Link inspector

What this looks at

Phishing links are built to look trustworthy at a glance. This tool takes the address apart the way your browser does, and points out the tricks that are used most:

• The real domain. In paypal.com.secure-login.xyz the domain is secure-login.xyz. Everything to the left of it can be chosen freely by whoever owns that domain.
• Brand names in the wrong place, such as a bank’s name in a subdomain or path of someone else’s domain.
• Lookalike domains with a swapped or extra letter, or a digit instead of a letter: paypa1.com, rabobanc.nl.
• Lookalike characters from other alphabets. A Cyrillic а looks identical to a Latin a, but leads to a different domain.
• Hidden destinations: link shorteners, an @ in the address, or another address tucked into the parameters.
• Bare IP addresses, unusual ports and unencrypted http.

What it can’t tell you

The tool never visits the link, so it can’t see what the page does, and it doesn’t consult a blocklist. A link without warning signs can still be malicious, for example on a hacked but legitimate website. Treat a clean result as “nothing obvious”, not as “safe”.

When in doubt

Don’t click. Go to the website yourself by typing the address you know, or use the app. Banks and government services never ask you to log in through a link in an e-mail or text message.