Suspicious domain checker
Paste a link before you click it. See how old the domain is, whether it imitates a known brand or hides lookalike letters, who really controls the address, and whether it is set up at all.
- Never opens the website
- Brand lookalikes and homographs
- No signup needed
Warning level
Enter a link or domain to start
- Host nameWaiting for inputTaken from the link
- Name—Brands and letters
- Registry—Age and status
- DNS—Set up or not
Domain report
Paste a link or domain above to see its age, who controls it, brand lookalikes, hidden lookalike letters and its DNS setup. The website itself is never opened.
Fair-use limit: 30 checks per hour and 200 per day for each visitor IP address. Results are cached for 1 hour.
What makes a domain suspicious
No single sign proves a scam. Several together, on a link you did not expect, are a strong reason not to click.
It was registered days ago
Phishing domains are often bought shortly before a campaign and dropped soon after, before blocklists catch up.
It imitates a name you trust
paypa1.com, amaz0n-support.com and secure-paypal.net all borrow a brand that does not own them.
The real owner is at the end
In paypal.com.account-check.net, the address belongs to account-check.net. Read domains from the right.
Letters can be fakes
A Cyrillic а looks exactly like a Latin a. Mixed alphabets in one word are rare in honest domains.
How warning points are counted
Each sign the tool finds adds points. 50 or more means several strong signs.
| Warning sign | Points | Why it matters |
|---|---|---|
Registered under 30 days ago |
+35 | Scam domains are often used within days of registration. |
Registered 1 to 6 months ago |
+15 | Still young. Common for scams and for new businesses alike. |
Lookalike of a known brand |
+35 | One letter changed, digits for letters, or the brand plus extra words. |
Brand name in a subdomain |
+30 | paypal.com.example.net belongs to example.net, not PayPal. |
Mixed alphabets (homograph) |
+35 | Latin letters mixed with Cyrillic or Greek ones that look the same. |
Registry hold or suspension |
+30 | The registry or registrar stopped the domain, often after abuse reports. |
Free subdomain hosting |
+15 | Anyone can create a site on these platforms in minutes. |
Risky words, odd structure |
up to +15 | Words like login or verify, many hyphens, digits or subdomain levels. |
No name servers or no address |
+10 to +15 | The domain is not set up or no longer points anywhere. |
How this tool works
What happens between pressing Check and seeing the report.
You paste a link or domain
The host name is taken from it, decoded if it uses Punycode, and split into subdomain and registered domain.
The name is examined
It is compared with 60 well-known brands, checked for mixed alphabets, risky words and free hosting platforms.
Public records are read
The registry's RDAP service gives the registration date and status; DNS shows whether the domain is set up.
Signs are weighed
Each warning sign adds points. The report explains every sign and links to Google and VirusTotal.
What this tool does, and what it doesn't
A plain list, so you know exactly what to expect.
This tool does
- Read registration age and status from RDAP
- Spot lookalikes of 60 well-known brands
- Decode Punycode and find mixed alphabets
- Show the domain that really owns a link
- Check name servers, address and mail records
- Link to Google Safe Browsing and VirusTotal
This tool does not
- Open or scan the website
- Check blocklists itself
- Prove that a site is safe
- Know every brand in the world
- Follow short links like bit.ly
- Keep results longer than 1 hour
Where your data goes
The website is never opened. Our server asks the domain's registry (found through IANA's public RDAP list) and DNS about the domain, so they see our server, not you. The result is cached for 1 hour, then deleted. The Google and VirusTotal buttons open their sites in your browser only when you click them. A hashed, temporary copy of your IP address is used for rate limiting. Like any website, our server may keep normal access logs, as described in our privacy policy.
Why your results might look unexpected
The six surprises people run into most, and what each one means.
A real company, but flagged as new
New businesses register new domains too. Check the company through another channel before trusting it.
No warning signs, but it feels wrong
Trust your doubt. Hacked old domains and brand-new scams can pass these checks.
Registration date not shown
Some country registries do not publish dates over RDAP. The other checks still run.
A familiar platform is flagged
Sites on free hosting such as web.app are flagged because anyone can create them, not because the platform is bad.
A real non-English domain is flagged
Domains in one non-Latin alphabet are normal. Mixing alphabets in one word is what raises the warning.
A short link like bit.ly
Short links hide the destination. Open them with a link expander first, then check the real domain.
Questions about suspicious domains
How does the suspicious domain checker work?
It looks for the warning signs phishing and scam domains often share: a very recent registration, a name that imitates a well-known brand, lookalike characters from other alphabets, a brand name in a subdomain, free subdomain hosting, and missing or broken DNS. Each sign adds warning points. It reads public registry and DNS data and never opens the website itself.
Does "No warning signs" mean the site is safe?
No. It means none of the signs this tool checks were found. A long-established domain can be hacked, and new scams appear before any list catches them. Also check Google Safe Browsing and VirusTotal with the links in the report, and never enter a password or payment details on a page you reached from an unexpected message.
Why does a new domain count as a warning sign?
Scam campaigns often register domains days before they use them and abandon them weeks later. Plenty of new domains are legitimate new businesses, so age alone is never proof. Combined with a brand lookalike or risky words, a registration only days old is a strong warning sign.
What is a homograph or Punycode domain?
Domains can contain letters from other alphabets. In DNS they are written in Punycode, starting with xn--. Some letters look the same as Latin ones, such as the Cyrillic а and the Latin a, so a domain can look exactly like a real brand. The tool decodes the name, shows which alphabets it mixes and compares it with known brands.
Why is a brand name in the subdomain a warning sign?
The owner of a domain is decided by its last part, such as example.com in paypal.com.example.com. Anyone who owns example.com can put any brand name in front of it. The report shows the registered domain separately so you can see who actually controls the address.
What should I do if a domain shows warning signs?
Do not enter passwords, codes or payment details on it. Open the company's site by typing its address yourself or from your bookmarks, and contact them through that site. Report phishing to the brand being imitated, to your email provider, and to Google Safe Browsing using the link in the report.
Is the domain I check stored or visited?
The website is never visited. Our server asks the registry's public RDAP service and DNS about the domain, so neither sees your IP address. The result is cached on our server for 1 hour, then deleted. A hashed, temporary copy of your IP address is used for rate limiting. Like any website, our server may keep normal access logs, as described in our privacy policy.