Phishing & Lookalike URL Checker
Spot the structural tricks phishing links use — IDN homograph domains, brand-name stuffing, @-symbol host obfuscation — before you click.
Also known as: Phishing link checker, Fake URL detector, Homograph domain checker, Typosquatting checker
How it works
- 1Paste a URL or bare domain into the input.
- 2Review the overall risk summary and the specific flags found.
- 3Read each flag's explanation to understand exactly what triggered it.
- 4Treat a clean result as "no known red flags," not a certainty of safety.
Why use Phishing & Lookalike URL Checker
Real punycode decoding, not a guess
Implements the RFC 3492 bootstring algorithm from scratch to decode "xn--" domains to their actual Unicode characters, verified against Node's own IDNA implementation.
Names the specific look-alike characters
Flags known individual confusable characters (Cyrillic, Greek) by name — not just "contains unusual characters."
Catches brand-name stuffing
Flags a brand name appearing inside a domain that isn't actually that brand's real registrable domain.
Checks the classic obfuscation tricks
Detects @-symbol host hiding, raw-IP hosts, excessive subdomains, and known URL shorteners in one pass.
Honest about its limits
A clean result is labeled "no known red flags," not "safe" — this checks URL structure only, not page content.
Nothing ever transmitted
Every check runs entirely in your browser tab — the URL you're checking is never sent anywhere.
Who uses Phishing & Lookalike URL Checker
Checking a link before clicking it
Paste a suspicious link from an email or message to check it for structural red flags before opening it.
Verifying a domain really belongs to a brand
Confirm whether a domain claiming to be a bank, retailer, or service is actually that brand's real registrable domain.
Decoding a punycode domain
See what an "xn--" domain actually spells out in Unicode before deciding whether it looks legitimate.
Expanding a shortened link mentally before visiting
Get a clear flag that a link is shortened, as a reminder to expand it elsewhere before trusting the destination.
Training or security awareness examples
Demonstrate real phishing URL patterns — homographs, brand stuffing, @ obfuscation — with a concrete, explained example.
Double-checking a link shared in a group chat or forum
Quickly screen a link before sharing it further or clicking it yourself.
About Phishing & Lookalike URL Checker
Most phishing URLs don't rely on sophisticated exploits — they rely on a human glancing at a link and seeing what they expect to see. A domain that swaps a Latin "a" for a visually identical Cyrillic "а," or tucks "paypal" into a subdomain of a domain that isn't paypal.com, exploits exactly that: the structure looks close enough that most people don't check character-by-character.
This tool automates the character-by-character check. It decodes punycode ("xn--") domains back to Unicode using a from-scratch implementation of the RFC 3492 algorithm, then scans for characters from multiple writing systems mixed in the same domain — the classic homograph technique — and flags known individual look-alike characters (Cyrillic "а" for Latin "a," Greek "ρ" for Latin "p," and similar) by name, so you can see exactly which character is impersonating which.
Beyond homographs, it checks for the other structural tricks that show up constantly in real phishing links: a brand name appearing in a domain that isn't actually that brand's domain, an "@" symbol used to hide the real destination host, a raw IP address standing in for a domain name, unusually deep subdomain chains, known URL shorteners (which hide the destination until you click), and TLDs disproportionately popular in phishing campaigns because registration is cheap.
None of this amounts to a verdict. A clean result means no known structural red flags were found — not a guarantee the destination is safe, since this only examines the URL's structure, not what the page actually does once loaded. Every check runs entirely in your browser; the URL you paste is never sent anywhere.
Phishing & Lookalike URL Checker vs. other options
How Open Tools Library compares to desktop software and other online tools.
| Feature | Open Tools Library | Desktop software | Other online tools |
|---|---|---|---|
| Price | Free, unlimited | N/A | Often free with limits |
| Homograph/punycode detection | Real RFC 3492 decode plus confusable-character detection | N/A | Rarely offered |
| Brand lookalike detection | Substring + edit-distance checks against known brand domains | N/A | Uncommon |
| Explains each flag | Plain-English reason for every red flag raised | N/A | Often just a score with no explanation |
| Speed | Instant — no network round trip | N/A | Often requires a server-side scan |
| Data privacy | URL never leaves your device | N/A | Often submitted to a third-party service |
Pro tips
- A domain that visually resembles a brand but isn't its real registrable domain is one of the strongest signals here — always check the flagged "real domain" against what you expect.
