Phishing
Where does this link really go?
Paste a link or scan a QR code. The page takes it apart in your browser and points out the tricks phishing links use, without opening it.
Point your camera at the code, or drop, paste or choose a picture of it.
who runs itchosen by themignored by the browser
Without tracking
Follow the redirects
Short links and tracking links bounce you through other addresses first. This asks breached.space’s server to request each one and report where it points next, so your browser never loads them. The server reads the response headers and keeps nothing, and the sites see its address instead of yours. Redirects done by JavaScript on the page won’t show up here. Don’t use it on sign-in, password reset or unsubscribe links: some servers act on any request, even one that only asks for headers.
What it checks
The end of a site’s name decides who runs it. In paypal.com.account-help.net that’s account-help.net, and its owner can put anything they like in front.
Some letters in other alphabets are drawn exactly like Latin ones, so аррӏе.com, spelled in Cyrillic, is a different site from apple.com. Browsers usually show such names as xn-- codes when they spot the trick, but they miss some.
A link can also hide where it goes behind text before an @, an address written as a number, a short link or a second address in the query string. The inspector looks for each of these.
QR codes can do more than open a page. One can join a Wi-Fi network, start a text to a premium number, add a 2FA account or ask for a crypto payment. Scammers stick their own codes over the real ones on parking meters and restaurant tables.
A link that passes can still lead to a phishing page on a site that looks harmless. If a message asks you to log in, type the site’s address yourself instead. For a suspicious email, check its headers too.