Glance

Read a link before you tap it.

Paste a URL or the whole message. I read the address in your browser: lookalike names, hidden destinations, and — when the registry publishes it — how new the domain is. https only means the connection is encrypted. Scam sites have certificates too.

The link is not sent to this site, and the page is not opened.

What I look at

  • Lookalike and borrowed brand names
  • Text hiding the real site, including an @ sign
  • Plain HTTP, short links, raw IP addresses, and program downloads
  • Forms and files anyone can publish, including on Google
  • Whether the name exists, and how new it is
  • Defacement marks, hidden encoded links, and webshell names

What I can’t see

  • The page itself. I never open it.
  • Who sent it, or what they asked you to do.
  • A normal-looking name, including a real site that was later defaced.
  • Every blacklist. There is no call to this website’s servers.