What we check
- Where it really goes. We follow short links, HTTP redirects, meta refresh and simple JavaScript redirects to the final page.
- Known phishing domains. Every domain in the chain is matched against a public list of active phishing domains, updated several times a day.
- Domain age. Scam domains are usually days or weeks old. We look up the registration date.
- Look-alike domains. Letters from other alphabets that look like Latin ones (Cyrillic а instead of a), brand names inside someone else's domain, and tricks with @ in the address.
- Fake login pages. A page that calls itself PayPal, Microsoft or your bank and asks for a password on a domain that does not belong to them.
- Downloads. Links that start a download of an app, archive or program instead of opening a page.
- Risky hosting. Cheap top level domains and free site builders that phishing kits favour, broken HTTPS and bare IP addresses.
Signs of a phishing message
- Urgency. Your account will be closed, a package is held, a fine is due today.
- A link instead of a normal route. Banks and authorities ask you to log in through their app or website, not through a link in a text.
- A sender that does not match. A display name of a company with a random email address or phone number.
- A request for codes. Nobody legitimate asks for a one-time code, MitID approval or card PIN.
When in doubt, do not use the link. Open the company's app or type their address yourself.
I already clicked. What should I do?
- If you only opened the page, close it. Opening a page alone rarely infects an up-to-date phone or computer.
- If you typed a password, change it right away on the real site, and anywhere else you used it. Turn on two-factor authentication.
- If you entered card details, call your bank and block the card.
- If you downloaded and opened a file or app, disconnect from the internet and run a malware scan, or get help from IT.
- Report it: forward phishing emails to your provider's report address, and SMS scams to your phone operator or the police.
Frequently asked questions
Is it safe to check a link here?
Yes. The link is opened by our server, never in your browser, and we only read the page text. Nothing that runs on the page can reach your device.
Does 'No warning signs found' mean the link is safe?
It means none of our checks found a problem. A brand new scam can be clean on every list for its first hours. If the message was unexpected or pushes you to act fast, treat it with care anyway.
Can you check short links like bit.ly or tinyurl?
Yes. We follow short links and every redirect after them, and show you the full chain and the final page, without you ever visiting it.
Do you store the links I check?
No. Links are not saved and our access log for this tool does not record query strings or request bodies.
Why does a real site get a warning?
Some signals are only hints, like a very new domain or a free hosting platform. Read the specific findings: one low signal on a site you know is usually fine. Strong signals like a blocklist hit or a fake brand login page are not.
What phishing lists do you use?
The open Phishing.Database list of active phishing domains, refreshed every 6 hours, plus our own checks for patterns that new scams cannot hide, like domain age and look-alike letters.