Scam Link Checker

How this checker works

This tool never opens your link. It only reads the structure of the address and looks for patterns that show up again and again in online fraud cases in Malaysia: bank or government names placed on domains they do not own, cheap domain endings popular with scammers, shortened links, raw IP addresses, hidden characters, punycode lookalikes, and links that download APK files.

Each sign adds to a score that gives a low, medium or high risk result. A low result does not prove a link is safe. Scammers can register clean-looking domains, so always ask yourself: was I expecting this message?

7 signs a link is a scam

1. The bank name is in the wrong place

What decides who owns a website is the real domain: the last two or three parts before the first slash. In maybank2u.com.my.verify-account.top the real domain is verify-account.top. The "maybank2u" at the front is decoration.

2. A government agency without .gov.my

LHDN, KWSP, PERKESO, JPJ and PDRM use domains ending in .gov.my. A "tax refund" link on lhdn-refund.com is fake.

3. An APK file from WhatsApp

This is the most damaging trick in Malaysia right now. Victims are asked to install an app to book house cleaning, open a digital wedding invitation or "track a parcel". The app then reads SMS one-time passwords and empties the bank account. Never install .apk files from outside Google Play.

4. A shortened link

Bit.ly, TinyURL and similar services hide the real destination. They are used legitimately in marketing, but from an unknown number, treat them as risky.

5. An @ symbol in the address

Browsers ignore everything before @. The link https://[email protected] actually opens scam.top.

6. Time pressure

"Your account will be blocked in 24 hours", "unpaid summons", "claim your prize today". Banks and agencies do not ask you to log in through a link in an SMS.

7. Lookalike letters

Domains like rnaybank (r and n pretending to be m) or sh0pee (zero instead of o) are easy to miss on a phone screen. Domains starting with xn-- contain foreign letters that look like Latin ones.

Already clicked or shared details?

1. Call your bank right away using the number on your card or the bank's official site.
2. Call the National Scam Response Centre (NSRC) on 997 if money has been transferred.
3. Change the passwords of affected accounts and turn on two-step verification.
4. If you installed an APK, switch off mobile data, uninstall the app and get technical help.
5. Make a police report. You can check a recipient's bank account or phone number at Semak Mule (PDRM).

For companies: phishing is the front door

Most ransomware and data theft incidents start with one email or message clicked by an employee. This tool helps individuals; organisations need staff awareness training, regular phishing simulations and penetration testing to learn how far an attacker can get after a single click.