Link X-Ray
Got a dodgy-looking link in a text or email? Paste it below to see where it really goes and whether it shows the usual scam signs. Short links are followed safely for you and the domain’s age is checked. The page itself is never opened in your browser.
Try an example:
Private by design: the scam checks run in your browser. If “Follow redirects” is ticked, Catpool’s server follows the link one hop at a time (max 10), reading only the reply headers, refusing private or internal addresses, and looks up the domain’s registration date (RDAP). Pages are never loaded, and links are cached for 10 minutes but not linked to you. Untick the box and nothing leaves your browser.
How to use Link X-Ray
- Copy the link you’re not sure about. On a phone, press and hold the link in the text or email and choose Copy link, so you don’t open it by accident.
- Paste it into the box and press Check link. You can paste a whole message too, and Link X-Ray will pick out the first web address it finds.
- Read the verdict (Looks OK, Be careful or Likely scam) and the list of reasons underneath. The real domain is highlighted, so you can see who actually owns the site.
- Use Clear and check another to start again. Link X-Ray never opens the link, so checking it is always safe.
If you enjoy what we do, consider supporting us. Every little bit means the world! Support Catpool on Ko-fi
Why fake links work
Most scam texts and emails want just one thing: a tap on their link. It usually leads to a copycat page that looks exactly like Royal Mail, Evri, HMRC, your bank or Netflix, and asks for a “small redelivery fee”, a login or your card details. The page can look perfect, so the address is often the only giveaway.
Web addresses are easy to fake at a glance. Scammers bury a real brand name at the start of the address, swap letters for numbers, borrow lookalike letters from other alphabets, or hide the destination behind a link shortener. On a small phone screen the important part is often cut off. Link X-Ray pulls the address apart so you can see what’s really there.
What the warnings mean
- Real domain highlighted: the part just before the ending (like
.co.ukor.com) shows who owns the site. Inpaypal.com.secure-login.topthe owner issecure-login.top, not PayPal. Everything before it can be set to anything. - Brand name on someone else’s site: names like Royal Mail, Evri, DPD, HMRC, the DVLA, the NHS, PayPal, Amazon or a bank appearing in an address that doesn’t belong to them. It’s the most common phishing trick of all.
- Lookalike and typo spellings: a zero for an “o”, “rn” for “m”, or a near-miss like
paypai. Letters from other alphabets show up asxn--“punycode”, and Link X-Ray shows you what they really spell. - Hidden “@” trick: everything before an
@in a web address is ignored, sohttps://gov.uk@example.topactually goes toexample.top. - Link shortener: services like bit.ly and TinyURL hide the final address. Plenty of honest firms use them, but you can’t see where you’ll land without opening the link, and Link X-Ray never opens links.
- Not encrypted (http) or a raw IP address: signs of a quickly thrown-together site rather than an established business.
- Unusual domain ending: cheap endings like
.top,.xyz,.icuor.clickare popular with scammers. This is only a nudge, as many honest sites use them. - Scam-style words: words like verify, login, redelivery, fee or refund in the address are there to rush you.
- Very long or heavily encoded links, links inside links and app downloads: ways of disguising where a link goes or what it does.
The verdict adds these up. Looks OK means nothing obvious stood out, but it can’t promise a site is safe. A brand-new scam on an ordinary-looking address can still slip through. If a message asks you to pay or log in, the safest move is always to open the company’s own app or type their web address yourself.
Privacy
Everything happens on your device. Link X-Ray reads the text of the address and nothing more. It never opens, visits, “expands” or previews the link, and nothing you paste is uploaded, logged or stored. Refresh the page and it’s gone.
FAQ
Is it safe to paste a scam link here?
Yes. Pasting a link is just pasting text. Link X-Ray never visits it, so the scammer can’t tell you’ve checked it.
Can it tell me for certain that a link is safe?
No tool can. Link X-Ray looks for the warning signs scammers commonly leave behind, but a new scam on an ordinary-looking address may not trigger any of them. Treat the verdict as a second opinion, not a guarantee.
Why can’t it show where a bit.ly link goes?
Finding the destination of a short link means visiting it, which is exactly what Link X-Ray avoids. If a short link arrives out of the blue, don’t open it. Go to the company’s website or app directly instead.
I’ve already entered my details on a scam site. What should I do?
Call your bank straight away on the number on the back of your card, or dial 159 to reach most UK banks’ fraud teams. Change any password you typed in, and anywhere else you use it. Then report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040 (in Scotland, call Police Scotland on 101). Forward scam texts to 7726 and scam emails to report@phishing.gov.uk.
Related: Catpool home, Security, QR X-Ray, Text X-Ray, Photo X-Ray, Has My Password Been Leaked?.
