Phishing Link Scanner

You receive a text message claiming your package could not be delivered. An email says your bank account has been locked. A message on social media offers you an exclusive deal. They all have one thing in common: a link they want you to click. Some of these links are legitimate. Many are not. Phishing links are the primary delivery mechanism for credential theft, financial fraud, and malware distribution, and they arrive through every communication channel you use.

The phishing link scanner above lets you check any suspicious link before clicking it, giving you a clear picture of whether it has been flagged as dangerous by the world's leading threat intelligence sources.

Where Do Dangerous Links Come From?

Phishing links are not limited to email. Attackers distribute them across every platform where people communicate:

• Email -- Still the most common delivery method. Attackers impersonate banks, e-commerce platforms, and employers with urgent messages ("Your account will be suspended"). The APWG reports that email phishing continues to set new records each year.
• SMS (smishing) -- Fake delivery notifications, bank fraud alerts, and toll payment demands. Phone screens show less of the URL, making fakes harder to spot.
• Social media and messaging apps -- Phishing links spread through Instagram DMs, Facebook Messenger, Telegram, WhatsApp, and Discord. Telegram scams are particularly widespread, with fake bots and impersonation of crypto project staff.
• QR codes -- Malicious QR codes placed over legitimate ones in parking meters, restaurants, and public spaces redirect you to phishing sites.
• Search engine ads -- Attackers purchase sponsored results that appear above legitimate websites, linking to phishing clones of popular services.

What the Phishing Link Scanner Checks

When you paste a link into the scanner, it runs multiple checks in parallel:

• Browser Threat Intelligence -- Checks the URL against real-time indexes of known phishing, malware, and social engineering sites.
• VirusTotal (70+ engines) -- Scans the URL simultaneously against more than 70 antivirus and security engines.
• PhishTank -- Queries the community-verified phishing database, one of the oldest and most established collaborative phishing feeds.
• ScammerDetect database -- Cross-references the domain against our database of over 31,000 known scam and phishing domains, built from automated scanning, user reports, and threat intelligence feeds.
• Domain intelligence analysis -- Examines the domain's WHOIS registration, age, TLS certificate, and DNS configuration for fraud signals.

The scanner produces a risk score from 0 to 100. High scores mean the link matches known phishing patterns or has been reported by multiple sources. Low scores mean no flags were found -- but this does not guarantee safety for brand-new phishing links.

How to Protect Yourself Before Clicking Any Link

Build these habits into your daily routine to catch phishing links even without a scanner:

1. Hover before you click. On desktop, hover over any link to see the real destination URL in the bottom-left corner of your browser. If it does not match what the link text says, do not click.
2. Go directly to websites. If an email or text says there is a problem with your account, do not use the link provided. Open your browser and type the company's URL yourself, or use their official app.
3. Inspect shortened URLs. Links using bit.ly, tinyurl, or other shorteners hide the real destination. Use a URL expander to reveal it before clicking.
4. Be skeptical of urgency. Messages that pressure you to act immediately ("within 24 hours," "account will be locked") are using a classic social engineering tactic. Legitimate organizations give you time to respond.
5. Verify the sender independently. If a message claims to be from someone you know, contact them through a separate channel to confirm they actually sent it.

The FTC recommends reporting phishing attempts to help law enforcement track and shut down operations. You can also forward suspicious emails to reportphishing@apwg.org and report phishing URLs to Google Safe Browsing. The FBI IC3 accepts reports of internet-enabled crimes including phishing.

Related Resources