We identify the real domain. Familiar brand names elsewhere in the address do not change who owns it.
Is that link safe or a scam?
Paste a web address to check it. We'll explain in plain English what looks safe, what looks suspicious, and why.
We inspect the page without entering passwords or filling in forms.
See how an address is put together. Try an example:
https://example.com/login
The marked part is the site you are really visiting. Everything before it can be set to anything at all.
How we check suspicious links
We trace every redirect. Each address shows whether the link goes somewhere else before the page loads.
We inspect the page. Password fields, forms, links, and copied branding reveal what it asks for.
We check its history. Registration, certificates, and hosting details add context to the result.
Rules and scoring are compared. Disagreements and rules that change the result stay visible.
The check stays contained. It never fills forms or accepts downloads, and it has time and size limits.
Frequently asked questions
What is a phishing site?
A fake copy of a real site (your bank, your email, a delivery company) built to make you type a password or card number into it. They are usually days old and usually look convincing.
This tool looks at one the way an investigator would: who registered the address, how old it is, what the page asks for, and whether it borrows another company's images. Then it explains what it found.
How do I read an address myself?
Look for the registered domain in the address. Its ending may have several parts, such as co.uk, so counting the last two words does not always work. A familiar company name placed before the registered domain does not prove ownership. In secure.paypal.com.account-verify.co the site is account-verify.co, and every reassuring word in front of it was typed by whoever set the address up.
The box at the top of this page marks that part for any address you paste, so you can see where it falls before you decide anything.
Is it safe to paste a suspicious link here?
The checker fetches the page in a restricted environment, follows redirects, and inspects the returned content. It does not fill in forms or enter credentials, and downloads are blocked. When enabled, it can run page scripts to inspect content that needs them. The suspicious page is not opened in your browser.
What happens when the rules and the model disagree?
Legitimate sign-in pages and credential phishing can look almost identical from the outside, so a fixed rule and the scoring model sometimes land on different sides of a case. A confident rule, in either direction, still wins - a known-good domain is not recoloured by a nervous score. And when the checks look at the evidence and cannot decide, the page says exactly that rather than letting the score pick a word for it - so "not sure" means the checks were unsure, not that the number was close.
What are the exact limits on every check?
- Redirect depth cap
- 10
- Response size cap
- 2 MB
- Per-collector timeout
- 15s
- Javascript execution
- disabled
- Form submission
- never
- Downloads
- blocked
- RDAP rate limit
- 0.5 req/s
- WHOIS rate limit
- 0.25 req/s
What happens to the links I check?
The address goes to this site's server, which visits the page itself, not through your browser and without your cookies or logins, so the site you are checking sees a visit from the checker, not from you. To check the domain, the server also asks outside services about it: domain registries, public certificate logs, DNS and a network-ownership lookup, and Google Safe Browsing if this site has it set up.
Nothing about your check is kept on the server after your result has been shown, or after two minutes if it never is. Like any website, the hosting provider's request logs record the addresses requested, which include the link you checked, for a limited time.
Your results are kept only in this browser, under History in the header, where any of them can be renamed or removed. Removing one deletes it and its saved result from this browser.