Bug Circuit

Free tool · no signup

Phishing email checker

Paste a message you are not sure about. The checker lists the warning signs in the wording, and shows where each link really goes and whether the address is a look-alike.

By the Bug Circuit security team · Last updated

Paste the suspicious message

Paste a message to see its warning signs, and what each link really points to.

How can I tell if an email is phishing? Look for pressure to act fast, a threat about your account, a request for a password or a code, links that go somewhere other than they say, and addresses that imitate a real brand. Paste the message here to find them. A clean result is not a guarantee, so check with the sender another way before you act.

How it works

What it looks for in the text

Most phishing relies on a few tricks. Urgency (act within 24 hours) stops you thinking. A threat about your account (suspended, locked, unusual sign-in) makes you want to fix it at once. A request to verify or update your details, to share a one-time code, or to pay by gift card, wire or crypto is the real goal. Prizes and windfalls, unexpected invoices, a generic greeting such as Dear customer, a legal or tax threat, a request to keep it secret and attachments with risky names such as .html, .js, .iso or macro-enabled documents are all common. The tool matches these patterns and names each one it finds.

What it checks in the links

It lists every link, including the real address behind linked text if you paste the HTML source, and checks each one. It flags bare IP addresses, an @ sign that hides the real host (everything before it is ignored), punycode look-alike characters, link shorteners that hide the destination, plain http, odd ports, many stacked subdomains and a few endings often used in scams. The most useful check is the brand look-alike test: an address such as paypal-secure-login.example.xyz or login.microsoft.com.evil-site.net is flagged, because the real brand domain is whatever comes right before the ending, not whatever appears at the start.

It also compares the text of a link with its destination. A link that reads www.paypal.com but goes to a different site is one of the strongest signs of phishing.

What a result does and does not mean

The tool counts warning signs and weights them, and it never says a message is safe. A well-made targeted phishing message, written by a person who knows you, may trigger nothing here. So the rule is the same whatever the result: do not click links or open attachments in unexpected messages, go to the real site by typing its address, and confirm money or account requests by a phone number you already have. If you did click and entered a password, change it from a clean device and sign out of all sessions. For the delivery details of a message, use the email header analyzer.

Worked examples

A classic account-suspended scam

Dear customer, your PayPal account has been suspended. Verify immediately: http://paypal-secure-login.example.xyz/verify

Many warning signs: treat it as phishing
Pressure to act quickly (medium)
A threat about your account (medium)
Asks you to verify or update your details (high)
Looks like Paypal, but the domain is example.xyz (high)

The real PayPal sites end in paypal.com. Words before the registered domain mean nothing.

A link that lies

Link text www.paypal.com/verify, real address http://198.51.100.9/login

The link text shows one site but goes to another (high)
The link goes to a bare IP address (high)

Hover over a link to see its real address before you click, and prefer typing the site address yourself.

An ordinary message stays quiet

Hi Sam, the meeting moved to 3pm. Agenda: https://docs.google.com/document/d/abc

No red flags found

That is not a guarantee, only that nothing in it matches the usual patterns.

Frequently asked questions

How can I tell if an email is phishing?
Check the sender address, hover over links to see where they really go, and look for urgency, threats, requests for passwords or codes, and unexpected attachments. When in doubt, contact the sender by another route.
Is it safe to paste a phishing email here?
Pasting text is safe, because nothing in it is opened or fetched, and the check runs in your browser. Do not click any link inside the message itself.
Does a clean result mean the email is safe?
No. Targeted phishing can be written to look entirely normal. The tool finds common warning signs and cannot see the sender's intent.
What should I do if I clicked a link?
If you entered a password, change it from a clean device and sign out of all sessions. Turn on two-factor authentication, check for forwarding rules on your mailbox and tell your IT contact.
Why is a link shortener a warning sign?
It hides the destination. Real companies seldom use shorteners in account emails, and scammers use them to disguise bad addresses.
What is a look-alike domain?
An address that imitates a real brand using extra words, swapped letters such as paypa1, or characters from another alphabet. The tool checks the registered domain against the brand's real ones.
Where do I report phishing?
Forward it to your mail provider's report address or use the Report phishing button, tell your IT team, and in many countries to the national anti-phishing service. Then delete it.

Keep reading

Email Header AnalyzerTrace the route and check SPF, DKIM and DMARC.Password Breach CheckerSee if a password has appeared in a breach.Email Spoofing CheckerCan your own domain be faked?My website was hackedFirst-response steps after a compromise.

See what attackers see, for free

Run the free passive check on your website. No login, no impact on your site, results in seconds.

Ready for the full manual audit? See pricing

Phishing Email Checker: Spot the Red Flags · Bug Circuit