How confirmURL.com works
A plain-language walkthrough of what happens when you confirm a link.
1. You paste a URL
Start with a full https:// link from email, chat, SMS, or a shortened URL you do not trust yet.
2. Safety gates
We block private and internal network targets (for example localhost or cloud metadata addresses) to reduce server-side request risks. Only public http/https destinations are allowed.
3. Isolated browser session
For live checks, we open a headless Chromium-based browser that is not your personal profile. It does not use your passwords or cookies. Sessions are short-lived.
4. You review the result
You can view a screenshot or interact briefly to see redirects, branding, and forms. Never enter real credentials into a page inside the sandbox.
4a. More ways to check
- 二维码扫描器 — decodes the QR code in your browser (camera or photo; the image is never uploaded), then runs the normal safety check on the link. Wi-Fi, text and other non-link codes are shown but not opened.
- 邮件和短信扫描器 — paste a whole message. We extract every link (including defanged ones and links hidden behind HTML text), quick-check each domain without opening it, and flag scam tricks: urgency, requests for logins, codes, payments or gift cards, link text that doesn't match the real destination, and brand names that don't match the link domains. Your message text is processed in memory only and never stored (the links found are recorded in our admin-only check log, see Privacy).
- Side-by-side compare — when a link looks like a lookalike of a known brand, the report shows its screenshot next to the brand's real page (official screenshots are refreshed every 24 hours).
- 浏览器扩展 - check the current tab or right-click any link (Chrome, Edge, Firefox), with optional warning badges on links (off by default).
- 公开 API —
GET /api/v1/check?url=returns the same verdict as JSON. Free keys, rate limited. - 诈骗链接动态 — links reported by visitors are reviewed by a moderator before they're published (link, verdict and date only).
- Install as an app — on phones you can add confirmURL to your home screen and share links straight to it from other apps.
4b. Fake login page detection
When the checked page has a login form, we look for signs that it is a fake sign-in page built to steal passwords:
- password or sign-in forms that submit to a different site, to a hidden
data:address, or to known data-collection services - brand names, logos, titles or favicons (PayPal, Microsoft, Apple, banks and more) on a domain that isn't the brand's own
- obfuscated or encoded scripts on the login page
- a login form on a brand-new domain (registration date from RDAP)
- password fields on pages without HTTPS
Each sign adds to the risk score. When several line up, the report shows a 虚假登录页 warning and a card listing the evidence. Official brand domains (for example accounts.google.com) are recognized and not flagged. The check runs on our server in milliseconds; nothing you type is involved. The browser extension shows the same warning in its popup.
4c. Threat-intelligence sources
Each safety check also uses data from two public reputation services:
- Google Safe Browsing — Google's lists of known malware, phishing (social engineering), unwanted-software and harmful-app URLs. We send the link you entered and where it ended up; the report shows 安全 or 已标记 with the threat type.
- VirusTotal — aggregates verdicts from 70+ antivirus and URL-security vendors. We look up the site's domain and show how many vendors flag it, with a link to the full VirusTotal page.
To stay fast and within free-tier limits, results are cached (VirusTotal for 24 hours per domain, Safe Browsing for 6 hours). If a service is busy, the report says so instead of guessing. We also check domain age (RDAP), the TLS certificate, lookalike/brand-impersonation patterns and fake login pages. confirmURL is independent and not affiliated with or endorsed by Google or VirusTotal; a clean result is not a guarantee.
针对特定检查的免费工具
网址安全检查 · 钓鱼链接检查 · 诈骗链接检查 · 虚假登录页检查 · 还原短链接 · 二维码链接检查
5. You decide
If the final site looks wrong, close it and open the official app or type the brand’s address yourself. If it looks legitimate, still prefer official bookmarks for logins.