How does the tool help you spot phishing links?
Scam messages by SMS, WhatsApp or email (“your parcel is held, pay a small fee”, “your bank account is suspended, update your details”) rely on a link that looks like an official site. This tool analyses the link text without opening it, shows you the real domain it leads to, and explains every suspicious sign in plain words.
How to use it
- Copy the link from the message without tapping it (long-press, then “Copy link”).
- Paste it into the box: the result appears instantly.
- Look first at “Real domain”: is it really the website of the organisation the message claims to be from?
- Read the notes; if you see “High risk”, delete the message.
Golden rule: read the domain from the end
In a link like cihbank.ma.account-update.xyz you might think it is the bank because its name comes first, but the real domain is the last two parts: account-update.xyz. A scammer can write anything before them. The tool highlights that part for you.
What does the tool check?
- Missing HTTPS, and IP addresses instead of domain names.
- Names of well-known organisations (banks, postal and delivery services, platforms) on a domain they don’t own, or imitated with digits like
paypa1. - Look-alike letters from other alphabets, and Punycode.
- Link shorteners, extensions common in spam, many sub-domains and hyphens.
- An @ sign inside the link, and links to executable files.
Limits
The tool doesn’t query blacklists or visit the site, so a carefully crafted new scam link may pass without a warning. The key rule: only enter card details or verification codes on a site you opened yourself, by typing its address or via the official app — never from a link received in a message. If a suspicious text contains hidden symbols, try the invisible characters detector.