Check a suspicious email or link PHISHLENS

The one thing it will not do

It never opens the link. It does not fetch the page, load an image, follow a redirect or resolve a name. Everything it reports is read out of the text you pasted.

That restraint is the point rather than a limitation. A phishing link is usually unique to you: visiting it tells the sender the address is live and that a human read the message, which is exactly what they are measuring. Loading a remote image does the same thing more quietly. Most "check this URL" services work by requesting the page, and on a targeted message that request is the confirmation the attacker wanted.

What it reads

• Where the link really points. The visible text of a link and its destination are unrelated, and the oldest trick in the medium is making one say the other. It also unwraps redirect services that carry their destination in the URL.
• What the domain actually is. The registered domain, separated from the subdomains in front of it, because login.microsoft.com.secure-account.example is not Microsoft, and the part that matters is at the end rather than the beginning. Characters that imitate other characters are flagged; see HOMOGLYPH for why a name can be unreadable by eye in principle.
• The header claims, if you paste the whole message: whether SPF, DKIM and DMARC passed, and whether the authenticated domain is the one in the From line. HEADERPROOF is the deeper version of that.
• The tricks in the body. Text hidden with a background colour or a zero font size, invisible characters splitting a word so a filter cannot match it, and images standing in for text for the same reason.

What a clean result is worth

Less than it feels like. A competent attacker registers a domain, configures SPF and DKIM correctly, writes in plain HTML and links to a page that looks right, and passes every check here. The techniques this finds are the cheap ones, and finding none of them means the message is not cheap.

The judgement that actually protects you is not technical: was this expected, does the request make sense, and does the sender gain something by hurrying you. If a message says an account will close today, the answer is to open the account from a bookmark you already had rather than to examine the link more carefully.