Suspicious link checker
Shows which domain a link really leads to and flags common scam tricks: brand names on someone else’s domain, lookalike letters, hidden addresses, link shorteners and bare IP addresses.
How to use it
- Don’t open the link. In the text or email, long-press it (on a computer, right-click it) and choose Copy link address.
- Paste it into the box and click Check link.
- Look at Where the link really goes. Only this domain matters – not what appears at the start of the address or in the message.
- If the tool reports a risk or you don’t recognise the domain, don’t open the link. Go to your bank’s or courier’s website yourself, or use their official app.
How it works
Scam texts and emails (“pay a small fee to redeliver your parcel”, “your account has been suspended”, “a buyer has sent you money”) rely on one trick: the link looks like the address of a company you know, but it goes somewhere else. This tool reads the address the same way your browser does and shows you where it really leads.
How to read a web address
Only the domain matters – the part between “https://” and the next slash, and specifically the end of it. In the address https://www.paypal.com.account-check.example.com/login, the real domain is example.com. The www.paypal.com. at the start is just a subdomain, which the owner of example.com can name however they like.
What the tool flags
- A brand name on someone else’s domain – for example
paypal-secure-login.topordhl-redelivery.info. - Lookalike letters – a zero instead of the letter o, “rn” instead of “m”, or Cyrillic letters that look identical to Latin ones. International characters in domain names are technically written as Punycode (
xn--…); the tool shows both forms. - Misleading text before an @ sign – in
https://www.paypal.com@scam.example/, the browser ignores everything before the @ and goes toscam.example. - A numeric IP address instead of a site name, including unusual formats that the browser converts into an IP address.
- Shortened links (bit.ly, tinyurl.com and similar), where you only see the destination after opening them.
- Free hosting platforms (web.app, github.io, netlify.app…), where anyone can set up a page.
- Redirects – another address hidden in the link’s parameters.
- An unencrypted connection (http) and an unusual port.
The padlock and “https” at the start of the address don’t mean a site is honest. Scammers can get an encrypted connection for free too.
FAQ
Does the tool open the link or send it anywhere?
No. The address is broken down in your browser using the rules described below. The page never connects to the link and sends nothing, so the scammer can’t tell you’ve looked at it.
The tool found nothing suspicious. Is the link safe?
The tool can’t guarantee that. A scam site can sit on a brand-new, perfectly ordinary domain that no rule will catch. Ask yourself: Do I know this domain? Was I expecting this message? Is it asking for a password, a code or card details? If in doubt, don’t open it.
Why doesn’t the tool check a list of known scam sites?
Those lists live on other people’s servers, and querying them would mean sending your link to a third party. Instead, the tool shows you the tricks scammers use again and again.
I’ve already clicked the link and entered my details. What now?
If you entered card details or your online banking login, call your bank straight away on the number from its official website or the back of your card. Change the password everywhere you’ve used it and turn on two-step verification. Then report the scam to the police or your national fraud reporting service.
How do you know which domains brands use?
The tool has its own short list of brands that scammers often impersonate, together with the domains they use. It covers global brands such as PayPal, Netflix, Apple, Microsoft, DHL and DPD, and banks, couriers and marketplaces in the Czech Republic and Slovakia, where Kyberkit is based. The list isn’t complete, and a brand may have other official domains, so a warning means “check this”, not automatically “scam”. Tricks that don’t depend on a brand – lookalike letters, hidden addresses, IP addresses, shorteners and free hosting – are detected for any link.
Sources
Updated