Free phishing URL checker — 5-signal risk engine, live redirect trace, URI blacklist cross-check, and AI verdict for any link.

Most phishing checkers stop at a single blacklist hit. This tool combines a heuristic engine (10+ URL patterns), a brand-impersonation matcher (51 tracked brands, Levenshtein-1 typosquat), WHOIS domain-age intelligence, a live HTTP behaviour trace, and three URI blacklists — then hands the whole picture to Gemini for a plain-English verdict.

The engine groups checks into five buckets so a strong signal in one area can't be masked by silence in another. Signals are ranked by severity (critical / warning / info) and every one contributes weighted points to the total.

• URL / host structure IP-literal host, credentials-in-URL (`@` trick), punycode / IDN hostname, hyphen-spam, subdomain-depth, URL length, high-abuse TLD (`.zip`, `.top`, `.xyz`, `.tk` and 36 more), URL shorteners, sensitive path keywords (`login`, `verify`, `secure`, `account`, `webscr`), plain-HTTP scheme.
• Brand impersonation Two independent checks: (1) brand-name label present in a subdomain but not the registered SLD (`paypal.com.attacker.com`), and (2) Levenshtein-1 typosquat against the 51-brand list with length-similarity guard. Both fire critical.
• Brand-in-SLD embedding Real brand token embedded at the start of the SLD or after a hyphen — `appleid-verify-secure`, `paypal-login-secure`, `microsoft2fa-support`. Length guard prevents false positives on unrelated words that merely contain a short brand substring.
• Domain intelligence (WHOIS / RDAP) Age in days with graduated risk bands (< 7d critical, < 30d critical, < 90d warning, < 180d info), registrar name, WHOIS privacy shielding, creation and expiry dates, nameservers. Privacy on a young domain is treated as a soft signal, not decisive.
• DNS presence A record present, MX record present, NS records enumerated. Missing MX on a brand-like domain is a warning — real corporate brands publish MX. Missing A means the site isn't currently resolving.
• SSL / TLS posture Live TLS handshake to port 443. Presence of a valid cert, issuer organisation, days until expiry. Expired cert is critical. No SSL is a strong warning — real payment / login pages have valid HTTPS in 2026.
• Live HTTP behaviour Follows up to 6 redirects, records the chain, extracts page title + content-type + meta-refresh target + password-field presence from the first 64 KB of HTML. Cross-SLD redirect (final host has a different registered domain than the input) is a critical signal.
• URI blacklists (DNSBL) Reversed-domain queries against Spamhaus DBL, SURBL multi, URIBL Black in parallel. Positive responses (127.0.0.x where x >= 2) count as listed; the loopback fallback (127.0.0.1) and Spamhaus diagnostic (127.255.255.254) are correctly ignored.

Five buckets, weighted points per signal, capped at 100. Any single strong signal (blacklist hit, brand impersonation, IP host, credentials-in-URL) can carry the score. Verdict thresholds are deterministic — you get the same verdict for the same signals every time.

• URL / host structure (up to ~25 pts) IP host +18 · credentials-in-URL +14 · punycode +10 · hyphen-spam +4 to +8 · deep subdomains +3 to +6 · very long URL +6 · risky TLD +5 · sensitive path keywords +5 · plain HTTP +4 · URL shortener +4 (informational).
• Brand impersonation (up to ~30 pts) Brand-name in subdomain +18 · Levenshtein-1 typosquat +14 · brand-in-SLD embedding +15. Any brand impersonation signal fires critical.
• Domain intel (up to ~25 pts) Age < 7d +22 · < 30d +15 · < 90d +9 · < 180d +4 · missing A record +4 · missing MX on brand-like domain +5 · no SSL +8 · expired SSL +8 · WHOIS privacy on a young domain +3.
• Live behaviour (up to ~25 pts) Cross-domain redirect +10 · > 5 redirects +5 · meta refresh +5 · password field on newly-flagged domain +6.
• URI blacklists (up to 35 pts, decisive) Any single blacklist hit contributes +20, additional hits add +8 each, capped at 35. One hit alone pushes the verdict to Likely Phishing under the deterministic AI threshold.
• Verdict thresholds 0-19 = Safe (A) · 20-39 = Low Risk (B/C) · 40-64 = Suspicious (D) · 65-100 = Likely Phishing (F). The AI prompt uses the same thresholds so its verdict never disagrees with the score.

