Website Trust Score Calculator

Most phishing attacks succeed not because the fake page is convincing — modern tools make cloning a real login page's appearance almost effortless — but because almost nobody actually looks at the URL itself before typing in a password. This calculator exists because the URL, unlike the page's visual design, is genuinely difficult for a scammer to fake convincingly if you know what to look for, which is exactly what it checks structurally.

HTTPS is the most misunderstood signal. A green padlock or 'https://' used to be a rough proxy for legitimacy, back when getting a certificate required some verification. Today, free automated certificate authorities mean any phishing site can have valid HTTPS in minutes — so its absence is still a real red flag, but its presence no longer proves safety. That's why this tool treats HTTPS as one signal among several, not a pass/fail gate on its own.

The domain itself is where the more reliable signals live. A raw IP address instead of a domain name is something no consumer-facing legitimate business uses, because it's both unmemorable and immediately suspicious to anyone who checks — its presence is close to a guaranteed red flag. Free or heavily-abused top-level domains like .tk, .xyz or .top are legitimately used by some real sites, but they're also disproportionately represented in phishing infrastructure specifically because they're free or extremely cheap to register in bulk, which matters when a phishing domain typically only needs to survive a few days before being taken down.

Brand impersonation is the pattern this tool is built to catch most directly: a domain containing 'paypal,' 'apple,' 'irs,' or another well-known name, where the actual registrable domain isn't that brand's real one. This shows up in two common forms — a domain like 'paypal-secure-login.com' (the brand name plus extra words, on a domain PayPal doesn't own), or a deeply nested subdomain like 'paypal.com.account-verify.tk' (designed so a quick glance at 'paypal.com' near the start looks reassuring, when the actual host is the .tk domain at the end). Both are structurally detectable without needing to know anything about the specific scam campaign behind them.

Not every impersonation attempt spells the brand name correctly, though, which is why a plain substring search for 'amazon' or 'paypal' misses a large share of real typosquats. A domain like 'arnazon.com' never contains the literal word 'amazon' — the 'm' is swapped for 'rn', which renders as something very close to 'm' in most fonts — and 'paypa1.com' swaps a lowercase 'L' for the digit '1'. This tool checks each domain's name against a list of frequently-impersonated brands using edit-distance matching (how many single-character changes separate the two), so a one- or two-character-off spelling gets caught even when the real brand name never literally appears. It also scores domains that stack multiple words common in phishing pages — 'verify', 'secure', 'login', 'account', 'update' and similar — since a domain combining several of these, even with no brand name at all, matches a strong and common fake-login-page pattern.

What this tool can't do — check whether a domain was registered yesterday or five years ago, or cross-reference a live blocklist of confirmed phishing URLs — genuinely requires a server making a request on your behalf, which is exactly the kind of data transmission this tool avoids by design. The tradeoff is a narrower but completely private check: your URL never leaves your browser, and what it does check reflects patterns real enough to catch a large share of phishing links on sight.