How to use
- Paste the link, or paste the whole text message or chat message; the link is found automatically.
- Click Check link. Our server follows the redirects for you and shows the site that really opens.
- Read the signs below: red Warnings need real care; yellow Cautions are worth a second look.
- Open Redirects to see every address and status code along the way.
Options explained
- Actually opens
- The address reached after following up to 10 redirects. The bold part is the registered domain — the only part that tells you whose site it is.
- Domain age
- The domain’s registration date from RDAP or WHOIS; under 30 days is flagged as a warning, under six months as a caution.
- Imitation check
- Compares against the official domains of banks, payment services, shops, couriers and social networks that are often impersonated, catching brand names placed in front, look-alike letters (0 for o, rn for m) and Cyrillic letters.
Common tricks in phishing links
| Trick | Example | How to spot it |
|---|---|---|
| Brand name in front | www.paypal.com.secure-login.top |
Read only the end: the site is secure-login.top, not PayPal |
| Look-alike letters | paypa1.com, arnazon.com |
The digit 1 for l, rn for m |
| Foreign letters | Cyrillic а in place of Latin a | Often shown as a code starting with xn-- |
| The @ trick | https://www.amazon.com@1.2.3.4/login |
Everything before @ is ignored; the link opens what comes after it |
| Short links | bit.ly/xxxx, tinyurl.com/xxxx |
You can’t see where they go — expand them here first |
| New domains | A domain registered last week | Real organisations have had their sites for years |
Check official addresses on the back of your card, in the company’s app or in your app store. For the full response headers of each redirect, use the HTTP header checker; to look up a domain’s registrar and expiry date, use WHOIS lookup.
Frequently asked questions
Is it safe to check a link here?
Yes. Our server visits the link and reads only the status codes and redirects; it does not run the page’s scripts, and nothing opens on your device.
“No common warning signs” — does that mean it is safe?
Not necessarily. The tool looks only at the address, the redirects and the domain age. It cannot see the page content and does not use a blacklist, and some scam pages sit on hacked legitimate sites or big platforms. If a message pushes you to enter a password, a one-time code or card details, or to install an app, check with the company through its official app or phone number first.
Why is a new domain suspicious?
Scam sites are reported and taken down quickly, so they usually run on domains registered a few days earlier and move on. Real companies have used their domains for years.
I already clicked or entered my details. What now?
Change the affected passwords at once, call your bank to block the card, and report the message — in the US forward scam texts to 7726 (SPAM) and report at reportfraud.ftc.gov; in the UK forward them to 7726 and report to Action Fraud.
Privacy
This tool needs our server: what you enter or upload is sent over HTTPS, processed and then discarded, never stored. Server access logs record IP addresses and request URLs, used only to prevent abuse.