Phishing works because a message arrives at a moment when its story is plausible. A delivery is genuinely due. A password genuinely did expire recently. An invoice from that supplier genuinely does arrive monthly. The attacker only has to be believable for the few seconds between reading and clicking.
This page removes the clicking from that sequence. Paste the message and every link in it is checked separately, so you can decide with evidence rather than instinct.
Why checking every link matters
A phishing email is rarely made of a single malicious link. It is usually one dangerous link surrounded by genuine ones, pointing at the real company's homepage, privacy policy and social accounts. Those real links are camouflage. They make the message look right if you spot-check one or two, and they help it past filters that judge a message by its overall reputation.
Checking all of them at once turns that tactic against the sender. When nineteen links go to a real bank and one goes to a domain registered four days ago, the message answers itself.
What Scanify does with the text
- Finds the addresses. Full web addresses and bare domains are both extracted, whether they sit in the body, a signature or a forwarded header block.
- Unwraps tracking redirects. Corporate mail systems rewrite links so they pass through a gateway first. Scanify unwraps the common formats so you see the true destination rather than the wrapper.
- Removes duplicates. A link repeated in the body and the footer is checked once.
- Checks each destination. Redirect tracing, domain age, certificate inspection, Google Safe Browsing and hostname heuristics run separately for every link.
The warning signs no scanner can read for you
Urgency and threatened loss
Almost every phishing message manufactures time pressure: an account closing, a payment failing, a refund expiring, a delivery being returned. Urgency exists to stop you checking. Its presence is itself the signal.
An unexpected request to authenticate
Real organisations do not email you a link and ask you to log in to avoid a consequence. If an account genuinely needs attention, you will find the same message after navigating to the site yourself.
A sender address that nearly matches
Read the full address, not the display name, which is trivially forged. Look for extra words, hyphens, unusual endings and digits standing in for letters. A message from a free mail provider claiming to be a bank is finished right there.
A greeting with no name
"Dear customer" from a company that has had your name for years suggests a list rather than a relationship. Increasingly personalised phishing exists, so a correct name proves nothing in the other direction.
Requests for credentials, codes or payment details
No legitimate organisation asks for a password, a full card number or a one-time code by email. A one-time code request is particularly serious, because it usually means someone already has your password and is trying to get past the second factor in real time.
An attachment you did not expect
Invoices, receipts and scanned documents from unfamiliar senders are a standard malware delivery route. If you need to open one, check it first with the file scanner rather than opening it to see what it is.
What to do with the result
- Any link flagged high or critical: treat the message as an attack. Do not reply, do not click, and report it through your mail client so the provider learns from it.
- All links clean but the message feels wrong: trust the feeling. A brand-new phishing page can be clean for hours before any engine catches it. Reach the organisation through a number or address you already had.
- A link to a shortener: expand it with the link expander to see where it lands.
- Mixed results: one bad link among many good ones is the classic shape of a real phishing message, not a reason to relax.
If you already clicked or entered something
- Change the password for the imitated service immediately, going to the site directly rather than through any link in the message.
- Change that password anywhere else you reused it. Credential stuffing is automated and fast.
- Turn on two-factor authentication if it was not already on.
- If you entered a card number, call your bank and freeze the card.
- If it was a work account, tell your security team the same day. They can revoke active sessions that a password change alone will not.
- Run a malware scan if you downloaded or opened anything.
A note on what this tool is not
This checks the links in a message. It does not authenticate the sender, inspect mail headers for forged routing, or analyse attachments. Those are separate jobs. Header analysis in particular requires the raw source of the message and is the right next step when a message passes every link check and still looks wrong.