scan.now
Premium Scan a site

Check Whether a Link Is a Phishing or Scam URL

Answers two questions about a link you were sent: Is it dangerous, and where does it actually end up? We open it from our server, follow every redirect to the real destination and check the address for the tricks scammers use - lookalike domains, hidden hosts, shorteners and brand names in the wrong place.

The link is opened from our server, never in your browser. Copy it from the message rather than clicking it. How to read a suspicious URL

Illustration of the phishing url checker in use

What this tool checks

13 checks across 1 areas. Each links to its reference page with the test, the risk and the fix.

Full reference

URL and phishing indicators

13 checks

The ones that most often decide the grade:

High Internationalised (punycode) domainThe domain contains internationalised (non-ASCII) characters encoded as punycode (xn--), which can make a lookalike... High Lookalike of a well-known brand domainThe registered domain closely resembles a well-known brand's domain through a typo, an inserted character, a swapped... High Brand name used in a subdomain or pathA well-known brand name appears in the subdomain or path of a URL whose registered domain is something else, for... High Credentials or @ embedded in the URLThe URL contains a user:password@ section before the host, a legacy syntax that phishers use to make an address... Critical Google Safe Browsing blocklistGoogle Safe Browsing lists this URL as phishing, malware or unwanted software. This is the strongest signal Scan.now...

After this one, most people run Password & Breach Check. Each answers a different question about the same thing, and the full list of tools explains which to reach for when. Every finding links through to the checks reference.

Guides for this tool

Background reading written to go with these results.

8 min read · Updated Sep 13, 2026 How to Spot Phishing: URLs, Lookalike Domains, Urgency and the Checks That Work

Phishing succeeds by looking legitimate at a glance. This guide teaches the checks that hold up: Reading a URL from the right end,...

Read the guide 8 min read · Updated Sep 18, 2026 TLS Certificate Errors Explained: Expired, Mismatched, Self-Signed and Untrusted Chains

A certificate warning means the browser could not prove it is talking to the right server. Each error, what causes it on the server...

Read the guide 8 min read · Updated Sep 12, 2026 Two-Factor Authentication: SMS vs Authenticator Apps vs Passkeys and Security Keys

A second factor stops most password-based takeovers, but the methods differ enormously in strength. This guide ranks SMS codes,...

Read the guide 9 min read · Updated Sep 10, 2026 SPF, DKIM and DMARC Explained: Stopping Email Spoofing of Your Domain

Without SPF, DKIM and DMARC anyone can send email that appears to come from your domain. What each record does, how to write them, how...

Read the guide

Frequently asked questions

Does checking a link visit it?

Yes, from our server, not your browser, with a hard timeout and no scripts executed. We follow redirects to find the real destination and look for a password form.

A link passed every check. Is it safe?

No check proves safety. A clean result means none of the common phishing signals are present. Still navigate to important sites yourself rather than through links.

What is a lookalike domain?

A domain that reads like a brand at a glance: paypa1.com, micros0ft-login.com, or a Cyrillic 'а' in apple.com. We fold confusable characters and compare against known brands.