TOOLBOX · EMAIL & DOMAIN
Check Links Without Clicking.
Paste a suspicious link and see who really owns the address. The checker explains deceptions such as the @ trick, look-alike characters and redirects. Indications, not a verdict.
HOW THE LINK CHECKER WORKS
Signs
with Sources.
Every rule follows a standard or a recommendation. The link is never opened for this: only the structure of the address is evaluated.
@ Trick
In web links, everything before an @ is only a user name. The checker shows which address the browser really opens.
RFC 3986, Section 7.6 Semantic AttacksIP Address Instead of a Name
A bare IP address does not reveal who owns the server. URI syntax does not allow hexadecimal or single-number notations; the checker converts them back.
RFC 3986, Section 7.4 Rare IP Address FormatsLook-alike Characters
Mixed scripts and characters that look like Latin letters, according to the Unicode security rules, plus the technical form with xn--.
Unicode UTS #39, Unicode Security MechanismsDomain in the Prefix
In www.example.com.verify-account.example, the address belongs to verify-account.example. What counts is the part directly before the ending.
Public Suffix ListRedirects
Parameters such as url= or next= with a second address. The checker shows the embedded target and checks it separately on request.
OWASP Unvalidated Redirects and Forwards Cheat SheetShort Links
Short links hide the actual target. The BSI advises not to click if in doubt; https:// is no proof of authenticity.
BSI: How Can I Recognise Phishing in E-mails and on Websites?
NEXT
Understand
Phishing.
Phishing
How phishing works and how to recognize fake messages.
In the GlossaryBusiness Email Compromise (BEC)
Fake CEO and supplier emails with payment requests: the pattern behind them.
In the GlossaryEmail Header Analysis
Did the message really come from the sender? Paste the headers and read SPF, DKIM and DMARC.
Analyze Headers (German)
QUESTIONS
Good to Know.
Does the link checker open the link?
No. The link is only taken apart as text, directly in your browser. The page does not open it, prefetch anything or send it to TOMORIS or third parties. That is why it cannot see what is behind the link, such as a fake sign-in form or malware.
Does “no deception signs” mean the link is safe?
No. The checker looks for typical deceptions in the address. But scammers also use inconspicuous, newly registered domains. What matters is whether the domain shown really belongs to the sender. If in doubt, check through another channel, such as a phone number you already know.
How do I copy a link without opening it?
On a computer: right-click the link and choose “Copy link” or “Copy link address”. On a smartphone: press and hold the link and choose “Copy link”. Do not tap the link.
What is the @ trick?
A web address may contain a user name before the server name, separated by an @. Only what comes after it counts for the target: https://www.example.com@fraud.example leads to fraud.example. RFC 3986 describes exactly this pattern as a way to deceive people (Section 7.6).
Why does a domain look real when it is not?
Cyrillic or Greek letters such as а, е, о and р look like Latin ones but are different characters for computers. A domain made of such characters is a domain of its own. The link checker detects mixed scripts and confusable characters according to Unicode UTS #39 and shows the technical spelling with xn--.
I already clicked. What now?
Do not enter anything on the page that opened and close it. If you already entered credentials, change the password through the route you know and inform your IT immediately. Better to report once too often than too late.
YOUR NEXT STEP
You Have the Result.
What Comes Next?
We assess findings, prioritize by risk and put changes into practice on request: as a project with EXPERTS or as ongoing operations with GRID.