Is phishing?
Paste a suspicious link or an email's headers. You get a plain answer (looks safe, be careful, or likely phishing) and the reasons behind it.
Checking…
01 · Names
Look-alike names
Domains that copy about 100 brands phishers like to fake (Microsoft, PayPal, DocuSign, banks, shippers), using typos, swapped letters or foreign characters.
02 · Age
How new it is
When the domain was registered (RDAP) and when it got its first HTTPS certificate (Certificate Transparency). Most phishing sites are days old.
03 · Lists
Known bad lists
Free community phishing lists, refreshed every few hours, plus the Spamhaus, SURBL and URIBL domain blocklists.
04 · Redirects
Where it really goes
We follow redirects and short links to the final page and check whether it asks for a password while pretending to be someone else.
What happens to what you paste
- Email headers are read in your browser. They are never uploaded. If you leave the box ticked, only the sending IP address and the sender's domain are looked up.
- Links are checked on our server and not saved or logged. The only thing stored is a counter per network for an hour, so the free service can't be abused.
- We never show you the page. We read only its first few kilobytes as text (the title and whether it has a password box). Nothing from it runs.
- A clean result doesn't prove a link is safe. New phishing pages appear every minute and may not be on any list yet. If in doubt, go to the company's site by typing the address yourself.