Is This Link Phishing? Free Link Checker
Quick answer: the real website is the part just before the first single "/", read from the right. If a brand name like "sbi" or "amazon" is not right there, be careful. Paste a link below to check it.
🔒 The link is checked only inside your browser. We do not open the link, and we do not send or save it.
Important: this is a guide, not a guarantee. A link can pass every check and still be a scam, and a safe link can show a warning. When in doubt, do not click. Open the official app or type the address yourself.
Try an example:
How to read a link
Why
Phishing links copy famous names to steal passwords, OTPs and card numbers. If you can read a link, you can spot most fakes.
What
Every link has a real site name (the domain). It is the last two parts before the first "/" — like amazon.in or hdfcbank.com. Everything on the left is a subdomain. The site owner can type anything there.
How
- Find the first single "/" after "https://".
- Look at the text just before it.
- Read from the right: the last two parts are the real site (three parts for endings like
.co.in). - Ask: is this the brand's real site? If not, stop.
Example, step by step
- Rahul gets an SMS:
https://hdfcbank.com.reward-points.top/claim. - The first "/" comes after
.top. - Read from the right:
reward-points.top. That is the real site. - "hdfcbank.com" is just a subdomain. It is a fake. Rahul deletes the SMS.
What each check means
Why
Each warning sign alone may be harmless. Many signs together usually mean a scam.
What
The checker looks for 9 common tricks.
How
- Lookalike letters / punycode:
аpple.comwith a Russian "а" shows up asxn--pple-43d.com. - IP address host:
http://185.62.10.7/login— real brands use names. - "@" in the link:
https://google.com@evil.sitereally goes to evil.site. - Many subdomains:
login.sbi.co.in.verify.example.tophides the real site at the end. - http, not https: data is sent in plain text.
- URL shorteners: bit.ly, tinyurl and others hide the real destination.
- Risky endings: .xyz, .top, .zip, .click and others are popular with scammers (many honest sites use them too).
- Brand in the wrong domain: "paypal" or "irctc" in a link that is not paypal.com or irctc.co.in.
- Bait words: kyc, verify, reward, refund, login in the site name.
Example, step by step
- Emma gets an email: "Your Netflix payment failed".
- The link is
https://netflix-billing-update.click. - Checks: brand in the wrong domain, risky ending ".click", bait word "update".
- Result: high risk. Emma opens the Netflix app directly instead. Her account is fine.
Ravindra Bagale's Tip
Never act on the link inside an SMS, WhatsApp or email that asks for KYC, OTP, refund or "account blocked". Close it, open the official app or type the address yourself. A real bank will never ask for your OTP or PIN.
Ravindra Bagale's Tip – मराठी
SMS, WhatsApp किंवा email मधल्या KYC, OTP, refund किंवा "account blocked" link वर कधीच action घेऊ नका. तो बंद करा, official app उघडा किंवा address स्वतः type करा. खरी bank तुमचा OTP किंवा PIN कधीच मागत नाही.
Ravindra Bagale's Tip – हिंदी
SMS, WhatsApp या email के KYC, OTP, refund या "account blocked" link पर कभी action न लें. उसे बंद करें, official app खोलें या address खुद type करें. असली bank आपका OTP या PIN कभी नहीं मांगता.
Phishing checklist (before you click)
Why
A tool cannot see the message around the link. Your own checks catch tricks the tool misses.
What
Ask these 8 questions. If any answer is a worry, do not click.
How
- Do I know the sender, and was I expecting this message?
- Does the message rush me ("within 24 hours", "account blocked")?
- Does it ask for OTP, PIN, password, card or Aadhaar details? (Real companies never ask this by link.)
- Is the real site name (read from the right) the brand's official site?
- Does it use https and the correct spelling?
- Is it a shortened link I cannot see?
- On a phone, did I long-press the link to preview it instead of tapping?
- Can I go to the official app or type the address myself instead?
Example, step by step
- Arjun gets a WhatsApp: "Your electricity will be cut tonight. Pay here: bit.ly/…".
- Question 2: it rushes him. Question 6: it is a shortened link.
- He opens the official MSEDCL app instead.
- The bill is already paid. The message was a scam.
If you already clicked
Why
Fast action limits the damage. Minutes matter when a password or OTP was typed.
What
Act in this order: change passwords, call your bank, report it.
How
- Close the page. Do not type anything more.
- If you typed a password, change it now on the real site, and on any site where you used the same one.
- If you shared card, UPI or OTP details, call your bank at once and block the card.
- In India, call the cybercrime helpline 1930 or report at cybercrime.gov.in. Elsewhere, contact your local police cyber unit.
- Turn on 2-step login for your email and bank.
Example, step by step
- Meera typed her email password on a fake login page.
- She changed it within 5 minutes and turned on 2-step login.
- She checked "recent activity" in her email settings.
- No one else had logged in. The quick change stopped the attack.
Frequently asked questions
Is this phishing link checker 100% accurate?
No. It is a guide, not a guarantee. It checks common tricks in the link text only. It does not visit the site. A new scam can pass every check.
Does the checker open the link?
No. It only reads the text you paste, inside your browser. Nothing is sent or saved.
Is a link with https always safe?
No. https only means the connection is encrypted. Scammers can get https for fake sites easily and for free.
What is punycode?
Punycode is how web addresses with non-English letters are written, starting with "xn--". Attackers use it to make lookalike names such as аpple.com with a Cyrillic letter.
Where do I report a phishing link in India?
Call 1930 or report at cybercrime.gov.in. You can also forward scam SMS to your mobile operator and report the sender on the Sanchar Saathi Chakshu portal.