Suspicious Link Checker
Paste a link and read what its structure reveals — look-alike domains, punycode disguises, hidden destinations and bait words — without ever visiting it.
Phishing links survive by looking right at a glance: one letter swapped, a brand name riding in the subdomain, a real name hidden behind a shortener. This checker slows the address down and reads it the way a browser — and a fraud analyst — actually parses it: scheme, host, registrable domain, subdomains, port and path, each compared against a built-in table of brands and their real domains.
How to use
- Paste the full link, exactly as it appeared — including any http:// or https:// prefix. Right-click (or long-press) a link and choose “Copy link address” rather than typing what the visible text claims.
- Read the table from the top: red rows are structural red flags, amber rows are worth a second look, and the final rows state plainly what was not checked.
- If any red flag appears, do not open the link. Reach the organisation through its official app or by typing its real address yourself.
About this tool
It never visits the link. Plenty of “link checkers” fetch the page or query a reputation database, which means the address you are worried about gets sent to a server. This one does all of its work with string analysis in your browser tab: nothing is fetched, looked up or stored, so you can safely check a link you would never click.
The output is a row-by-row evidence table, not a score to trust blindly. Each check explains what it found and what it means in plain English, including the checks this tool deliberately does not perform — domain age and blacklist status need live databases, and pretending otherwise would be dishonest. If the link arrived inside a message, run the whole message through the Scam Message Checker too: wording plus link together is the full picture.
How it works
How it reads a link — 11 structural checks. Addressing tricks: dangerous schemes (data:, javascript:), the @ sign that hides the real host, raw IP addresses instead of names, and non-standard ports. Disguises: punycode (xn--) encodings and non-Latin characters that imitate Latin letters, hyphen-stuffed and over-long domains, and cheap throwaway top-level domains. Impersonation: the registrable domain is compared with a built-in table of brands and their official domains — exact brand names on wrong domains, brand names inside longer domains, near-misspellings, and digit substitutions (paypa1 for paypal) are all flagged, as are brand names parked in subdomains. Concealment and bait: known link shorteners, stacked subdomains, and login/verify/claim vocabulary in the path of a domain that is not the brand’s own.
What is not checked, on purpose: whether the domain was registered yesterday, whether it appears on phishing blacklists, and what the page at the other end actually does. Those need live external databases. A clean structural result therefore means “nothing about the address itself gives it away” — the page behind it can still be a freshly built fake on a perfectly ordinary domain.
Worked examples
Brand in the subdomain: Input: https://paypal.com.secure-login.top/signin — the registrable domain is secure-login.top, not paypal.com. Output flags: brand name parked in a subdomain, throwaway top-level domain, and login bait in the path of a domain that is not PayPal’s.
Digit substitution: Input: http://paypa1-verify.com — output flags: no HTTPS, digit-substitution imitation of paypal (1 for l), brand name inside a longer domain, and verify bait in the domain itself.
An ordinary link: Input: https://www.bbc.com/news — output: no structural red flags. HTTPS present, the registrable domain is the organisation’s own, no disguises or bait — with the standing note that structure alone cannot prove where a link leads.
Frequently asked questions
Does this checker visit the link or scan the page?
No. It only reads the text of the address itself. Visiting unknown links to “check” them is risky, and sending the address to a reputation service tells a third party what you received. Everything here happens in your browser, offline-capable, and nothing is stored.
A link got no red flags. Is it safe to click?
Not necessarily. Structure checks catch disguises and impersonation tricks; they say nothing about the page at the other end. A brand-new fake shop on a normal-looking domain passes every structural check. If the link arrived unexpectedly, reach the organisation through its official app instead.
What is a look-alike (homograph) domain?
An address built to be misread: paypa1.com swaps the letter l for the digit 1; a punycode domain swaps Latin letters for identical-looking Cyrillic or Greek ones. Your eye reads the brand; the browser goes somewhere else entirely. This checker compares the real registrable domain against the brand’s official one.
Why does it not check domain age or blacklists?
Because those require live external databases, and this tool’s promise is that your link never leaves your device. The result table states this gap openly rather than implying a full reputation check. For high-stakes decisions, pair this with your provider’s own security tools.
The message text looks fine but the link is suspicious. What now?
Trust the link. Modern phishing often uses flawless, even genuinely-copied message text; the address is where the trap lives. Do not open it — go to the service through its official app or your own bookmark instead, and consider running the full message through the Scam Message Checker for the wording side.
More free tools
Scam Message Checker
Paste a suspicious text, email or DM and see the warning signs it contains — checked against 27 known scam patterns, entirely in your browser.
Password Strength Checker
How strong is your password — really? Local strength scoring plus a private breach check.
Phone Number Checker
Validate any phone number: country, line type and the correct international format.
IBAN Validator
Check an IBAN for typos before you send money — mod-97 validation and full structure breakdown.
Credit Card Validator
Check a card number’s format: Luhn checksum and card brand, right in your browser.
C2PA Content Credentials Verifier
Check a photo or video for Content Credentials (C2PA): who signed it, whether the signature still validates, and whether AI involvement was declared — verified on your device.