Is 123rf.com legit?
123rf.com appears to be a mostly safe and established platform, backed by strong identity and infrastructure signals. However, users should exercise caution regarding the presence of urgency tactics and a high number of external scripts, which raise minor concerns about user experience and potential security risks.
Stock Media average: 80/100 · based on 31 sites
Checked: April 27, 2026 at 1:13 PM UTC
Is 123rf.com a scam? Here's what we found.
The site uses modern TLS 1.3 and has a valid SSL certificate, and Google Web Risk reports it as clean. However, the high number of external scripts introduces a moderate security vulnerability risk.
This is a very well-established domain, over 21 years old, with Whois information indicating a long-standing online presence. The registrar is well-known, and the domain expiry is more than 300 days away, suggesting active management.
The site has a strong Tranco rank, indicating high traffic and visibility over time, and is clean on DNS blacklists. The presence of urgency tactics is a slight detraction from an otherwise solid reputation, though it's neutral regarding Trustpilot and Wayback Machine history cannot be confirmed.
Comprehensive contact information, legal pages (privacy and terms), and a significant social media presence are all indicators of a transparent operation. The absence of a sitemap is minor for transparency and common for many sites.
The presence of both a Privacy Policy and Terms of Service pages demonstrates a commitment to legal and user responsibility, aligning with standard compliance expectations.
The DNS configuration is robust with multiple IP addresses and name servers, along with correctly configured SPF and DMARC records for email authentication. DNSSEC is unsigned, which is a minor detraction, and the inability to check certificate transparency is a slight concern.
Signals Detected
This is a well-known, high-traffic website
Site has structured data markup
This business has no Trustpilot presence — not unusual for smaller or newer companies
crt.sh returned status 429
Site uses multiple urgency/scarcity tactics — common in scam sites
Excessive number of external scripts — may indicate malicious injection
Domain created 2005-03-04T11:55:14Z (21 years, 5 months ago)
Registered through NameCheap, Inc.
Expires in 310 days
DNSSEC status from WHOIS
Resolves to: 18.172.112.10, 18.172.112.110, 18.172.112.16, 18.172.112.48
Mail servers: aspmx.l.google.com., alt2.aspmx.l.google.com., alt1.aspmx.l.google.com., alt3.aspmx.l.google.com., alt4.aspmx.l.google.com.
Domain has SPF email authentication configured
Domain has DMARC email authentication configured
DNS providers: ns-1404.awsdns-47.org., ns-1924.awsdns-48.co.uk., ns-221.awsdns-27.com., ns-562.awsdns-06.net.
Valid certificate, expires in 313 days
Certificate issued by Amazon
Connection uses TLS 1.3
robots.txt has 26 directives
Site has custom branding and social media metadata
No threats detected by Google Web Risk
Website is live and responding
Website appears to have contact information
Website has both privacy policy and terms of service pages
Website links to multiple social media platforms
No sitemap found — common for smaller sites
Could not query Wayback Machine
Not found on any DNS blacklists
Fast page load
Embed This Badge
Stay Safe Online
Good habits to protect yourself, no matter the scan result.
Never reuse passwords across sites.
Add a second layer of security to your accounts.
Always verify unfamiliar stores before entering payment info.