Free security tools · No signup
URL Scanner & Phishing Detector
Check a suspicious link or email in one place. Understand the warning signs, then use Deep Scan to inspect a link’s destination and see a preview of the page.
Basic check reads the address without opening the page. Only the domain name is sent for public-record lookups. Deep Scan asks before opening the full URL with Cloudflare.
Paste a URL above to check it.
What this scanner checks for (15 checks)▼
- Uses an IP address instead of a domain name. An IP address makes ownership harder to recognize. It can also be used by legitimate infrastructure; it is not proof of phishing.
- Hides the real destination behind a fake address before the @. A URL like "paypal.com@evil-site.tk" actually goes to evil-site.tk — browsers treat everything before the @ as a discarded username, but your eye reads "paypal.com" first.
- Uses look-alike characters to impersonate a brand name. "paypa1.com" or "rnicrosoft.com" look like the real brand at a glance. Your eye fills in the gap — that's the trick.
- One or two characters off from a real brand name. A domain that's one letter away from a well-known brand (like an extra, missing, or swapped character) is a possible lookalike; similar spelling alone does not establish impersonation.
- Brand name appears as a subdomain, not the real site. "paypal.secure-login.com" is NOT PayPal. Anyone can create a subdomain that includes a brand name.
- Mixes alphabets to imitate a real domain (homograph attack). A Cyrillic "а" or Greek "ο" looks identical to a Latin letter but is a completely different character — "аpple.com" is not apple.com.
- Domain itself is stuffed with security/login keywords. Real companies don't need "secure-login-verify-account" in their own domain name. Legitimate brands use short, stable domains.
- Domain extension needs context. An extension alone cannot establish whether a site is legitimate. Check the destination and context before sharing information.
- Uses an internationalized domain name. "xn--" at the start of a domain label means it's an encoded international character set — standard for many legitimate non-English domains. Check the spelling, but this alone is not evidence of impersonation.
- Domain name is padded with multiple hyphens. Real brand domains are short and simple. "paypal-account-verify-secure.com" is a pattern that needs context; legitimate domains can use hyphens too.
- Uses a URL shortener; destination not yet checked. Shorteners like bit.ly hide where a link actually goes. Preview it at checkshorturl.com before clicking, or run it through Deep Scan below.
- Not encrypted (HTTP, not HTTPS). Any legitimate site that handles accounts uses HTTPS. HTTP means your connection isn't encrypted.
- Path contains /verify, /secure, /confirm or similar. Login and account paths are normal. We only note them alongside a stronger domain warning.
- Unusual number of subdomains. Chains like 'secure.verify.update.malicious.com' are designed to make the real domain hard to spot.
- How recently the domain was registered. We look up the domain's public WHOIS/RDAP registration date and, as a backup, the earliest publicly-logged TLS certificate for it. Recent records provide context, not proof of phishing. A certificate date does not establish when a domain was bought or a site launched.
For example, a link like paypa1-secure-verify.tk/login trips four checks at once: look-alike character substitution, a domain-keyword stack, a domain extension requiring context, and a login path. These are clues that call for verification, not proof of phishing.
Pattern matching runs as you type, entirely in your browser. If a sender's email domain isn't a free provider like Gmail, we also look up just that domain name (never the rest of the email) against public WHOIS/RDAP, DNS, and certificate-transparency records.
Paste any suspicious email above to scan it.
How email phishing checks work
How to check if an email is phishing
Paste the email text into the box above. This phishing checker instantly scans it against 14 checks real scammers actually trip for an instant phishing detection result. Most are instant pattern matching, and a couple look up the sender domain's public registration record. Here's exactly what it checks for and why it matters. No need to paste anything to read these.
- Urgency / pressure language. Scammers create fake emergencies to stop you thinking clearly.
- Threatens account suspension or closure. Real companies don't threaten to close accounts over email without prior notice.
- Asks for passwords, card numbers, or personal info. No legitimate company emails you asking for your password or financial details.
- Too-good-to-be-true offer. You didn't enter a competition. You didn't win anything. This is bait.
- No link, just a number to call. "Callback phishing" skips the link entirely, since links get caught by scanners like this one. You call a number staffed by a scammer who then talks you through installing remote-access software or reading out a card number.
