Phishing Checker
Check a suspicious link: phishing and malware blocklists, ClamAV antivirus scan, certificate, domain age, redirects and phishing-kit indicators.
- query Google Safe Browsing or commercial reputation services
- click, type or log in on the page: steps a kit shows only after a login attempt, or to visitors it considers real, are not seen
QR images (also pasted into the address field) and JSON exports are read in your browser and never uploaded; only the web address found is scanned. A re-check scans the address of an earlier JSON export again and tells you whether the page was taken down.
External Verification Tools (Enter URL above to pre-fill)
How to check a suspicious link or email
- A link: paste the full URL, for example
https://secure-paypa1.com/login?session=8f2a, into URL Analysis and press Analyze URL. Keep Deep Scan ticked to add the server-side checks. - A QR code (on a parking meter, a letter, a PDF): use Scan a QR code image under the address field, or paste a screenshot into the field. The image is decoded in your browser; only the address it contains is scanned.
- A domain name only: use Domain Check. It compares the name with well-known brands to catch lookalikes such as
rnicrosoft.com, then runs the deep scan against it. - An email or text message: paste the body into Content Analysis. Links found in the message get their own score and a Full analysis button.
- A raw email source or HTML: Extract Links lists every URL it contains and flags risky ones (IP addresses,
@in the URL, Punycode).
Reading the results
The risk score runs from 0 to 100: below 30 is Low, 30 to 59 Medium, 60 and above High. Open Score breakdown to see exactly which checks fired and how many points each added. The strongest signals are a brand name on a domain that does not belong to the brand, a domain registered in the last few weeks, a raw IP address instead of a host name, a xn-- (Punycode) host that can imitate another name, and credentials placed before the host, as in https://paypal.com@198.51.100.7/, where the real destination is the IP address.
The deep scan adds the SSL certificate, WHOIS/RDAP registration data, DNS records, IP and hosting, security headers, the redirect chain, and the forms and links on the landing page. A login form that posts to a different domain is a strong phishing sign. When in doubt, do not enter anything: go to the service by typing its address yourself.
Requesting and confirming a takedown
For a dangerous or suspicious result, the Takedown request text is addressed for you: to the platform's abuse form when the site sits on a shared platform such as github.io or pages.dev, otherwise to the abuse address of the network that hosts the IP address (from its regional internet registry: ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC), with the registrar's abuse address in copy. Each contact shows where it came from. When a registry publishes none (many country domains such as .lu have no RDAP), the text keeps a placeholder and the panel links to the registry lookup.
Download the JSON export when you report a site. Later, Re-check a takedown scans the same address again and compares: taken down (no DNS, no answer or HTTP 404/410), still online, or still online, but changed. Nothing is stored on our side: the earlier result is the file you keep. Related hostnames lists other names under the same domain seen in TLS certificates (certificate transparency): leads for the same campaign, not verdicts.
Frequently asked questions
How can I check if a link is a phishing link without clicking it?
Copy the link (right-click, Copy link address) and paste it in the URL Analysis tab. The pattern checks run in your browser, and the deep scan is done by this server, so your own browser never opens the page. The screenshot comes from that same isolated browser, not from a third-party service.
How do I check a suspicious email?
Paste the message text into the Content Analysis tab: it flags urgency, requests for passwords or payment data, generic greetings and links whose visible text differs from the real target, and scores each link it finds. To check who really sent it, paste the full headers into the email header analyzer.
Does a low risk score mean the site is safe?
No. The deep scan checks the link against free phishing and malware blocklists (URLhaus, OpenPhish, Phishing Army) and scans the page with ClamAV, but a brand-new phishing page is often on no list yet and carries no known malware signature. The deep scan also opens the page once in an isolated browser on a separate server, but phishing kits often hide from automated visitors, and the tool does not query Google Safe Browsing. If the result says the scan was incomplete, treat it as unchecked. Cross-check with the external services listed on this page.
Is a site with HTTPS and a padlock safe?
Not necessarily. A padlock only means the connection is encrypted. Phishing sites get free certificates in minutes, so a valid certificate proves nothing about who runs the site. A certificate issued a few days ago on a new domain is itself a warning sign.
What should I do if I already clicked a phishing link?
If you entered a password, change it at once from the real site (typed by hand, not via the link) and anywhere you reused it, then turn on multi-factor authentication. If you entered card details, call your bank. At work, report it to your security team, even if nothing seemed to happen.