Understand what each scanner clue can and cannot tell you. Signal strength describes evidence; it never acts as a verdict by itself.
One observed clue, such as a redirect or lookalike pattern.
A combined presentation of the checks that completed.
Your next action, based on the result plus real-world context and stakes.
Whether the final destination uses HTTPS.
This strength describes one clue. It is not a result or verdict on its own.
HTTPS protects the connection, but it does not prove that the website is legitimate.
Treat missing HTTPS as a caution signal. Even with HTTPS, verify the domain before entering credentials or payment details.
How many times a URL sends the browser somewhere else.
This strength describes one clue. It is not a result or verdict on its own.
Redirects are common, but long chains can hide the final destination or add tracking layers.
Check the final domain and be more careful when a link jumps through several sites.
The URL ends on a different domain from the one first entered.
This strength describes one clue. It is not a result or verdict on its own.
A different final domain can be normal for campaigns, but it can also hide impersonation or short-link abuse.
Compare the final domain with the sender, brand, and action requested before you trust it.
The destination uses an IP address instead of a readable domain.
This strength describes one clue. It is not a result or verdict on its own.
Raw IP hosts can appear in temporary infrastructure and phishing pages.
Avoid entering credentials or payment details unless you can verify why an IP address is expected.
The hostname contains encoded characters such as xn--.
This strength describes one clue. It is not a result or verdict on its own.
Punycode is legitimate technology, but it can hide lookalike characters in domains.
Verify the destination through the official website when the encoded domain appears in a login, payment, or account link.
The domain resembles a known brand with small changes.
This strength describes one clue. It is not a result or verdict on its own.
Lookalike domains can trick users into trusting fake login, support, or payment pages.
Open the service directly from the official site or app instead of trusting the message link.
The hostname has many nested labels before the main domain.
This strength describes one clue. It is not a result or verdict on its own.
Long subdomain chains can make a fake destination look like it belongs to a trusted brand.
Read the base domain, not just the first words in the URL.
The final base domain differs from the input base domain.
This strength describes one clue. It is not a result or verdict on its own.
A mismatch can indicate that a link is hiding its real destination.
Check whether the final base domain matches the brand or sender you expected.
Unusual URL features such as dense separators, digits, or complex hostnames.
This strength describes one clue. It is not a result or verdict on its own.
Structure alone rarely proves danger, but it can add context when combined with other signals.
Use the structure as a reason to slow down, then inspect the final domain and request manual review if the link affects work, money, or accounts.
Email senders are checked for domain, free-provider, disposable, number, and separator patterns.
This strength describes one clue. It is not a result or verdict on its own.
Sender patterns can reveal throwaway accounts or possible impersonation, especially in payment or login requests.
Verify the sender through a separate channel before replying, paying, or clicking.
Some email/domain checks add caution for TLDs that often appear in abuse patterns.
This strength describes one clue. It is not a result or verdict on its own.
A TLD is not proof of risk, but it can be a weak signal when combined with impersonation, urgency, or redirects.
Do not judge by TLD alone. Combine it with domain, sender, and page context.
Signals are clues. Manual review can help when redirects, business context, login pages, or sensitive links make the decision higher stakes.