Is this link safe?
Paste a link you do not trust and this tool lists the warning signs in how it is written: a name that imitates a brand, an @ sign hiding the real destination, look-alike letters, a shortener, a raw IP number. It is a set of in-browser checks. It is not a reputation lookup or a URL scanner: it never opens the link, never sends it anywhere and knows nothing about whether the site has been reported. A clean result does not mean a link is safe.
This runs in your browser. The link is never opened, sent, or looked up anywhere.
What this checks, and what it cannot
It looks at: the scheme (HTTP or HTTPS), text before an @ sign, raw or disguised IP numbers, punycode and mixed alphabets, a short list of common brand names for look-alikes and subdomain tricks, link shorteners, an unusual port, many subdomain levels, account-style words, a web address hidden in a parameter, links to program files, and pressure wording in message text you add.
It cannot see: whether the site is on a blocklist, how old the domain is, who owns it, what the page does, or where a shortened link leads. The brand list is short and hand-picked, and the registrable-domain logic is approximate for rarer endings. For reputation data use the reputation checker; for domain age use WHOIS lookup.
If a message pressures you to act, treat the pressure as the warning sign and read the examples in phishing attack types. Practise on Pick the Phish.
Questions people ask
Is this link safe to click?
This tool cannot tell you that. It reads how the link is written and flags patterns scammers use: a name that imitates a brand, an @ sign that hides the real destination, a raw IP number, encoded letters, a shortener or an unusual ending. A link that passes is not proven safe, because a new scam site with a plain-looking name shows no warning signs in its text.
Is this a website reputation checker or URL scanner?
No. It does not look the link up in any blocklist, scan the page, check how old the domain is, or visit the site. Nothing you paste is sent anywhere: the checks run as code in your browser. For a reputation lookup you need a service that keeps its own data, such as the ones in our reputation checker.
How can I tell if a website is legit?
Check the real domain, which is the last two parts of the name before the first single slash (in "login.example.com.evil.net/x" it is evil.net). Type the company’s known address yourself instead of following a message. Be suspicious of urgency, unexpected payment requests and pages that ask for a password after you arrived from a message.
What is a homograph or punycode attack?
Some letters in other alphabets look the same as Latin letters, so "аpple.com" with a Cyrillic "a" is a different name from "apple.com". Browsers store such names as punycode starting with "xn--". This tool flags any name that mixes alphabets or uses encoded characters.
What does the @ sign in a link do?
Text before an @ in the address is treated as a username, and the real destination comes after it. "https://paypal.com@evil.example/login" goes to evil.example. Scammers use it so a familiar name appears first.
Are shortened links dangerous?
Not by themselves, but they hide where you are going. Ask for the full address, or use a preview feature from the shortening service that does not load the target.
What should I do if I already clicked?
Do not enter anything. If you did enter a password, change it at the real site and anywhere you reused it, turn on multifactor authentication, and tell your IT or security team if it was a work account.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.