Free tool · Runs in your browser
Link inspector: check a URL for phishing red flags
Paste any link to see the domain it really goes to, and every phishing trick hidden in the address: brand names in the wrong place, lookalike letters, letters from other alphabets, @ signs, raw IP addresses, shorteners and forwarding. It runs entirely in your browser, so the link is never sent anywhere and never opened.
Try one of the examples, or paste a link from a message you are unsure about. Nothing you paste leaves this page.
How it works
The checker parses the address the same way a browser does, works out its registrable domain (the name someone actually owns), then runs 13 checks for the tricks phishing kits use, including comparing the domain against the real domains of the brands most often impersonated.
What it cannot do: tell you whether the page behind a clean-looking link is malicious. A brand-new domain with an innocent name passes every check. That is why the final question is always yours: is this domain the company the message claims to be from? How to spot a phishing link explains each red flag with examples.
The M-Learn app
Want to understand what the tool is checking?
M-Learn teaches how malware works and how defenders stop it, in short lessons with a diagram on every page, quick questions after each one, and a certificate when you finish. 8 courses, 144 lessons, in 11 languages.
Free to start. Coming soon to Android and iOS.