Enter a domain or URL to analyse it for phishing indicators: brand impersonation, lookalike patterns and suspicious DNS signals. Free, no sign-up.
The Phishing Site Check uses heuristic analysis of domain name patterns and DNS signals to estimate the likelihood that a domain is used for phishing. Enter a domain or full URL and get an instant score and breakdown of detected signals. Free, no sign-up required.
This tool is for reference only. It does not guarantee that a domain is safe or malicious, and it does not fetch or visit the URL. Use it as an initial triage step for suspicious links you receive.
The verdict is low, medium, or high risk. Score ≥ 60 → high, ≥ 25 → medium, otherwise low.
| Signal | Example | Score |
|---|---|---|
| Official domain used as a subdomain (subdomain fraud) | paypal.com.evil.xyz | +70 |
| Brand name in the domain | paypal-support.com | +60 |
| Character substitution (0→o, 1→l, rn→m…) | paypa1.com | +50 |
| Phishing keywords (login, verify, secure, account…) | amazon-verify-account.com | up to +30 |
| Suspicious TLD (.xyz, .tk, .top, .click…) | amazon.xyz | +20 |
| Three or more hyphens | paypal-login-secure-verify.com | +10 |
| SLD longer than 25 characters | amazon-secure-account-verify-login.com | +10 |
| No MX records | — | +5 |
Disclaimer: This tool provides heuristic analysis for reference purposes only. A "low" result does not guarantee safety. Never open a suspicious link — use this tool only to inform a decision, not to replace caution.
The result is "high". Does that confirm it's a phishing site?
Not necessarily. Heuristic analysis produces false positives. Legitimate services that incorporate a brand name in their domain (e.g. authorised resellers) can score high. Treat the result as a risk indicator, not a verdict. For a definitive check, visit the brand's official website directly or use a service like VirusTotal.
I entered a full URL. What gets analysed?
Only the domain part is extracted and analysed. The path, query string and fragment are ignored.
Does the tool support internationalised domain names (IDN)?
Yes. IDN domains (e.g. containing Japanese or other non-ASCII characters) are automatically IDNA-encoded before analysis.
Our own domain scores "high". What should we do?
If your domain is registered as an official brand domain it is immediately rated low. Otherwise, a high score on your own domain is a useful prompt to strengthen your DMARC, SPF and DKIM configuration — it indicates your domain name contains patterns that attackers often use.