Free · live registry data · no login
Phishing / Suspicious Domain Checker
Reputation and lookalike signals for a domain you received mail from.
How it works
Is this domain safe? Phishing and suspicious domain checker
Paste the domain from a suspicious email, text or link and, optionally, the brand it claims to be. We pull the registration date from the registry, measure how closely the name imitates the brand (including 0 for o and rn for m tricks), check the extension against the ones most abused for phishing, count hyphens, digits and bait words like 'login' or 'verify', and see whether the site has a valid certificate and mail records. The result is a 0 to 100 suspicion score with the reasons spelled out.
Results appear here after you click Check this domain.
How this works
- 1
Age and registrar
RDAP tells us when the domain was created and by which registrar; most phishing domains are days old.
- 2
Lookalike analysis
We undo homoglyph tricks, then measure edit distance and containment against the brand you named.
- 3
Extension, structure, hosting
Abused TLDs, hyphens, bait words, DNS records and the TLS certificate each add to or reduce the score.
Frequently asked questions
- How can I tell if a domain is a phishing site?
- Look at the registrable domain, the part right before the last dot. If it is not exactly the company's real domain, it is not the company, no matter what comes before it. Then look for age under a few months, misspellings, digits in place of letters, and words like secure or login in the domain itself.
- Does HTTPS mean a site is safe?
- No. The padlock means traffic to the site is encrypted, not that the site is honest. Free certificates are issued automatically to anyone who controls a domain, and the majority of phishing pages now use HTTPS.
- Why is the registration date so important?
- Phishing domains are disposable: registered, used for a campaign, and abandoned when blocklisted. A domain created days or weeks before you received a message from it is a strong warning sign. Established companies have domains that are years old.
- I entered my password on a suspicious site. What now?
- Change the password immediately on the real site, and on any other account that used the same password. Turn on two-factor authentication, check for forwarding rules or new devices in the account, and report the phishing site to the impersonated company.
- Can this tool be wrong?
- Yes. It scores signals, it does not consult a blocklist. A brand new legitimate startup on .xyz will score as suspicious, and a long-registered domain whose site was hacked will score as safe. Use the result alongside common sense about what the message is asking you to do.
Every MailShrine domain includes WHOIS privacy, transfer lock, Anycast DNS with DNSSEC and two business mailboxes.