Link safety checker
To check if a link is safe, read the real domain before you click: hover over it or long-press on a phone, and find the part just before the first single slash. If that domain is not the one you expect, do not open it. You can also run a free check of how securely the destination site is set up.
How to read a link
In https://login.example.com.secure-verify.net/account, the real domain is secure-verify.net, not example.com. Everything before it is a subdomain the owner of secure-verify.net chose. Phishing links rely on people reading only the start.
Common link tricks
- Lookalike domains with swapped letters (rn for m) or extra words.
- Shortened links that hide the destination. Expand them with a preview service before you open them.
- Links in messages that create urgency: a parcel on hold, an account locked, an invoice overdue.
- QR codes that lead to login pages. Treat them like links in an email.
What this check does
The Vigilbase check scans the destination site's security setup: HTTPS, headers, exposed files and server configuration. It is not a phishing blocklist. A newly created phishing page can pass basic checks, so the domain test above matters most.
Frequently asked questions
Is it safe to open a link just to check it?
Opening a phishing page is usually not harmful by itself; entering details or downloading files is. Still, check the domain first and never sign in from a link you did not expect.
How do I protect my team from phishing links?
Publish DMARC at p=reject so attackers cannot send as your domain, train staff to read domains, and monitor sign-ins. Vigilbase OS watches for risky sign-ins and account changes.
What should I do if I clicked a phishing link?
If you entered a password, change it everywhere you used it and turn on two-factor authentication. If it was a work account, tell your IT or security team straight away.