Suspicious Domain Checker

Analyze suspicious domain names for look-alike characters, deceptive spelling, and other impersonation indicators. A separate WhoisXML API check looks for threat records matching the hostname.

Text-only analysis: This checker does not visit, resolve, download from, or otherwise connect to the submitted domain. Do not enter passwords, authentication codes, private document links, password-reset links, or URLs containing personal access tokens.

The hostname is sent to WhoisXML API for a threat-intelligence lookup. URL paths, query strings, and fragments are not sent. The full link is not checked.

Suspicious domain or link (paste exactly as received)

Paste the suspicious domain or link exactly as you received it. Do not open it, correct its spelling, shorten it, or manually defang it first. The checker treats the submission as text and does not connect to the destination. Only a sanitized, defanged hostname is returned for display.

Expected legitimate domain (strongly recommended)

Enter the domain you believe the submitted address may be imitating—for example, paypal.com. This enables additional look-alike and misspelling checks and may substantially change the result.

I understand that I should paste the suspicious link without opening it. This tool performs preliminary text analysis without visiting the destination and does not determine whether a website is safe or malicious.

Clear Results