Phishing URL Checker
Score a URL for common phishing red flags.
Paste a suspicious link to scan it for common phishing signals like a brand-new domain, look-alike spelling or risky redirects. This is a quick heuristic check, not a guarantee, so treat the result as a prompt to look closer rather than a final verdict.
The Phishing URL Checker inspects a single web address and scores it against the structural red flags commonly seen in credential-harvesting and malware links. It examines the hostname, the path and any parameters without you having to visit the page, so you can triage a suspicious link from an email or message safely.
What the checker looks for
Phishing URLs tend to share recognisable traits. The tool weighs signals such as the use of a raw IP address instead of a domain, an unusually long or deeply nested hostname, an excessive number of subdomains or hyphens, brand names buried in the path or subdomain rather than the registered domain, look-alike characters, suspicious or free top-level domains, embedded credentials (the @ trick), and shortened or redirecting links that hide the true destination. None of these alone proves malice, but together they raise or lower a risk score.
How to read the result and stay safe
Treat the score as guidance, not a verdict. A high score means several deception patterns are present and the link deserves caution; a low score is not a guarantee of safety, because well-resourced attackers can register clean-looking domains.
- Never enter credentials based on a link's appearance. Navigate to the real site yourself.
- Check the registered domain, reading right-to-left before the first single slash, not the words that appear earliest.
- Expand shortened links with caution and re-check the final destination.
- Report confirmed phishing to your provider and the impersonated brand.
For inbound protection at scale, getting your own domains to DMARC enforcement stops attackers from spoofing you in the first place.
Frequently asked questions
Does a high score mean the URL is definitely malicious?
No. The score reflects how many phishing-associated patterns the URL contains, not a definitive judgement. Some legitimate sites use long URLs, many subdomains or unusual TLDs, while sophisticated attackers register clean domains that score low. Use the result alongside your own judgement and never enter credentials on the strength of a score alone.
Why is the part before the first slash so important?
The registered domain is the last two labels of the hostname, immediately before the first single forward slash. Attackers exploit this by writing something like https://yourbank.example-login.com/..., where the real domain is example-login.com, not yourbank. Always read the hostname right-to-left from that first slash.
What is the @ trick in a URL?
Anything before an @ in the authority part of a URL is treated as user information and ignored by the browser when choosing where to connect. So https://paypal.com@evil.example/ actually loads evil.example. The checker flags embedded credentials for exactly this reason.
Is it safe to check a link here instead of clicking it?
Yes. The tool analyses the text of the URL and does not require you to open the page in your own browser, so you avoid exposing yourself to drive-by content. It is a safe way to triage a link before deciding whether to trust it.
How do shortened links affect the result?
Link shorteners hide the true destination behind a neutral-looking domain, so the visible URL may score low while the final page is hostile. Where possible, expand the short link first and re-check the resolved address, and be especially wary of shorteners in unsolicited messages.
How do I stop phishing that impersonates my own domain?
Publish SPF, DKIM and a DMARC policy at p=reject so mailbox providers discard spoofed messages claiming to come from you. See our enforcement guide and the authentication requirements for the steps.