- Generic greeting instead of your name. Your bank knows your name. 'Dear Customer' means they got your email from a breach, not from your account.
- Impersonates a well-known brand. Fake emails copy logos and wording from PayPal, Amazon, Netflix etc. to look real.
- Suspicious links or 'click here' with no visible URL. Real links show you where they go. Phishing links hide behind 'Click Here' buttons.
- Mentions unusual login or suspicious activity. This is designed to panic you. If you're worried, go directly to the app — don't click the email link.
- Asks you to 'Allow' or 'Grant Access' to an app. OAuth consent phishing tricks you into approving a real permissions screen for a malicious app, which then keeps access to your account even after you change your password. Only approve app access you specifically requested.
- Reads like bulk marketing, not a personal or official notice. Legitimate security alerts, invoices, and account notices don't usually include marketing language. A mix of the two — an urgent account warning that also says "unsubscribe" — is a mismatch worth noticing.
- References a specific company or department by name. Worth independently searching for the company name (not by clicking anything in this email) to confirm it's real and that this is genuinely how it operates. Scammers often invent plausible-sounding company names or departments.
- Claims to represent a company but replies go to a free email address. Real companies use their own email domain, not a free address like @gmail.com or @yahoo.com. This is one of the most reliable signs of impersonation.
- The sender's own domain's age and mail setup. For non-free-provider senders, we look up the domain's registration age (via WHOIS/RDAP and certificate-transparency logs) and whether it even has working mail servers. A domain that can't receive email or was registered days ago isn't a real company's mail system.
For example, an email reading "Your account will be suspended within 24 hours, click here to verify" trips both the urgency-language and account-threat checks above before you've even looked at the link itself. And a growing trend is skipping the link entirely: an email that just says "call us immediately at [number] to avoid suspension" is callback phishing, designed specifically to slip past link scanners like this one, because a phone number can't be pattern-matched the same way a malicious URL can. If the email does include a link, paste it into the URL Scanner tab above for the full lookalike-domain and domain-age checks.
How to read your scan
A basic scan looks for warning signs in the text you provide. An uncertain result means more evidence is needed. Deep Scan inspects the destination in a remote browser and shows a snapshot of its appearance and available threat findings.
Public records come from domain registries via RDAP, Google DNS, and crt.sh certificate logs. Remote page scans use Cloudflare URL Scanner. Each source has gaps; missing records and a clean scan are not proof of safety.
Methodology updated October 7, 2026 · About MythosCortex · Report an incorrect result
Frequently asked questions
How can I check a suspicious link or email?▼
Choose Check a link and paste the URL, or choose Check an email and paste the message. The basic check explains address and message patterns without opening links. For a URL, Deep Scan can follow redirects and show the destination page in a screenshot.
Does a shortened URL mean phishing?▼
No. Businesses and individuals routinely use short links. A basic text check cannot determine the destination behind one, so this tool marks it uncertain and recommends Deep Scan. Even an unfamiliar extension, a new domain, or a login path is not proof of phishing.
What does Deep Scan show?▼
With your consent, Cloudflare opens the URL in a remote sandbox browser. When available, the report includes the final URL after redirects, a screenshot of what the page looked like, threat findings, hosting IP, network, country, TLS issuer, and detected technologies. Public domain records are looked up for the final destination.
Can I see when a website was purchased or set up?▼
Public RDAP records may provide the domain registration date, registrar, expiry, and last registry update. Certificate logs may show the earliest certificate observed. These dates do not establish a current owner's purchase date or the website's launch date. Unavailable records are shown as unknown, not suspicious.
Is the website preview a live browser?▼
No. It is a static screenshot captured in the remote browser at scan time. You cannot follow its links or submit forms inside the preview. A familiar logo or convincing appearance does not establish that a site is legitimate.
What happens to the URL or email I paste?▼
Message and URL pattern matching runs in your browser. Only a domain name is sent for basic public-record lookups. Deep Scan sends the complete URL to Cloudflare only after you confirm. Those scans are unlisted, not private: someone with the direct scan link can view them. Do not submit private tokens or password-reset links.
Can this checker guarantee a link or email is safe?▼
No. Pattern checks can produce false positives and miss threats, and remote scans can encounter blocked pages or miss new attacks. No threats reported means only that this scan did not report a threat. For sensitive actions, use an independently verified official website or contact channel.