Phishing has evolved from typo-ridden emails into pixel-perfect clones on look-alike domains. The exact same handful of tricks power the majority of successful credential harvest — this tool codifies each one.

• Young domain + payment brand + valid SSL. The modern phish stack: registrar-privacy WHOIS, Let's Encrypt cert (free, 90-day), brand-plus-suffix domain (`paypal-secure-signin.com`), Cloudflare in front. SSL padlock alone is not a trust signal — this tool weighs it against the age of the domain and its blacklist status.
• Brand-name-in-subdomain trick. `paypal.com.attacker.com` reads left-to-right as `paypal.com` for anyone who isn't paying attention. The registered domain is `attacker.com` — everything before it is a subdomain the attacker owns. Flagged critical, always.
• Cross-domain redirect from a look-alike host. The link shows `apple-id-verify.top` in the anchor text. First click hits that host, which 302-redirects to `credential-harvest.top/login`. The bait host is disposable — the harvest host lives longer. We follow the chain and flag any cross-SLD hop.
• Password field on a domain <30 days old. The single strongest combined signal in the engine. A fresh domain asking for a password on the fetched HTML matches every credential-harvest kit sold on Telegram in 2026. AI verdict escalates to `phishing` even at moderate scores when this pair fires.
• URI blacklist hit. Spamhaus DBL, SURBL, and URIBL are the same lists Gmail, Cloudflare, and browsers cross-check for their own blocking decisions. A single hit is takedown-grade evidence — this tool cross-checks all three in parallel on every scan.

Every signal bucket runs in parallel — total wall-clock time is dominated by the slowest bucket, not the sum. Median scan wraps in under 1 second.

• Stage 1 — URL normalisation Bare domains get a scheme prepended so `new URL()` parses correctly. `psl.parse()` extracts the registered SLD from the host (eTLD+1 detection handles multi-part TLDs like `.co.uk`).
• Stage 2 — Static heuristics (< 1 ms) URL structure and brand-impersonation checks run synchronously on the parsed URL. No network. All 10+ URL patterns and the 51-brand impersonation matcher complete in sub-millisecond time.
• Stage 3 — Parallel network fanout Domain intel (WHOIS/RDAP), DNS lookup (A/MX/NS), SSL handshake, live HTTP fetch, and three DNSBL queries all launch simultaneously. Each has its own timeout — a slow WHOIS doesn't hold up the SSL or blacklist result.
• Stage 4 — Signal aggregation + verdict Weighted points summed, capped at 100. Signals sorted by severity (critical → warning → info). Verdict picked from deterministic thresholds. Grade letter derived from the same thresholds.
• Stage 5 — AI diagnosis (async, non-blocking) The full report is enqueued for Gemini analysis. First response returns immediately with `AiAnalysisMeta:{id, avgMs, etaMs}` — the browser polls a lightweight status endpoint until the AI verdict is ready. Cached responses come back inline on subsequent scans.
• Stage 6 — Cache lifecycle AI response cached for 7 days keyed on the input URL hash. Adding `?refresh=1` bypasses the cache and re-runs the AI. WHOIS data is cached at the tier-based intervals shared with the rest of the platform.

URI blacklists are DNS-based reputation feeds. You query `<reversed-domain>.<zone>` — a positive response (a 127.0.0.x address) means the domain is on the list. Different zones use different response codes to indicate the reason.

