PHISHING
How to inspect a suspicious crypto URL
Inspect a suspicious link without opening it. Try local URL checks and three practice examples, then learn what the results can and cannot tell you.
Paste an address to inspect it locally, or try a practice example. Nothing connects to the submitted website. Read the step-by-step guide ↓
Inspect a link here
READ-ONLYOr learn with a reserved example:
Find the actual hostname
A URL contains separate components. The hostname identifies the destination. Branding in a path, a query, or a prefix does not change that destination. In the illustrative address trezor.io.claim.example, the destination is outside trezor.io.
MDN: the hostname in a URL ↗Look closely at the @ character
URLs can contain a username before @. In https://ledger.com@claim.example the hostname is claim.example. The text ledger.com is in the username position. These examples are illustrations, not allegations about real websites.
MDN: the username component ↗Treat unusual encoding as a reason to verify
Browsers normalize internationalized domain names, which can appear in an encoded form beginning with xn--. This is used by legitimate sites too. An encoding flag tells you to inspect the address, not that a website is malicious.
MDN: internationalized hostnames ↗Understand the limits of this tool
CryptoStronghold checks a small set of address patterns in your browser. It does not visit the page, follow redirects, consult a threat database, or authenticate a business. A fresh phishing site can have an ordinary-looking address. No detected pattern therefore means inconclusive.
Choose a separate route
Use an existing bookmark or a source you have independently verified. Avoid connecting or signing merely to investigate a suspicious link. If a message creates urgency, slow down and verify the request outside that message.