Phishing Domain Detection

Identify potential phishing domains that attempt to impersonate legitimate brands or trick users into providing sensitive data.

Evidence ASSESSED

Checked against: Google Safe Browsing v4 and URLhaus (abuse.ch)

RED TEAM 0 findings BLUE TEAM control did not hold

Our Phishing Scanner assesses whether a URL shows the characteristics of a phishing site — brand impersonation patterns in the domain, recent registration, suspicious structure, and presence on phishing intelligence feeds.

What is Phishing?

Phishing is an attempt to obtain credentials, payment details or personal data by impersonating a trusted organisation. The technical infrastructure is usually simple — a convincing copy of a login page hosted on a domain the attacker controls.

The domain is where most of the deception lives. Attackers register lookalikes using character substitution, extra hyphens, appended words, alternative TLDs, or homoglyphs from other scripts that render almost identically to Latin characters. A recipient glancing at the address bar sees something that looks right.

Detection combines several weak signals into a stronger judgement: how recently the domain was registered, whether it resembles a known brand, whether the URL structure matches common kit patterns, and whether it already appears on intelligence feeds.

Impersonates a trusted organisation to harvest credentials or data
Lookalike domains are the primary deception mechanism
Homoglyph characters render almost identically to Latin letters
Most phishing domains are registered days before use
Detection combines several signals rather than relying on one

Why Phishing Detection Matters

Phishing remains the most common initial access vector in reported breaches. It bypasses technical controls entirely by targeting the person, and a single set of harvested credentials is frequently enough to reach an internal network.

For the organisation being impersonated, the damage is reputational and financial even though nothing of theirs was compromised. Customers who lose money to a convincing fake blame the brand, and the support burden of a campaign in your name is substantial. Finding lookalike domains early is what makes takedown possible before a campaign reaches scale.

The most common initial access vector in reported breaches
Bypasses technical controls by targeting people directly
Harvested credentials frequently lead to full network access
Impersonated brands suffer reputational damage regardless of fault
Early detection enables takedown before a campaign spreads

How This Phishing Scanner Works

The tool evaluates a URL against several independent indicators.

Validates the URL input against format and SSRF safety checks
Checks the domain against phishing intelligence feeds
Analyses the domain for brand impersonation and homoglyph patterns
Checks registration age, since most phishing domains are very new
Combines the signals into an overall risk assessment

How to Use the Phishing Scanner

Enter the suspicious URL in the input field
Never enter credentials on a site you are checking
Run the scan to evaluate the indicators
Review each signal rather than only the overall verdict
Report confirmed phishing to the hosting provider and the impersonated brand

Understanding Your Phishing Scan Results

Each indicator contributes to the assessment:

Field / Value	Meaning
`Feed listing`	The URL appears on a phishing intelligence feed. The strongest single signal, though feeds lag behind new campaigns by hours or days.
`Domain age`	How recently the domain was registered. Most phishing infrastructure is days old, so a very new domain impersonating an established brand is a strong indicator.
`Brand similarity`	Whether the domain resembles a known brand through character substitution, added words or hyphens. Attackers rely on a glance rather than a careful read.
`Homoglyph characters`	Characters from other scripts that render almost identically to Latin letters. A Cyrillic character in place of a Latin one is visually indistinguishable in most fonts.
`URL structure`	Deep paths, brand names in the path rather than the domain, and randomised directories are common patterns in mass-deployed phishing kits.
`Certificate`	Valid HTTPS proves nothing about legitimacy. Free certificates are trivially obtained, and the overwhelming majority of phishing sites now use them.
`Clean result`	No indicators found. This is not proof of safety — a campaign launched hours ago will not yet appear on any feed.

Common Problems & How to Fix Them

Intelligence feeds lag behind new campaigns, so a site launched hours ago frequently scores clean.

Judge the context rather than the verdict. Did the link arrive unsolicited? Does it create urgency? Does the domain differ from the one you would type yourself? Never enter credentials on a site reached through a link — navigate to the organisation directly instead.

Characters from other scripts render almost identically to Latin letters, making the domain visually indistinguishable from the real one.

Browsers display such domains in punycode form, beginning with xn--, when they detect mixed scripts. Look for that prefix. Where you control the brand, register the obvious homoglyph variants defensively.

Act on several fronts at once. Report to the hosting provider abuse contact and to the registrar, submit the URL to Google Safe Browsing and other browser intelligence programmes, and notify your customers if a campaign is already in progress.

Preserve evidence first — screenshots and the full URL — since the site will be taken down and you may need the record.

This is entirely normal for phishing and proves nothing. Domain-validated certificates are free and automated, requiring only control of the domain, which the attacker obviously has.

The padlock indicates the connection is encrypted, not that the site is trustworthy. Assess the domain name itself rather than the certificate.

This happens to newly registered legitimate domains, and to domains that resemble an established brand for innocent reasons.

Establish legitimacy over time: publish real content, obtain a certificate, configure email authentication correctly, and build inbound links. If the domain was previously used for abuse by an earlier owner, request review from the relevant intelligence providers.

Best Practices

Navigate to sites directly rather than following links in unsolicited messages
Check the domain carefully, since the deception is usually there rather than in the content
Never treat HTTPS or a padlock as evidence of legitimacy
Register obvious lookalike variants of your own brand defensively
Monitor for newly registered domains resembling your brand
Report confirmed phishing to hosting providers, registrars and browser intelligence programmes
Preserve evidence before reporting, since the site will disappear

Security Recommendations

Treat a clean scan as inconclusive rather than as proof of safety, since feeds lag new campaigns
Deploy DMARC at enforcement so your domain cannot be spoofed in the email that carries phishing links
Use phishing-resistant authentication such as security keys, which defeat credential harvesting even when a user is deceived
Monitor certificate transparency logs for certificates issued to lookalike domains, often the earliest signal of a campaign
Train people to verify unexpected requests through a known channel rather than by replying
Assume any credential entered on a phishing site is compromised immediately and rotate it without delay

Frequently Asked Questions

Examine the domain closely for substituted characters, extra words or an unexpected TLD. Consider whether you arrived through an unsolicited link, and whether the message created urgency. Never rely on the padlock — phishing sites use HTTPS routinely.

No. It means the connection is encrypted, nothing more. Domain-validated certificates are free and automated, so the overwhelming majority of phishing sites have valid HTTPS. The padlock says nothing about who is on the other end.

The use of characters from other scripts that render almost identically to Latin letters, producing a domain visually indistinguishable from the real one. Browsers show such domains in punycode form beginning with xn-- when they detect mixed scripts.

Intelligence feeds lag behind new campaigns. A site launched hours ago has not yet been reported or analysed. A clean result means nothing has been detected, not that the site is safe.

Change that password immediately, and anywhere else you used it. Enable multi-factor authentication. Review recent account activity for unauthorised access, and notify your security team or the affected service.

Report to the hosting provider abuse contact found through IP WHOIS, to the domain registrar, and to browser intelligence programmes such as Google Safe Browsing. If your brand is being impersonated, also notify your customers.

Register plausible lookalike domains defensively, monitor certificate transparency logs for certificates issued to similar names, enforce DMARC so your domain cannot be spoofed in email, and maintain a clear reporting channel for customers.