• Spamhaus DBL (dbl.spamhaus.org) The Spamhaus Domain Block List — the most authoritative single-source URI blacklist. Response codes 127.0.1.2 (spam), 127.0.1.4 (phish), 127.0.1.5 (malware), 127.0.1.6 (botnet CC). Used by Gmail, Outlook, and every major mail provider.
• SURBL multi (multi.surbl.org) Bitmask response codes at 127.0.0.x where x indicates which sub-list matched (2 = phish, 4 = malware, 8 = spam, 64 = jwSpamSpy list). Free tier serves anycast; commercial tier serves faster.
• URIBL Black (black.uribl.com) Three response codes: 127.0.0.2 = black (confirmed spam/phish), 127.0.0.4 = grey (unconfirmed but likely), 127.0.0.8 = red (formerly-listed, still risky). We treat any positive response as listed.
• Response-code interpretation Positive-response semantics vary by zone. Our engine treats any 127.0.0.x address where the last octet is >= 2 as a real listing. 127.0.0.1 (used by some open-resolver fallbacks) and 127.255.255.254 (Spamhaus explicit diagnostic) are correctly excluded.

Every field on this page is available as JSON. Useful for SOC playbooks, email-gateway pre-filtering, browser-extension backends, brand-monitoring cron jobs, and incident response.

const res = await fetch(
  'https://api.domainscan.in/v1/security/phishing?url=' +
  encodeURIComponent('https://paypal-secure-signin.top/login')
);
const {data: report} = await res.json();

console.log(report.verdict.code);       // 'phishing'
console.log(report.verdict.grade);      // 'F'
console.log(report.riskScore);          // 78
console.log(report.breakdown);          // { url_structure, brand_impersonation, ... }
console.log(report.counts);             // { critical: 3, warning: 2, info: 1 }
console.log(report.brand.impersonated); // ['paypal']
console.log(report.domainIntel.ageDays);// 4
console.log(report.blacklists);         // [ { name, listed, addresses }, ... ]

// Route on verdict
if (report.verdict.code === 'phishing' || report.verdict.code === 'suspicious') {
  // block or warn
}

{
  "found": true,
  "input": "paypal-secure-signin.top/login",
  "url": "http://paypal-secure-signin.top/login",
  "host": "paypal-secure-signin.top",
  "sld": "paypal-secure-signin.top",
  "checkedAt": "2026-08-26T…",
  "durationMs": 812,
  "riskScore": 78,
  "verdict": { "code": "phishing", "label": "Likely Phishing", "grade": "F", "summary": "…" },
  "breakdown": { "url_structure": 12, "brand_impersonation": 15, "domain_intel": 22, "live_behavior": 4, "blacklists": 25 },
  "counts": { "critical": 3, "warning": 2, "info": 1 },
  "signals": [ { "id": "brand_in_sld", "severity": "critical", "label": "…", "detail": "…" } ],
  "brand": { "impersonated": ["paypal"], "isKnownBrand": false },
  "domainIntel": { "ageDays": 4, "registrar": "…", "whoisPrivacy": true, "sslValid": true, "sslIssuer": "Let's Encrypt", "hasA": true, "hasMx": false, "ns": ["…"], "creationDate": "ISO", "expiryDate": "ISO" },
  "liveResponse": { "reachable": true, "redirectChain": [ { "url": "…", "status": 200 } ], "finalUrl": "…", "finalHost": "…", "contentType": "text/html", "title": "…", "metaRefresh": null, "hasPasswordField": true, "crossDomainRedirect": false },
  "blacklists": [ { "name": "Spamhaus DBL", "zone": "dbl.spamhaus.org", "listed": true, "addresses": ["127.0.1.4"] } ],
  "AiAnalysis": { "verdict": "phishing", "summary": "…", "red_flags": [], "safe_signals": [], "recommendations": [], "who_should_worry": "…" }
}

