimate, industry-standard tools like Google Search Console, Sucuri, or VirusTotal. If these trusted sources say your site is clean, the "safety scanner" is a sham.

Report to Authorities: File a report with the FTC (Federal Trade Commission) and the IC3 (Internet Crime Complaint Center).

Public Transparency: Follow our lead—write a blog post! Warning your customers about these "pirates" builds trust and shows that you are proactive about security.

For those interested, Harrisburg Shopping security scans are always public:

VirusTotal (Will open in a new window)

Google Safe Browsing (Will open in a new window)

Final Thoughts: Protecting the Harrisburg Business Community

At HarrisburgShopping.com, we refuse to let digital pirates interfere with our mission to serve the Pennsylvania community. We will not be intimidated by "review fees" or "reputation threats," and you shouldn't be either.

The best defense against online extortion is a community that is informed and refuses to walk the plank.