Know before you click.
Analyze suspicious websites for phishing, scams, malware indicators, and other security risks with an intelligent website safety scanner.
Only public HTTP/HTTPS sites on ports 80 and 443 are scanned.
Click an example to fill the field, then scan.
Live phishing test
Loads a real URL from a current phishing feed. It should trigger a high-risk match. Scan it only; do not open it directly.
Legitimate examples
Established sites for comparing an ordinary low-risk result.
Threat matches depend on available providers. The keyless Phishunt feed is checked by default; without it or another provider, the report will honestly show that reputation coverage was unavailable.
Submitted URLs may be sent to configured threat-intelligence, RDAP, DNS, and AI services during the scan. Avoid submitting links that contain private tokens or personal information. JavaScript is never executed, forms are never submitted, and downloads are never opened.
URL & lookalike analysis
Encoding, IP usage, nested subdomains, brand similarity, and deceptive path patterns.
Domain & registration
RDAP registration age, registry status, DNS records, nameservers, and TLS certificate data.
Threat intelligence
Checks a keyless community phishing feed and queries any configured Google Safe Browsing, VirusTotal, and URLhaus integrations.
Safe content review
Retrieves limited public HTML without executing JavaScript, submitting forms, or opening downloads.
Provider availability depends on server-side API configuration. The scan report marks every unconfigured or failed source as unavailable — never as clean.
Trust through transparency
A verdict should show its work.
Securvex separates confirmed intelligence from weak signals, and clearly labels checks that could not run. The score is an estimate with documented inputs — not a black box.
See the complete methodWhat the scan does
- Queries only sources that are actually configured.
- Shows provider status, evidence, and query time.
- Revalidates redirects and blocks private networks.
- Uses deterministic rules for the verdict and score.
- Distinguishes confirmed findings from weak heuristics.
What it never claims
- That a website is guaranteed safe.
- That HTTPS alone makes a business legitimate.
- That an API timeout is a clean result.
- That AI can override a verified malicious match.
- That a new domain is automatically fraudulent.
No scan sees everything. Content behind logins, client-side rendered pages, newly weaponized domains, and targeted attacks can remain invisible. Use the report to make a more informed decision, not as a replacement for judgment.
How it works
From URL to evidence in three steps.
The scan runs real checks in parallel, then presents only the evidence that was actually collected.
Enter a website URL
The server validates the URL, blocks local and private destinations, and normalizes the target. Unsupported schemes and non-web ports are rejected.
Analyze reputation & signals
Available threat-intelligence, RDAP, DNS, TLS, redirect, and safe content checks run. Each source reports success, failure, or non-configuration.
Review the risk assessment
Deterministic rules score the evidence. You get a clear verdict, per-check findings, recommended actions, and an honest list of limitations.
Security capabilities
Real checks. Clear boundaries.
Every capability below is implemented in the scanning engine. Third-party features are marked unavailable when their credentials are absent.
Phishing & impersonation signals
Checks for lookalike domains, homoglyphs, brand-plus-keyword domains, deceptive subdomains, and credential-related paths.
Domain age context
Pulls registry RDAP data where available. A newly registered domain is shown as a risk indicator, never as standalone proof of fraud.
TLS & transport evidence
Records certificate issuer, validity window, expiry, and whether the final page used HTTPS. Encryption is not treated as trust.
DNS intelligence
Inspects public A, AAAA, NS, MX, TXT, and CAA records. Missing records are marked unavailable rather than guessed.
Content indicators
Looks for password forms, cross-domain form actions, hidden iframes, download links, payment instructions, urgency, and prize claims.
Redirect transparency
Follows a bounded redirect chain, revalidates each destination, and records cross-domain or HTTPS-to-HTTP transitions.
Transparent scoring
Rule-based category scoring reduces double-counting, separates confirmed intelligence from weak heuristics, and never treats missing data as safe.
Evidence-grounded AI
Optional AI explains the structured evidence in plain language. It cannot change the deterministic verdict or invent provider results.
What a report looks like.
This illustrative example uses fictitious values. It is not a live scan and does not describe any real domain.
Example report · demonstration only
secure-paypa1-login.example
Elevated risk
Estimated, not a probability. Fictitious demonstration.
Lookalike brand pattern
Registered domain resembles a payment brand and adds “secure-login”.
Domain age
Registered 12 days before the demonstration date.
TLS certificate
Valid certificate issued to the domain; encryption alone is not trust.
Threat intelligence
Illustrative providers are shown as not configured in this demonstration.
Questions, answered
Honest answers about limits.
The most important security principle in this product is simple: no threat detected is not the same as guaranteed safe.
Read the privacy policyDoes a low risk score mean the website is safe?+
No. A low observed risk rating means the completed checks did not surface significant weighted indicators. It is not a guarantee, and it cannot detect threats that are not visible to the checker or hidden behind a login.
Does HTTPS mean a site is legitimate?+
No. HTTPS encrypts the connection between your browser and the server. Fraudulent sites can obtain certificates too. The scanner records certificate and transport evidence, but treats domain identity and threat intelligence separately.
Which threat-intelligence providers are used?+
The application checks a keyless Phishunt community phishing feed by default and has adapters for Google Safe Browsing, VirusTotal, and abuse.ch URLhaus. Each optional provider is enabled only when its server-side API credential is configured. When one is not configured or a feed is unavailable, the report says so instead of pretending it was checked.
What does “unable to determine” mean?+
It means too few independent checks completed to produce a risk score. Missing or failed data is not treated as evidence of safety, and an unavailable scan never receives a clean verdict.
Is the submitted URL shared with third parties?+
Yes, when external services are configured. The URL may be sent to threat-intelligence providers, RDAP registries, DNS resolvers, and the configured AI endpoint. Sensitive-looking query values are redacted from saved reports and logs, but external providers may receive the full URL during the scan.
Do you execute the website or download files?+
No. The scanner never executes JavaScript from the scanned site, never submits forms, never attempts logins, and never downloads or runs files. It retrieves a limited public HTML response and treats it as untrusted evidence.
How long are reports stored?+
By default, scan reports are retained for 30 days and then deleted. The deployment operator can change the retention period. Reports are accessed through unguessable links; there are no public scan listings or user accounts.
Does the AI decide the verdict?+
No. URL checks, provider results, and scoring rules determine the verdict. AI is used only to explain those results, and it must first audit the evidence and cite real evidence IDs. Its explanation is checked for invented facts and contradictions; if it fails, the deterministic explanation is shown instead. AI can still make mistakes, but it cannot override the verdict or a confirmed malicious match.
Privacy by design
Minimal data. Clear disclosure. No accounts required.
Reports are retained for a limited period, sensitive query values are redacted, and there are no public scan listings. Submitted URLs may still be sent to configured external services during the scan — the policy explains exactly which ones.