Phishing and Malware URL Checker
Paste any URL and instantly check if it is safe, suspicious, or malicious. Get detailed threat analysis, safety scores, and reputation data powered by our 120 million domain database.
Check a URL
Enter a complete URL including the protocol. Example: https://www.google.com/path?query=value
Free lookups use a demo slice of the database. Licensed customers get the full data.
Want URL verdicts like this inside your own security product?
The checker above reads a small demo slice, while the licensed file holds more than 120 million categorized domains. Firewall and email security vendors run that file in their own systems and refresh it with daily delta files.
Sample Safety Report
Here is an example of the detailed safety analysis returned when you check a URL.
category level
No malware, phishing, gambling or adult tags found in this domain's classification.
Content Categories
Country
Source
What We Check For
Every URL is analyzed across multiple threat dimensions to provide a comprehensive safety assessment.
Malware Categories
Checked against the malware and other security categories in our database.
CleanPhishing Analysis
Checked for phishing indicators including spoofed domains, deceptive content, and credential harvesting.
No phishing signsSSL Certificate
Validates the SSL/TLS certificate chain, expiration dates, and issuer trustworthiness.
Valid SSLPrivacy Tracking
Detects excessive tracking cookies, fingerprinting scripts, and invasive data collection.
Trackers FoundCategory Coverage
Cross-references URL against 58 content filtering categories spanning business, technology, social media, and more. Schools and libraries can check whether a domain falls into a category their CIPA policy blocks and ensure CIPA compliance with auditable category-level filtering.
CategorizedThreat Categories
Flags phishing, malware, spam and other threat categories so you can see at a glance whether a link belongs on a block list.
CheckedHow to spot a phishing domain
Most phishing links fail a careful look at the domain name itself. Read the address from right to left: the part just before the first single slash is who you are really talking to.
Near-miss spelling
One letter swapped, doubled or dropped. A digit 1 for a letter l, or rn for m.
Extra words
A real brand plus "secure", "login", "verify" or "support", joined with hyphens.
Brand in a subdomain
The brand appears on the left, but the real domain sits further right and belongs to someone else.
Look-alike characters
Letters from other alphabets that look identical on screen. The browser may show the encoded form starting with xn--.
Very new domain
Phishing domains are usually days old. A bank or retailer you have used for years does not move to a brand new domain.
Hidden destination
Short links and redirect chains hide where you will land. Expand them before you trust them.
Login page on a file host
A sign-in form served from a file sharing or cloud storage address is a classic trick.
Urgent wording
"Account suspended", "payment failed", "verify within 24 hours". Pressure is the attacker's main tool.
Common phishing patterns, with placeholder examples
The examples below use made-up names on reserved example domains, so none of them is a live site. "yourbank" stands for any brand an attacker might copy.
| Pattern | Placeholder example | The tell |
|---|---|---|
| Typo domain | yourbannk.example | Doubled letter that the eye skips over |
| Digit swap | y0urbank.example | Zero in place of the letter o |
| Brand plus keyword | yourbank-secure-login.example | Real brands rarely put "secure login" in the domain |
| Subdomain trick | yourbank.com.account-check.example | The real domain is account-check.example, not yourbank.com |
| Path disguise | files.example/yourbank/login.html | The brand is only in the path, on a file host |
| Look-alike letters | yourbаnk.example (with a Cyrillic а) | Looks identical; encoded form begins with xn-- |
| Shortened link | short.example/x7Kp2 | Destination unknown until expanded |
| Free site builder | yourbank-help.sitebuilder.example | A brand page on a free hosting subdomain, built in minutes |
| Parked, then armed | yourbank-rewards.example | Sat parked for weeks, then turned into a login page |
Never test a suspicious link by clicking it on your work device. Paste the address into the checker above instead, or forward the message to your security team.
Where phishing links arrive
Email is still the main route, but attackers follow people wherever they read links. The domain checks are the same in every channel.
Fake invoices, delivery notices, password expiry warnings and shared document alerts.
Text messages
Parcel fees, toll charges and bank alerts with a short link. Small screens hide the full address.
QR codes
Stickers on parking meters, posters and printed letters. Check the address your camera shows before opening it.
Chat and social apps
Messages from hacked contacts, fake support accounts and giveaway posts.
Search ads
Paid results that copy a brand and point to a look-alike domain, often for software downloads.
Attachments
Links inside PDFs and office files, which some mail filters inspect less closely.
The short life of a phishing domain
Phishing domains are disposable. Knowing their typical life helps explain why category freshness matters so much for protection.
Before the attack
- A look-alike domain is registered, sometimes weeks ahead.
- It may sit parked or show a harmless page to avoid early detection.
During the campaign
- A login page or download appears, often for only hours or days.
- Messages go out in waves to as many targets as possible.
After it is spotted
- The page is taken down or the domain abandoned.
