Free tool
Phishing link checker
Got a link in an email, text or chat that you are not sure about? Paste it below. We follow it in an isolated browser, show you where it really lands, and tell you whether it looks like phishing — before you open it on your own device.
Public http/https only. Private networks blocked. Never enter passwords in the sandbox. How it works
What the phishing check looks at
Phishing links try to get you to a page that looks like your bank, email provider, delivery company or a shop, so you type a password or card number. A single check on confirmURL runs several independent tests on the link:
- Google Safe Browsing – whether Google currently lists the address as phishing (social engineering), malware or unwanted software.
- VirusTotal – how many of 70+ antivirus and URL-security vendors flag the site's domain.
- Redirects – every hop the link takes, so a harmless-looking short link cannot hide its real destination.
- Lookalike domains – addresses that imitate well-known brands with swapped letters, extra words such as “login” or “secure”, or unusual endings.
- Domain age and certificate – a site registered a few days ago, or one with a broken or missing HTTPS certificate, is a common phishing sign.
- Fake login detection – if the page asks for a password, we look at where the form sends it and whether the page borrows another brand's name, logo or title.
How to read the result
The report gives a plain verdict – looks normal, be careful or likely dangerous – with a risk score from 0 to 100 and the reasons behind it. You also get a screenshot of the final page, taken in our sandbox, so you can see what the link shows without loading it yourself.
A red verdict means at least one strong signal was found, such as a Safe Browsing match or a page imitating a brand on a domain that is not theirs. Amber means something is unusual and worth a second look. Green means none of our checks found a problem – it is a good sign, not a guarantee, because brand-new phishing pages can appear before any blocklist knows about them.
Safer habits that beat any checker
Even with a clean result, treat unexpected messages with care. If a message says your account is locked, a parcel is held or a payment failed, do not use the link at all: open the company's official app or type its address yourself. Never enter passwords, one-time codes or card details on a page you reached from a message you did not expect. If you have already typed a password into a suspicious page, change it straight away on the real site and turn on two-factor authentication.
Found a phishing link? Report it so it can be added to the public scam feed and help others spot it.
Frequently asked questions
Is this phishing link checker free?
Yes. Checking a link is free and does not need an account. Fair-use limits apply to keep the service available for everyone.
Does checking a link open it on my device?
No. The link is opened in an isolated headless browser on our server, not in your browser, so the page cannot read your cookies, saved passwords or files.
Can a link be phishing even if the result is green?
Yes. New phishing pages appear every day and may not be on Google Safe Browsing or VirusTotal yet, and our heuristics cannot catch everything. Use the result as one signal and still avoid entering passwords from links you did not expect.
What should I do if I already clicked a phishing link?
Close the page. If you entered a password, change it on the official site and enable two-factor authentication. If you entered card details, contact your bank. Running a malware scan on your device is also a good idea.