• What is a phishing link? A URL that looks legitimate but is engineered to steal credentials, payment info, or session tokens. Phishing links usually combine a look-alike domain (typosquat, brand-in-subdomain, brand-plus-suffix) with a landing page that mimics a login form or a payment page. The goal is to collect what you type before you notice the URL is wrong.
• How does this tool decide a URL is phishing? It scores five independent signal buckets — URL / host structure, brand impersonation, domain age + DNS + SSL intelligence, live HTTP behaviour, and three URI blacklists — into a 0-100 risk score. Verdict thresholds are deterministic: >=65 is Likely Phishing, 40-64 is Suspicious, 20-39 is Low Risk, below 20 is Safe. A single URI blacklist hit alone can carry the verdict.
• Is a URL safe just because it has HTTPS? No. Free Let's Encrypt certificates are trivial to obtain in under a minute, and phishing operators use them by default. HTTPS means the connection is encrypted — it says nothing about who is on the other end. Any phishing checker that treats the padlock as a trust signal is outdated. This tool weighs SSL against domain age, blacklist status, and behaviour.
• Why does domain age matter so much? Public research (APWG, Anti-Phishing Working Group; Google Safe Browsing telemetry) puts about 74% of phishing infrastructure on domains registered in the last 90 days. Attackers register throwaway domains cheaply and rotate them fast. Age is the single fastest actionable trust signal — that's why the engine weights it so heavily.
• What's a typosquat and how do you catch it? A domain that differs from a real brand by one or two characters — `paypa1.com` (1 for l), `micros0ft.com` (0 for o), `arnazon.com` (rn for m). We compute Levenshtein edit distance from the SLD to a 51-brand list with a length-similarity guard so we don't false-positive on unrelated words. Distance 1-2 with matching length is flagged critical.
• What is the brand-name-in-subdomain trick? The domain reads left-to-right as if it's a legit brand, but the registered part is buried at the end. `paypal.com.attacker-domain.top` looks like `paypal.com` to a hurried reader — but the actual registered domain is `attacker-domain.top`. We flag the subdomain-brand mismatch as a critical signal.
• Do you send my URL to any third party? The URL is sent to the three URI blacklists (Spamhaus DBL, SURBL multi, URIBL Black) as a DNS query — those are the primary services the blacklist exists to provide. The reversed-domain query is the standard way to check reputation. Nothing else leaves our infrastructure. The AI diagnosis runs against a shaped summary of the report, not the raw URL body.
• Does the tool visit / render the URL? It fetches the URL with a standard HTTP GET (up to 6 redirects) and reads the first 64 KB of HTML for a page title, meta-refresh target, and password-field presence. No JavaScript is executed, no browser is rendered, no requests are made to third-party assets referenced by the page. Bandwidth footprint is a fraction of a real browser visit.
• What if the URL is behind Cloudflare or a WAF and blocks the fetch? The live-response signals return `unreachable` and contribute zero points. The other four buckets (URL structure, brand impersonation, domain intel, blacklists) still run and score independently. A WAF-shielded phish is still a phish — you don't need the HTML to know the domain is 4 days old and typo-squats a bank.
• How is this different from Google Safe Browsing / VirusTotal? Safe Browsing and VirusTotal are reactive lists — a URL has to be reported, verified, and propagated before it flags. Our engine is proactive: it flags patterns known to correlate with phishing (young domain + brand-plus-suffix + password field) before the URL is ever reported. We use blacklists as one confirmatory signal, not the whole verdict.
• What should I do if the verdict is 'suspicious' or 'phishing'? Don't enter credentials on the URL. Don't download anything from it. Verify the destination out-of-band — type the real brand's URL yourself in a new tab, or use a saved bookmark. If you're a security team, forward the URL to your abuse@ inbox and to abuse@ at the registrar. Report to the appropriate takedown service (PhishTank, APWG, or the impersonated brand's abuse contact).