URL structure checks before anything is fetched
The first pass needs no network. A raw IP address as the host adds 25 points. An '@' before the host adds 20, because browsers discard everything before it and the real destination hides behind. Punycode (xn--) adds 20 and the finding shows the Unicode form so you can spot look-alike letters. A host with five or more labels adds 10, two or more hyphens in the domain label add 5, and a URL longer than 120 characters adds 5.
Plain http adds 10. Extensions that are cheap to register and heavily abused, such as .top, .xyz, .tk, .icu, .zip and .mov, add 10. Known URL shorteners add 5 as information. The redirect chain later shows where they lead. These points are small individually and are meant to accumulate.
Brand names and lure words
The host and path are searched for forty brand names: payment services, mailbox providers, parcel carriers, banks, exchanges and tax authorities. If a brand appears but the registered domain's first label is not that brand, 25 points are added with a message naming the mismatch, for example a link mentioning paypal on secure-login.example.xyz.
Words that attackers rely on to make you act, such as login, verify, secure, account, suspended, billing and recover, add 5 points each up to 15. After the page is fetched the title is checked the same way: a title that claims a brand while the final site is a different registered domain adds another 15.
Registration, blocklists and Safe Browsing
The registered domain (the registrable part, so login.example.co.uk becomes example.co.uk) is queried in parallel against RDAP for its creation date and registrar and against Spamhaus DBL, URIBL and SURBL. A blocklist hit names the list and the category, such as phishing domain or abused redirector. When the age cannot be determined the tile shows Unknown and no points are added.
Google Safe Browsing is consulted only when the operator has configured an API key. With a key, the Threat blocklists tile shows a Safe Browsing: clean or flagged note and a match adds 80 points. Without a key that note is absent and nothing is assumed. The other signals still run.
Reading the Page card
Final URL and HTTP status tell you where the link actually ends up after redirects, and the chain lists every hop with its status code. A different registered domain at the end is noted as information, since shorteners and tracking links do this legitimately. An untrusted certificate at the destination adds 15 points.
Password form shows whether the HTML contains an input of type password. On a domain under 180 days old or one that impersonates a brand that is a 15-point fail. On an established domain it is only noted. Form posts to lists up to five form actions whose domain differs from the page, worth 15 points, because credential harvesters often post to a collector elsewhere.
- Page could not be loaded: common for phishing pages already taken down, or sites that block server fetches
- TLS certificate Invalid: a self-signed, expired or mismatched certificate at the destination
- Form posts to Same site: nothing on the page submits to another domain
What a clean result does and does not mean
No phishing signs found means none of the checks above fired, not that the page is safe. Fresh phishing domains appear faster than lists update, pages can serve different content to a server than to a phone, and a compromised legitimate site passes the age and brand checks. Treat the result as one input and the pressure in the message as another.
If the link already got a password out of you, change it on the real site and anywhere you reused it, and turn on two-factor authentication. To dig into a domain's ownership and registration history use the WHOIS lookup. To see the mail that carried the link, paste its headers into the email header analyzer.