Copy it, do not open it

On a phone, press and hold the link and choose copy. On a computer, right-click and choose copy link address. Then paste it into the checker above, which reads it as text and never opens it.

Find the real domain

Read the address from the first "//" to the next single "/": that is the host name. The part that tells you who controls the page is the registrable domain: the public ending plus the one name just before it.

The public ending is not always one label. The Public Suffix List, a Mozilla initiative kept as a community resource, records every ending "under which Internet users can (or historically could) directly register names", and browsers use it to highlight the key part of a domain (Public Suffix List). It contains country endings with several parts, such as .co.uk or .com.au, and in a separate private section, endings run by hosting companies, such as github.io or netlify.app, where anyone can create a site (our reading of the list file itself).

Link	Public ending	Real domain	Who controls it
www.royalmail.com/track	.com	royalmail.com	Royal Mail
paypal.com.account-check.example/login	.example	account-check.example	Whoever registered account-check.example
news.bbc.co.uk	.co.uk	bbc.co.uk	The BBC
royalmail-redelivery.netlify.app	netlify.app	royalmail-redelivery.netlify.app	Any Netlify user who chose that name
hmrc-refund.github.io	github.io	hmrc-refund.github.io	Any GitHub user who chose that name

The last two are the dangerous case. A "last two parts" rule of thumb would call them netlify.app and github.io, two well-known services, and the link would look trustworthy. Under the Public Suffix List they are ordinary user sites, and the brand name in front proves nothing.

Shared hosting: the domain is real, the page is not theirs

Some well-known domains serve pages that any user can make, even though the domain itself is not on the suffix list: Google Sites and Google Forms pages under google.com, shared files on Dropbox or OneDrive, and blogs on free website builders. The checker flags these: the domain is genuine, so judge the page by what it asks you to do. A login form or a payment request on a shared page is a strong warning.

Tricks the checker looks for

Look-alike letters: "rn" for "m", a zero for an "o", or foreign letters hidden as "xn--".
An "@" before the address: everything before it is ignored by the browser.
A bare number (an IP address) instead of a name.
Shorteners that hide the destination.
Endings that look like files, such as .zip or .mov.
A brand name outside its own domain, including on a shared host.

How our check is simplified

The checker carries a compact copy of the Public Suffix List: more than a thousand country endings of the .co.uk kind and about thirty common hosting endings, taken from the list as published on 28 December 2025. The full list has about ten thousand entries and is updated often, so an unusual ending can still be read wrongly. Treat the result as a reading aid, not a verdict.

https is not a safety sign

The padlock means the connection is encrypted, not that the site is honest. The FTC's wording: the "s" "doesn't mean it's a legitimate site", and scammers know how to encrypt sites too (FTC).

A clean result is not a guarantee

Scammers register new, plausible domains every day. If the message pushes you to log in or pay, go to the company yourself instead. The NCSC reports 454.8 thousand scam web addresses removed by July 2026 (NCSC).