Paste a link (URL) — we flag phishing/impersonation risks from its structure alone. No model, no lookup, no upload. A rough guide.
Free with no sign-up, and the check runs inside your browser, so what you enter never leaves your device. The result is a signal to help you decide, not proof for money or legal decisions.
Before you click a link (URL) from a text, email or social message, estimate its phishing/scam risk from the address structure alone. It analyses only the URL string without visiting the page, so it is safe.
Fake sites imitate real domains. A classic trick puts a well-known brand name in a subdomain or prefix while the real domain is unfamiliar — naver-login.com, kakao.security-check.co. Look-alike characters (o as 0, l as 1 — homographs) are common too.
Shortened URLs (bit.ly, etc.) hide the final destination, so be careful when the source is uncertain. An @ sign in the address, an excessively long path, a raw IP-address link, and unusual top-level domains (.zip, .top) all add risk.
The padlock (HTTPS) in the address bar only means the connection is encrypted — not that the site is honest. Most phishing sites now use HTTPS too. Entering login or payment details because "there's a padlock" is the most common mistake.
The real check is the second-to-last part of the domain. login.naver.com belongs to naver.com, but naver.login-secure.com belongs to login-secure.com — someone else's site.
Phishing domains are usually registered, used and abandoned within days or weeks. An address imitating a brand is rarely an old domain, which makes registration date the strongest clue after URL structure. Put the domain into a whois lookup: a domain registered a month ago that is impersonating a bank login page needs no further argument.
The certificate tells a similar story. Click the padlock and look at when it was issued. A recently issued short-lived free certificate is not a problem in itself — plenty of legitimate sites use them — but read alongside the registration date it settles things quickly. Long-running services accumulate renewal history in both places.
Domains built from Hangul, Cyrillic or other scripts appear in the address bar as punycode beginning with xn--. An address that looked identical to the real one on screen turns into an unfamiliar string once the browser renders it. Long-press the link, copy the address and paste it here: the check applies the same conversion, so disguised characters surface immediately.
People who search "is this website safe" usually mean one of two things: is this address a phishing page built to fool me, or is this site a legitimate business? They need different checks. The URL structure check above answers the first question: whether the address imitates a real brand or hides its destination, without ever visiting it.
The second question cannot be answered from the shape of an address. For an online shop, look for a registered business name, a physical address and a company or tax number, then check them against your country’s official business registry or consumer-protection site. Missing details, details that do not match the registry, prices far below market and bank-transfer-only payment all point the same way.
Sites that are blocked for illegal content tend to change domains constantly and push the new address through texts and social posts. A link that arrives with "we have moved to a new address" deserves suspicion on that alone. It is also why this check weights newly registered domains and unusual top-level domains as warning signs.
Clicking alone rarely costs you an account. The risk turns on what you did on the next screen. If you closed it without typing anything, you are almost certainly fine. If you entered a username and password, change that password now, and change it anywhere else you reused it. With two-factor authentication switched on, a leaked password still does not get anyone in.
If a file was downloaded, delete it — and if you installed it, remove it and run a mobile security scan. If card or account details were entered, call the issuer or bank to freeze and reissue. Then report the phishing address to your national reporting body so it lands on blocklists; that is close to the only way the next person sees it less.
One habit prevents nearly all of this: never sign in through a link that arrived in a message. Even when you genuinely need that page, opening the app or a bookmark means phishing has nothing to work with.
The address in the message read like https://www.trusted-bank.com@203.0.113.45/login. The familiar name sat at the front, so it read as normal at a glance. Browsers treat everything before the @ as credentials and discard it, then connect to what follows: an unfamiliar IP address. The check flags the @ sign and the IP literal together. This is a trick aimed squarely at human reading, which makes it one of the few places a structural tool clearly beats the eye.
An address of the form paypal-login.secure-check.xyz was checked. The real brand sits in the subdomain rather than the registered domain, the top-level domain is unusual, and several hyphens pad the string. Risk comes back high. The trick exploits the habit of reading left to right; remembering that the registered domain is always the last two labels (secure-check.xyz) catches almost this entire family.
A bit.ly link from a text message was checked. The shortener itself is a legitimate service, so nothing in the string is malicious — but the final destination is unknowable from the string. The result is "needs checking" rather than "dangerous". Shorteners are not evil; they simply remove the evidence, so expand the link with a preview service and check the real address instead.
Marketing email links live on unfamiliar delivery-service domains with long random query strings and redirects. Structurally they are indistinguishable from phishing, so the risk score rises. This tool never visits the page. It reads the string only. That means it cannot certify safety, and a high score is not proof of fraud either. What settles it is whether the final destination domain belongs to the company.
No. It analyses only the structure of the URL string and never actually connects. Check freely.
It only means few structural risk signals. A freshly created phishing domain can look clean, so always reach login/payment through official routes.
Legitimate companies use long tracking parameters and third-party sending domains, and a structure-only check can rate those high. Rather than agonising over the score, go to the company site or app and see whether the same notice is there.
Some shortening services offer a preview, but not all do. This check flags the shortener itself as a risk factor, because not being able to see the destination is already the information you need.