- The attacker moves to the next new domain and starts again.
This cycle is why new domains are categorized on day one and checked again after a week and a month: a harmless parked page can change into a phishing page at any time.
What the URL checker looks at
The checker strips the path and query and looks up the domain in our category data. What you see is the output of that lookup, in plain terms.
Category
Which of our 58 web filtering categories the domain carries. The one that matters most here is Malware / Phishing / Suspicious.
- Other risk signals: Parked / For-Sale Domains, URL Shorteners, VPN / Proxy / Anonymizers
- Several ranked categories can appear for one domain
- Categories describe the whole site, not one page
Newly registered status
About 300,000 newly registered domains are categorized every day, so even very young domains usually have a category.
- New domains are checked again after a week and after a month
- Licensed products receive new domains as daily delta files
- Many security teams treat any very new domain with extra caution
What to do after a positive result
If the checker flags a link, or your instinct does, act in this order. Speed matters most when credentials may already be exposed.
You only received the link
- Do not click it again or reply to the sender.
- Report the message to your IT or security team, using the report button in your email client if you have one.
- Delete it after reporting.
- Warn colleagues if it arrived in a shared mailbox or group chat.
You clicked or typed a password
- Change that password now, from a device you trust, by typing the real address yourself.
- Change it anywhere else you reused it.
- Turn on multi-factor authentication if it was not on.
- Tell IT at once so they can review sign-ins and sessions.
- If card or bank details were entered, call your bank using the number on your card.
You run the network
- Block the domain in your DNS filter, proxy or firewall.
- Search logs for other users who visited it.
- Check endpoints of those users for downloads.
- Make sure your filter blocks the whole Malware / Phishing / Suspicious category, not only single sites.
Many countries run a national service for reporting phishing. Check which one applies to you and forward suspicious messages there as well.
From one-off checks to automatic protection
A checker answers one question at a time. Filters, email gateways and browsers need the same answer for every link, in milliseconds, without asking anyone.
Phishing and malware feed
Security vendors take the risk categories as a daily feed. Read about the phishing and malware domain feed.
Check a list of domains
Paste many domains at once with the bulk categorization tool.
See every category
For the full category view of a site, use the web filter lookup.
Plug into security tools
Combine categories with alerts in your SIEM. See threat intelligence integration.
A 30-second phishing check before you click
Did you expect this message, from this sender, today?
Hover or long-press the link. Does the real domain match the brand exactly?
Read the domain right to left. Is the brand in the last part, or only on the left?
Is it asking for a password, a code, a payment or a download?
Paste it into the checker. Any risk category means stop.
Still unsure? Open the brand's site by typing its address yourself and sign in there.
Background on the risk categories themselves: phishing category and malware category.
URL checker FAQ
Does a clean result mean a link is safe?
No single check can promise that. A clean result means the domain carries no risk category in our data. Always check the spelling and the context of the message too.
Why does the checker ignore the rest of my URL?
Categories are assigned per domain. The path and query string are removed before the lookup, so a result describes the whole site.
The result says "Not in the free demo slice". What now?
The free tool searches a demo slice of the full database. Treat an unknown result as unknown, and lean towards caution if the link arrived unexpectedly.
Can a safe site turn into a phishing site?
Yes. Domains get compromised, expire or change hands. That is why new domains are rechecked after a week and a month, and all domains are refreshed monthly.
Can I use this checker inside my product?
Not the free tool. Vendors license the database and the included lookup API for internal use or OEM embedding.
How can IT stop look-alike domains before users see them?
Block the Malware / Phishing / Suspicious category in your filter and apply extra caution to very new domains. Licensed products receive newly registered domains every day, so new look-alikes can be handled early.
Is it safe to paste a phishing link here?
Yes. The checker looks up the domain in our data and does not open the site in your browser.
Build phishing protection into your product
License the category database with daily newly registered domain files and a lookup API. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
URL Checker Features
The most comprehensive URL safety analysis tool available, combining multiple data sources for accurate results.
Instant Results
Get safety analysis in under 500 milliseconds. Our pre-computed database means you do not have to wait for a live scan to complete.
Multi-Layer Analysis
Combines content categorization, WHOIS data, SSL analysis, and geographic data for complete domain coverage.
API Integration
Check URLs programmatically from your application. Perfect for email gateways, browsers, and chat platforms that need real-time link checking.
Full URL Support
Analyzes the complete URL including path, query parameters, and fragments. Not just the domain, but the specific page you are visiting.
Historical Analysis
View how a domain's classification has changed over time. Track category changes and content evolution across our database.
Continuously Updated
Our domain database is updated continuously with new classifications, category changes, and newly registered domains worldwide.
Protect Your Users from Unsafe URLs
Integrate our URL safety API into your email gateway, browser extension, or chat platform. Real-time protection at scale.