Phishing & Domain Reputation Checker
Paste any URL. We check DNS, SSL, WHOIS, and run a phishing classifier over the live page in under 10 seconds. Free, no login.
Rate limited to 10 scans per hour per IP. Sign in for unlimited monitoring of your own brand.
What we check
Infrastructure
DNS resolution, SSL certificate issuer + subject, MX records, resolved IPs. The raw building blocks that tell you whether a site is real or spun up yesterday.
WHOIS / RDAP
Who registered the domain, when, and with which registrar. New domains with privacy registration are a huge phishing tell.
Phishing signals
Live page fetch with heuristic classifier: login forms, brand keywords, homograph chars, meta redirects, iframe sandboxing, favicon matches. Each signal is weighted into a 0-100 risk score.
Signals we check
The verdict is built from a fixed set of signals, each named in the report. Nothing is hidden behind a black-box ML score.
- DNS. A and AAAA records, MX records, and the NS provider. No DNS at all is itself a signal. So is using a free DNS provider that ships phishing kits in bulk.
- SSL. Certificate issuer, subject CN, full SAN list, certificate age, and time to expiry. A Let's Encrypt cert issued in the last 24 hours on a brand-spoof domain is a strong signal.
- WHOIS. Registrar, registration date and so domain age, and registrant org if disclosed. Domains under 30 days old score higher. Privacy registration on a brand-spoof domain scores higher still.
- Brand keyword in subdomain or path. "paypal" in login.paypal-secure.example.com is the classic pattern. We match against a known brand list and flag the placement.
- Suspicious TLD. .tk, .top, .xyz, .ru, .cn, and a handful of others are over-represented in phishing telemetry. Not an automatic fail, but it nudges the score.
- Free-tier hosting on a brand-spoof domain. Heroku, Vercel, Netlify, and Cloudflare Pages are legitimate platforms abused by phishing kits because they are free and disposable.
- Open redirects and suspicious URL parameters. Long base64 blobs, encoded URL parameters that look like another domain, and known open-redirect patterns.
- HTML resemblance to known brand login pages. Lightweight string match against a library of common login templates. Not pixel-perfect comparison, but it catches the obvious clones.
Verdict bands map the 0 to 100 score into four buckets:
What we don't check
Honest about the limits. This is a fast lightweight scanner, not a full sandbox.
- We do not fetch full page content for malware analysis. There is no sandbox detonation, no JavaScript execution profiling, no binary scoring.
- We do not follow redirect chains beyond 3 hops. Long redirect chains used to obscure final destination are flagged but not fully traversed.
- We do not decode obfuscated JavaScript. Encoded payloads, packed scripts, and runtime-generated DOM are out of scope.
- We do not query every available threat intel feed. The free tool checks a curated subset. Full feed integration is on the paid SecurityAlert plan.
For deeper inspection, run the URL through VirusTotal for AV-engine consensus, urlscan.io for a full headless-browser session including DOM and network capture, or Hybrid Analysis for sandbox detonation. This tool is the first-pass triage that tells you whether deeper inspection is worth your time.
When to use this
- You got a suspicious link. Email, SMS, Slack DM, anything. Paste it here before clicking. Five seconds of caution saves a lot of incident-response work.
- Pre-takedown reconnaissance. If you are about to file a takedown for a brand-spoof domain, run this first to capture the WHOIS, registrar, and signal evidence in one report URL you can attach to the request.
- Customer support triage. A customer reports a domain claiming to be your brand. Scan it, share the report URL with the customer and with internal security. If the verdict is malicious, escalate to takedown.
- Security awareness training. Show a real suspicious URL alongside its report so people learn what the signals look like in practice.
Frequently asked questions
How accurate is the verdict?
The verdict is signal-based, not a black-box ML score. Each contributing factor is named in the report so you can audit the reasoning. Treat the verdict as a starting point. A clean score does not guarantee safety on a fast-flipping infrastructure, and a suspicious score on a brand-new legitimate site is a known false positive.
What if a legitimate site comes back as suspicious?
False positives are most common on three patterns. New domains under 30 days old, even when registered by legitimate businesses. Privacy-registered WHOIS entries on otherwise normal sites. Domains using Cloudflare Pages, Vercel, or Netlify hosting because phishing kits abuse those same tiers. Read the per-signal breakdown to see what is contributing. If only the registration-age signal is firing, the site is likely fine.
What if a malicious site comes back as clean?
Possible, especially on fast-flux infrastructure or domains repurposed in the last few hours. Lightweight scans cannot follow every redirect chain or render every JavaScript-loaded page. If you have evidence a site is phishing despite a clean verdict, report it to the registrar and to Google Safe Browsing. We are also happy to receive reports at support@securityalert.ai so we can tune signals.
Do you store the URLs I scan?
Yes. Public scans are cached for 30 days so report URLs are shareable and so we do not re-scan the same host repeatedly. The stored record includes the URL, the verdict, the contributing signals, and the WHOIS and DNS data we already pulled.
Can you scan multiple URLs at once?
Not yet. Batch scanning is on the roadmap. For now, scan one URL at a time. The per-IP rate limit is 10 scans per hour. Continuous brand-keyword monitoring across all newly registered domains is what the paid SecurityAlert plan does, which is a different shape of problem than a manual batch scan.
How is this different from VirusTotal or urlscan?
VirusTotal aggregates verdicts from dozens of antivirus engines and is excellent for known malicious URLs. urlscan.io captures a full browser session including DOM and network requests, which is the gold standard for deep analysis. This tool is faster and surfaces a transparent signal-based verdict in one screen, which is what most people actually need before clicking a link. For deeper forensics, run urlscan.io. For brand-protection monitoring across many lookalikes, use SecurityAlert.