How to check if a link is safe
- Paste the link you were sent.
- Read the highlighted site name and each warning sign.
- Select Check where it leads to follow the redirects and test the certificate.
Examples
https://paypal.com.secure-login.xyz/verify goes to secure-login.xyz. PayPal is only named in front of it, the .xyz ending is often seen in scam reports, and the name holds the words secure and login, so it gets a danger warning.
https://www.sbi.co.in@sbi-kyc-update.in/login goes to sbi-kyc-update.in, because browsers ignore everything before the @. That name contains SBI and the word KYC, but it isn't an address the bank uses.
http://3232235777/ is the address 192.168.1.1 written as one large number. Browsers still open it, so a disguised number address is marked as a danger.
https://аpple.com/ starts with a Cyrillic letter that looks like the Latin a. The browser really sends xn--pple-43d.com, and the tool shows that the name mixes two alphabets.
About this tool
Before you tap a link from a message, see what the address really says. The tool highlights the part that is the real website, then checks for tricks such as look-alike letters, a famous name placed in front of another site, number addresses, short links and pressure words like verify or KYC. An optional check on this site's server follows the redirects to see where the link ends and whether its certificate is valid.
Common questions
Does no warning mean the link is safe?
No. A new scam site can have a clean address and a valid certificate. Treat the checks as a reason to slow down. When a message asks for a password, an OTP or a payment, open the company's app or type its address yourself.
What does Check where it leads do?
This site's server opens the link and follows each redirect one step at a time, without running the page's scripts, then checks the final site's certificate. Private and local addresses are never opened.
Why isn't the padlock enough?
https only means the connection is encrypted. Anyone can get a free certificate for a domain they own, including people running scam sites.
Which company names does it know?
Banks, payment apps, couriers, government services and large websites that scams often copy, such as SBI, HDFC, Paytm, India Post, Amazon and Google. A link that copies a name not on the list isn't matched to it.
Where can I report a scam link?
In India, report it on the National Cyber Crime Reporting Portal at cybercrime.gov.in. If money has been taken, call the cyber fraud helpline 1930 as soon as you can.
Is it free to use?
Yes. There's no sign-up, and you can use it as often as you like.
Do I need to install anything?
No. It works in your browser on a computer or a phone.
Is what I enter kept?
It's only used to get your result. Some public answers, such as the branches for a pincode, are kept for a while so the next lookup is quicker, but nothing links them to you.