Address and brand lookalikes
Whether the domain imitates a bank, marketplace or public service: typos, lookalike letters from another alphabet, a brand name inside someone else's domain, a “login@” trick.
Link and website phishing check
Got a link by text, chat or email? Paste it here: in a few seconds we show whether it looks like a fake and explain every sign in plain words.
This is not an antivirus: we don't download files or open pages. We look at the address itself, the domain, the certificate, redirects and public phishing lists.
The link is sent to our server in the request body and isn't stored. We contact the checked website from our server and request only its home page (the full path only for link shorteners). For the domain age we request public RDAP data from the zone registry. The link and domain never reach analytics.
What we check
The result is built from open signals. We describe each one in words, without scores.
Domain age
When the domain was registered, from public RDAP data. Phishing sites usually live on domains that are only days old.
Certificate
Who issued the SSL certificate and to whom, whether it has expired and whether the name matches.
Redirects
We expand shortened links and follow the redirect chain to the final website.
Phishing lists
We match the address against a local copy of the public Phishing.Database. The link isn't sent to third-party services.
What we don't do
Not an antivirus
We don't download or scan files, don't render the page and don't run its scripts.
Not a guarantee
No signs doesn't mean safe: new phishing may not be listed yet, and some sites hide from scanners.
No link storage
The link isn't saved, logged or sent to analytics. Results stay in memory for 10 minutes so repeated checks don't hit the site.
More LiMP tools
Free network, privacy and security checks right in your browser — no install, no sign-up.
Lookalike addresses
A phishing site copies the look of a bank or shop and makes its address resemble the real one: paypa1 instead of paypal, a .help domain instead of .com, Cyrillic letters instead of Latin ones. In the browser bar such an address is easy to mistake for a familiar one.
Another trick is to put the brand at the start of a long address: paypal.secure-login.example. Read the real domain from right to left: everything left of the last two parts can be written by anyone.
Fresh domains
Scammers register domains in bulk and drop them after a few days, once the site gets listed. A week-old domain asking for card details is a serious red flag. We take the age from public registration data (RDAP); some zones don't publish it yet.
Shortened links
A shortener hides the real address: the message shows bit.ly, but not where it leads. Our check expands the link on our server and shows the final website as text, so you don't have to open it.
What to do if you already clicked and entered data
- If you entered card details, call your bank using the number on the back of the card and block it.
- If you entered a password, change it on the real website and wherever you reused it, and turn on two-factor authentication.
- If you entered an SMS code, tell your bank or the service: it may have confirmed a transaction.
- Scan your device with an antivirus if a file was downloaded.
Link check FAQ
Paste the link above. We check whether the address imitates a known brand, how old the domain is, whether the certificate is fine, where redirects lead and whether the address is in a public phishing list. No check is a full guarantee, so for banks and public services it's safest to type the address yourself or use the app.
Yes. Our server contacts the link, not your browser. We don't download files, don't run page scripts and don't read the page content: we only look at the address, server responses and the certificate. Addresses in the result are shown as text, not links.
Only the website's home page: we don't send the path and parameters, so one-time links aren't used up and click trackers aren't triggered. The exception is shortened links (bit.ly and similar): the redirect is the whole point there, so we expand them in full.
A domain registered recently, usually less than a month ago. Real banks and shops keep their domains for years, while phishing sites live for days. A fresh domain alone doesn't prove fraud, but combined with a brand lookalike it's a strong sign.
We match the address against a local copy of the open Phishing.Database list and say “found in a public database”, not “these are scammers”. Other signs (lookalike address, fresh domain, certificate problems) are typical of fakes, not a verdict.
We don't keep our own list; we use the public Phishing.Database, and removal is requested from its maintainers. If you think our result for your website is wrong, write to us via the contact page with the website address, and we'll review it.
No. We don't download or scan files. If a link offers you a file, don't open it; check the file with your antivirus.