Phishing link analyser
Paste a link, an email or a text message. The analyser shows who really controls each link and explains every warning sign, without ever opening it.
Links are analysed as text in your browser. Nothing is sent to us and the links are never opened.
What the analyser checks
The analyser reads a link the way a browser does and explains each part. It finds the registrable domain, the part that tells you who controls the site, with a short list of public suffixes such as co.uk and com.tr.
It then looks for the tricks phishing links rely on: text before an @ sign, disguised IP addresses, look-alike letters from other alphabets, punycode names, typo domains, brand names placed in subdomains or paths, link shorteners, redirect parameters that carry another address, and file names such as invoice.pdf.exe. Brand checks compare the domain with about 80 commonly imitated brands, banks, delivery firms and government portals in Europe and Türkiye, using their real primary domains.
What it cannot tell you
The link is never opened, so the analyser cannot see the page, its certificate or how old the domain is. A link that passes every check can still lead to a hacked site or through an open redirect on a trusted domain.
If a message pushes you to act quickly, open the site yourself by typing its address or using its app.
Questions
Does the analyser open the link?
No. The text is analysed in your browser. Nothing is sent to us or to the site, so you can safely paste live phishing links.
Why does a genuine link get a warning?
Some patterns are used by legitimate senders too, such as tracking redirects, link shorteners or regional bank domains. A warning means “check this”, not “this is malicious”. Read the explanation under each finding.
What is the registrable domain?
It is the name someone registered, such as example.co.uk in shop.example.co.uk. Whoever owns it controls everything to its left, so it is the part to check.
What should I do with a dangerous link?
Do not open it. Report the message to your IT or security team, or to the organisation being imitated. If you already entered a password, change it now and turn on multi-factor authentication.
Need more than a tool can show?
A tool checks one thing. Our consultants look at the whole picture.
Consulting and trainingRelated articles
-
A practical WordPress security checklist
Twelve WordPress hardening steps in a sensible order, from updates and abandoned plugins to 2FA, XML-RPC, backups, file integrity and a WAF.
-
Security headers that matter, and the ones to retire
A practical guide to CSP with nonces, HSTS and preload, frame-ancestors, Referrer-Policy, Permissions-Policy and COOP, with examples and what to drop.
-
How to design and test secure file uploads
A checklist of controls for file upload features, based on the OWASP cheat sheet, with a table of tests to run against each upload endpoint.