Link safety checker: is this link safe?

How phishing links trick people

Every web address has one part that decides who runs the site: the registrable domain, such as paypal.com or bbc.co.uk. It sits just before the first single slash, and you read it from the right. Everything to its left is a subdomain, which the owner can set to any words they like, and everything after the slash is a path, which can say anything at all. Phishing links work by putting a name you trust in one of those free-for-all places, or by registering a domain that only looks like the real one.

The US Cybersecurity and Infrastructure Security Agency (CISA) lists links that are slightly altered from a real brand's name, untrusted short links, urgent or threatening language and requests for personal or financial information as the signs to watch for. It also notes that clumsy spelling is no longer a reliable clue, because scammers now write polished messages with AI.

What the warning signs mean

Each warning sign comes with a level, so you can tell a trick from a quirk:

• High: a technique real companies don't use in links, such as a fake address before an @, letters from a different alphabet, a brand's address placed in front of someone else's domain, a disguised IP address or a program download.
• Medium: common in phishing but with innocent uses too, such as a short link, an unencrypted http address, a misspelling of a well-known name, or a link that forwards you to another site.
• Low: worth a second look, such as an unusual port, a very long address or a site on a free hosting service.
• Note: information only, for example that the link had no https:// or was wrapped by your email provider's link scanner. When a link forwards somewhere else, the destination is checked as well.

Look-alike checks compare the domain with a built-in list of more than 120 brands and government services that scammers often copy, from banks and delivery companies to the IRS and GOV.UK. A new or local brand that isn't on the list won't be matched, which is one more reason a clean result is not a guarantee.

If you already clicked

Act quickly, but don't panic. What to do depends on how far you got:

1. You only opened the page. Close it. Keeping your browser and device up to date protects against most attacks that work just by visiting a page.
2. You typed a password. Change it right away on the real site (type the address yourself), plus anywhere else you used the same one. Turn on two-step verification. You can see whether a password is already known to criminals with the password leak check, and make a new one with the password generator.
3. You gave card or bank details. Call your bank or card company using the number on the back of your card, not one from the message.
4. You downloaded a file. Don't open it, and delete it. If you already opened it, the FTC advises updating your security software, running a scan and removing anything it flags.
5. You gave personal details such as a Social Security number: in the US, IdentityTheft.gov has a step-by-step plan for each kind of information.

Then report it. In the US, the FTC asks you to report phishing at ReportFraud.ftc.gov, forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org and forward scam texts to 7726. CISA recommends using the report button in your email or messaging app. In the UK, forward suspicious emails to report@phishing.gov.uk, which the National Cyber Security Centre (NCSC) investigates, and suspicious texts to 7726.

What this checker can't do

Because it never visits the link, it can't see what's on the page, follow a short link to its destination or look the address up in blocklists. A freshly registered domain with an ordinary name will pass, and so will a real site that has been hacked. That's why the result never says a link is safe. If you want a second opinion, the optional buttons send the link to Google Safe Browsing and VirusTotal, which know about many reported sites, though not every new one.

Got a file from a link and want to make sure it's the genuine download? Compare it with the publisher's checksum using the file checksum calculator. Run a business? Scammers can only fake email from your own domain if it lacks protection: check yours with the DMARC checker and SPF checker.