Skip to content
ScanMyPrivacy
Menu

Privacy and leak tests

Full Privacy ScanDNS Leak TestWebRTC Leak TestBrowser Fingerprint TestAm I Using a VPN?HTTP Headers ViewerUser Agent CheckerOpen Port Checker

Online safety assistant

Website Safety CheckerSuspicious Link CheckerScam and Phishing Message CheckerBrowser Security GuideMobile App Safety CheckPersonal Security Checkup

IP and network lookups

IP LookupMy IP LocationWhat Is My Public IP?What Is My IPv6 Address?Reverse DNS LookupDNS Lookup
Online safety Guides API About

Scams & phishing

How to spot fake login pages and lookalike domains

Updated · 2 min read

Written by the ScanMyPrivacy team. How we write and check guides · Report a correction

Try it yourself:Suspicious Link CheckerScam and Phishing Message CheckerPersonal Security Checkup

A fake login page copies the look of a bank, email or delivery site so you type your password into it. The page can look perfect. The address is where the difference shows, and it takes about ten seconds to check.

Read the address from the right place

The part that matters is the registered domain, which sits just before the first single slash and after any dots. In https://login.example.com/account the domain is example.com. In https://example.com.account-check.net/login the domain is account-check.net; "example.com" is only a prefix designed to fool you. Text before the domain, such as login., is chosen by whoever owns the domain.

Common lookalike tricks

  • Misspellings: a letter swapped, doubled or dropped (for example "paypa1" with the digit one, or "rnicrosoft" using r and n instead of m).
  • Extra words: "secure-", "-login", "-support" or "-verify" added to a real brand name.
  • Brand in the wrong place: the brand name appears as a subdomain or in the path, but the domain is something else.
  • Look-alike characters: letters from other alphabets that appear identical. Browsers often show these in a special encoded form that starts with "xn--".
  • Shortened links: a short link hides where it goes. Preview it before opening.
  • Unusual endings: a brand name with an uncommon ending such as .top or .xyz.

The padlock does not mean safe

The padlock means the connection to that site is encrypted. Criminals get certificates for fake sites too, so a padlock tells you nothing about who owns the page.

A routine that works

  1. Do not log in from a link in a message. Open the official app, or type the address yourself or use your own bookmark.
  2. Check the domain using the steps above, or paste the link into the suspicious link checker, which flags these patterns in your browser.
  3. Use a password manager. It fills your password only on the real domain, so a lookalike gets nothing. That is one of the best protections.
  4. Turn on two-step verification so a stolen password is not enough. See strong passwords and two-step verification.

If you already entered your password

Change that password from the real site straight away, change it anywhere else you used it, and follow what to do if you clicked a phishing link.

If the message itself is the concern, the scam and phishing detector can point out pressure tactics in the text. No tool can promise a page is real, so when unsure, go to the organisation's site yourself.

Tools that can help

Password managers

What it does: Create and store a different strong password for every account, and fill it in only on the right website. What it does not do: Protect you if you hand a password to a fake site yourself, or if your device is already infected. Pair it with two-step verification.

  • BitwardenFree tier and paidNo commissionOpen-source password manager with a free tier and paid plans. Visit site
  • KeePassXCFreeNo commissionFree, open-source manager that keeps your passwords in a file on your own device. More hands-on to set up and sync. Visit site

We list free and built-in options first. How we choose.

Keep reading

What to do if you clicked a phishing linkClicked a suspicious link or typed a password on a fake page? Follow these steps in order: what to change, check and report, and what can wait.Strong passwords and two-step verification, made simpleSecure your accounts: unique passwords with a password manager, two-step verification starting with email, and how to end a stolen session.What to do after an online fraud in IndiaPaid a scammer, shared an OTP or clicked a fake link? A first-hour checklist for India: bank, 1930 helpline, cybercrime portal, evidence and Chakshu.Fake virus warnings and malicious popups: what to doPopups claiming your device is infected are scams. Learn to spot them, close them safely and clean up notification and extension settings.Canvas Fingerprinting ExplainedHow canvas fingerprinting works, why the same drawing produces different pixels on different devices, who uses it, and how browsers defend against it.How to Prevent Browser FingerprintingPractical ways to reduce browser fingerprinting: the browsers and settings that help, the tricks that backfire, and how to test whether your changes worked.

Frequently asked questions

Does HTTPS mean a website is legitimate?

No. It means the connection is encrypted. Fake sites can have it too.

Can a password manager help spot fake sites?

Yes. It offers your saved password only on the exact domain it was saved for, so a missing suggestion is a warning sign.

What if the link came from a friend?

Accounts get hijacked, so confirm with them another way before logging in through it.