← Back to Tools

🎣 Phishing URL Analyzer

Analyze any URL for structural phishing signals — no HTTP request is made to the target site. Safe to use on suspicious links.

🔒

Analysis is done on the URL string only — your browser never connects to the target. No request is made to the suspicious site, so there is no risk of loading malware or tracking pixels.

🕵️ Spot the Scam — URL Quiz

Can you tell which URL is the phishing link? Click to reveal.

📚 How Phishing URLs Work — Attacker Techniques

Lookalike domains

Attackers register domains that look like real brands: paypa1.com (the l is a 1), paypal-secure.com, or account.paypal.phishing.com (the brand is in the subdomain, not the domain).

IDN Homograph attacks

Unicode characters can look identical to ASCII. Cyrillic "а" (U+0430) is visually indistinguishable from Latin "a" (U+0061). A domain like pаypal.com (Cyrillic а) is a completely different domain to paypal.com.

@ trick

In a URL, everything before @ is treated as credentials, not the domain. So https://[email protected] actually goes to evil.com — the browser ignores paypal.com@.

Open redirects

Some legitimate sites accept a destination URL as a parameter: https://trusted.com/go?url=https://evil.com. Attackers use these to craft a link that starts on a trusted domain but sends victims to a phishing page.

How to use this tool

1 Paste the suspicious URL into the input field.

2 Click Analyze.

3 The tool checks the URL structure, domain age, redirect chain, and against known phishing databases.

4 Review the risk score and flagged indicators before deciding whether to visit the link.

Frequently asked questions

What are common signs of a phishing URL?

Lookalike domains (paypa1.com instead of paypal.com), long subdomains burying the real domain, URL shorteners hiding the destination, and freshly registered domains.

Is it safe to paste a phishing URL here?

Yes. The tool analyzes the URL without loading the destination page in your browser.

Can the tool detect all phishing sites?

No tool catches 100% of phishing sites. New domains appear continuously. Use this as one layer of defense alongside browser warnings and common sense.

What should I do if I clicked a suspicious link?

Disconnect from the network, run a malware scan, change passwords for any accounts you entered credentials on, and contact your IT team if this happened on a work device.