How to check if a link is safe
- Copy the link without opening it. On a phone, press and hold the link and choose Copy; on a computer, right-click and choose Copy link address.
- Paste it here. The address is taken apart and checked for common tricks, without visiting the site.
- Read the verdict and warnings. Pay most attention to the registered domain: that is who really owns the site.
Tricks this checker looks for
Phishing links are designed to look right at a glance. Common tricks include look-alike domains that swap letters for numbers ("paypa1") or for characters from another alphabet (a Cyrillic "а" instead of a Latin "a", hidden behind punycode such as xn--); putting a brand name in a subdomain, like paypal.com.secure-login.example, where the real domain is the last part; an "@" sign, which makes browsers ignore everything before it; raw IP addresses; link shorteners that hide the destination; open redirects that bounce you through a trusted site; and very long addresses that push the real domain out of view.
No checker can prove a site is safe: a brand-new scam domain can pass every structural test. Treat any unexpected message that asks you to log in, pay or "verify your account" with suspicion, and go to the company's website by typing the address yourself or using its app. The inspection happens entirely in your browser; the link is never opened or sent anywhere, so it cannot alert the scammer that you clicked.
Does this page visit the link?
No. It only analyses the text of the address, so it is safe to paste suspicious links.
What is punycode?
The way domains with non-English letters are stored, starting with "xn--". It is legitimate, but also used for look-alike domains, so the checker shows both forms.
The link looks fine but I am still unsure. What now?
Do not open it. Contact the company through its official website or app, or a phone number you already have.