- Punycode domains (starting with "xn--") aren't inherently malicious — plenty of legitimate international domains use them — but it's always worth checking what they decode to.
- Shortened links (bit.ly, tinyurl.com, and similar) aren't inherently dangerous either, but they hide the destination until you click, which is exactly why phishing campaigns use them heavily.
- This tool checks URL structure only — it can't see what a page actually does once loaded, so a clean result is a green light for the link's structure, not a guarantee about the destination.
Technical specs
- Punycode decoding
- From-scratch RFC 3492 implementation, verified against Node's IDNA decoder
- Homograph detection
- Mixed-script detection plus a table of common individual confusable characters
- Brand comparison
- Substring and Levenshtein-distance checks against ~80 commonly impersonated domains
- Structural checks
- @-symbol hosts, raw IPs, subdomain depth, hyphenation, shorteners, suspicious TLDs, non-standard ports
- Registrable-domain extraction
- Simplified — covers common compound ccTLDs (co.uk, com.au, etc.), not a full public suffix list
- Processing location
- 100% local, in your browser
Privacy & security
A tool for checking whether a link is trying to deceive you shouldn't itself require sending that link anywhere.
Every check — punycode decoding, brand comparison, structural analysis — runs entirely in your browser.
The URL you check is never uploaded, logged, or sent to any server.
No account, no email, no login — just a URL in, a flag list out.
Equally private whether you're checking one link or dozens.
Frequently asked questions
Does a clean result mean a URL is safe?
No — it means no known structural red flags were found. This tool checks URL structure only, not what the destination page actually does, so it can't be a full guarantee.
What is a homograph attack?
A phishing technique where a domain uses characters from a different alphabet that look identical or very similar to Latin letters (e.g. Cyrillic "а" instead of Latin "a") to visually impersonate a different, trusted domain.
Is my URL sent anywhere?
No — every check, including punycode decoding and brand comparison, runs entirely in your browser.
Why does it flag "@" in a URL?
Browsers ignore everything before an "@" symbol when connecting — text that looks like the destination site may not be where the URL actually goes. This is a classic obfuscation trick.
How does it know which brands are commonly impersonated?
It compares against a curated list of roughly 80 domains from finance, tech, e-commerce, and shipping — the categories most frequently targeted by phishing campaigns.
Can this replace a real anti-phishing browser extension?
Not entirely — this is a quick structural check for a single URL, not continuous protection. It's a useful second look before clicking a specific suspicious link.
Troubleshooting
Why was a legitimate-looking domain flagged?
Check the specific flag reason — a short brand name or a domain that happens to be a couple characters different from a well-known one can trigger a flag even when it's legitimate. Read the explanation, not just the flag count.
Why wasn't a domain I'm suspicious of flagged?
This tool checks structure, not content or reputation — a well-formed phishing domain with no homograph tricks, brand stuffing, or other structural red flags won't be caught by structural analysis alone.
What does "decodes to" mean under the hostname?
It's the Unicode text a punycode ("xn--") domain actually spells out — worth checking those characters carefully, since this is exactly where homograph attacks hide.
The risk level seems too high for an info-only flag
The overall risk level reflects the most severe flag found — a single "info" flag (like a hyphenated domain) keeps the result low risk; it only escalates when a "warning" or "danger" flag is present.
Related searches
Landed here looking for something worded a little differently? Phishing & Lookalike URL Checker covers all of these too:
Ready to use Phishing & Lookalike URL Checker?
Free, private, and ready right now — no signup required.
Scroll to Phishing & Lookalike URL Checker