No supported warning found
The resolved destination did not trigger the current domain, redirect or page indicators. Navigate independently for sensitive accounts.
Check Whether a Link Is a Phishing or Scam URL
Answers two questions about a link you were sent: Is it dangerous, and where does it actually end up? We open it from our server, follow every redirect to the real destination and check the address for the tricks scammers use - lookalike domains, hidden hosts, shorteners and brand names in the wrong place.
The link is opened from our server, never in your browser. Copy it from the message rather than clicking it. How to read a suspicious URL
Analysing the link…
What this tool checks
13 checks across 1 areas. Each links to its reference page with the test, the risk and the fix.
URL and phishing indicators
13 checksThe ones that most often decide the grade:
High
Internationalised (punycode) domainThe domain contains internationalised (non-ASCII) characters encoded as punycode (xn--), which can make a lookalike...
High
Lookalike of a well-known brand domainThe registered domain closely resembles a well-known brand's domain through a typo, an inserted character, a swapped...
High
Brand name used in a subdomain or pathA well-known brand name appears in the subdomain or path of a URL whose registered domain is something else, for...
High
Credentials or @ embedded in the URLThe URL contains a user:password@ section before the host, a legacy syntax that phishers use to make an address...
Critical
Google Safe Browsing blocklistGoogle Safe Browsing lists this URL as phishing, malware or unwanted software. This is the strongest signal Scan.now...
Medium
URL uses a raw IP address as hostThe link points to a bare IP address instead of a domain name, which legitimate consumer services almost never do.
Low
URL shortener hides the destinationThe link goes through a URL-shortening service, so the real destination is hidden until you click.
Low
Excessive subdomain depthThe host has an unusually deep chain of subdomains, a pattern used to push the real domain out of sight and to mint...
Low
Top-level domain heavily abused for phishingThe domain ends in a top-level domain that is disproportionately used for phishing and spam, usually because...
Medium
Long or cross-domain redirect chainFollowing the link produced several redirects, or a redirect onto a different domain, so where you land is not where...
Medium
Page asks for credentialsThe page at the link asks for a username and password, so if anything else about the URL is off, this is where the...
Medium
Link uses plain HTTPThe link uses plain http://, so anything you send to the page, including a password, would travel unencrypted, and...
Medium
Domain registered very recentlyThe domain was registered very recently, which is typical of phishing infrastructure that is created, used for days...
How a phishing URL checker investigates a link
The checker resolves the real destination from Scan.now's server and explains address tricks without opening the page in your browser.
A suspicious link can hide behind a shortener, several redirects or a hostname designed to resemble a trusted brand. The important domain appears immediately before the public suffix, not wherever a familiar word happens to occur in the address.
Scan.now normalises the URL, follows a bounded redirect chain from its own server and records each destination. It compares the final hostname with known brand and character-confusion patterns, checks HTTPS and domain structure, and inspects returned HTML for supported credential-form and impersonation clues without executing scripts.
Parse the addressSeparate scheme, hostname, registrable domain, path and misleading text.
Follow redirectsResolve shorteners and forwarding hops from the scanner, not your browser.
Inspect the destinationCheck domain tricks, transport and supported credential-page signals.
Put this result in context
This scanner answers one part of the review. Continue with Email Header Analyzer for sender, ip, route, spf, dkim and dmarc, then Password & Breach Check for breach lookup and strength analysis. These are separate checks because a strong result here does not prove that the adjacent surface is healthy.
For the background behind these signals, read How to Spot Phishing: URLs, Lookalike Domains, Urgency and the Checks That Work and TLS Certificate Errors Explained: Expired, Mismatched, Self-Signed and Untrusted Chains. The Internationalised (punycode) domain check reference explains the exact test, evidence and remediation used in the report. The Scan.now methodology explains request limits, scan boundaries and what the scanner deliberately does not attempt.
Phishing-link signals explained
No single clue proves fraud, so the checker combines destination, identity and page evidence.
| Signal | What is examined | Why it matters |
|---|---|---|
| Registrable domain | The domain controlled by the site, separated from subdomains and path text. | A brand name elsewhere in the URL does not make that brand the owner. |
| Redirect chain | Every supported HTTP forwarding hop and the final destination. | Shorteners and tracking links can conceal where a click ends. |
| Lookalike characters | Confusable Unicode, punycode, digit substitutions and suspicious brand similarity. | Visual similarity can make an unrelated domain look legitimate at a glance. |
| Transport and structure | HTTPS use, unusual ports, user-info tricks, IP hosts and excessive nesting. | These signals can expose misleading or fragile link construction. |
| Page clues | Supported password forms, brand terms and visible destination mismatches in returned HTML. | A credential request raises the impact of an already suspicious domain. |
What the phishing verdict means
A clean automated result lowers suspicion but never overrides the context in which the message arrived.
High-risk link
A lookalike domain, hidden destination, dangerous construction or credential-page evidence needs caution. Do not sign in through the link.
Needs human context
A new domain, legitimate shortener or third-party login provider may look unusual without being malicious. Verify the sender and expected workflow.
Handle a suspicious link safely
- Open the organisation's known website or app yourself instead of using the message link.
- Confirm unusual requests with the sender through a separate trusted channel.
- Do not enter passwords, payment details or recovery codes after an unexpected redirect.
- Report confirmed phishing to the impersonated organisation and your mail or messaging provider.
What this result does not prove
- The scanner does not execute page JavaScript, complete CAPTCHAs or sign in, so gated content can remain hidden.
- A malicious operator can change the destination after the check or show different content by location and device.
- Legitimate compromised sites and newly created phishing domains may not yet expose a recognisable automated signal.
Related tools
Continue the review with four checks that cover adjacent parts of the same attack surface.
Email Header Analyzer
Sender, IP, route, SPF, DKIM and DMARC
Password Strength & Breach Checker
Breach lookup and strength analysis
Browser Security & Privacy Check
Fingerprint, leaks, version, policies
File Malware Scanner
Malware in documents and archives
Guides for this tool
Background reading written to go with these results.
8 min read · Updated Sep 13, 2026
How to Spot Phishing: URLs, Lookalike Domains, Urgency and the Checks That Work
Phishing succeeds by looking legitimate at a glance. This guide teaches the checks that hold up: Reading a URL from the right end,...
Read the guide
8 min read · Updated Sep 18, 2026
TLS Certificate Errors Explained: Expired, Mismatched, Self-Signed and Untrusted Chains
A certificate warning means the browser could not prove it is talking to the right server. Each error, what causes it on the server...
Read the guide
8 min read · Updated Sep 12, 2026
Two-Factor Authentication: SMS vs Authenticator Apps vs Passkeys and Security Keys
A second factor stops most password-based takeovers, but the methods differ enormously in strength. This guide ranks SMS codes,...
Read the guide
9 min read · Updated Sep 10, 2026
SPF, DKIM and DMARC Explained: Stopping Email Spoofing of Your Domain
Without SPF, DKIM and DMARC anyone can send email that appears to come from your domain. What each record does, how to write them, how...
Read the guideFrequently asked questions
Does checking a link visit it?
Yes, from our server, not your browser, with a hard timeout and no scripts executed. We follow redirects to find the real destination and look for a password form.
A link passed every check. Is it safe?
No check proves safety. A clean result means none of the common phishing signals are present. Still navigate to important sites yourself rather than through links.
What is a lookalike domain?
A domain that reads like a brand at a glance: paypa1.com, micros0ft-login.com, or a Cyrillic 'а' in apple.com. We fold confusable characters and compare against known brands.
