Paste a page URL and page HTML or source. This runs the same trust-borrowing signal the extension uses to catch fake pages that lean on real brand assets, policy pages, and support links.
Phishing pages often borrow legitimacy by linking to real brand-owned assets: a privacy page, a support link, a hotlinked logo, or a script from a known brand domain. That does not make the page real. It just makes the fake page feel more believable.
If the tested page lives on an unrelated domain but links out to PayPal, Google, Microsoft, Apple, or bank-owned resources, the mismatch matters. If the page also contains a password field, the risk score rises because the borrowed trust is now supporting a likely credential flow.
Paste the page URL and the saved HTML or source. The checker resolves relative links against the page URL the same way the browser does, then compares those outbound references against the trusted-brand map bundled into the extension.
A clean result only means this specific signal stayed quiet. It does not guarantee the page is safe. The extension combines this with other signals like domain mismatch, hidden iframes, suspicious password forms, and exposed token patterns.
People do not audit a page before typing a password into it; they glance at it. A footer carrying a real Privacy and Terms link pointing at the genuine brand domain, a logo hotlinked from the brand's own CDN, and a support address that resolves correctly all read as evidence that the page is legitimate. None of them are. Every one of those assets is publicly reachable, so anyone can reference them from anywhere. The links are real; the page is not. That is the whole trick, and it is cheap enough that phishing kits ship with it by default.
The mismatch is invisible to a person skimming a page but obvious to code. A browser resolves every outbound reference anyway, so comparing the host of each reference against the host of the page costs nothing. When a page served from paypal-secure-verify.xyz pulls its logo and legal links from paypal.com, the discrepancy is arithmetic rather than judgement. Reputation services cannot help here, because the phishing domain is usually hours old and the brand domains it borrows from have spotless reputations.
Do not enter anything into it. Close the tab and reach the service the way you normally would — a bookmark, or the address typed by hand. If you have already submitted credentials, change that password everywhere you reused it and check the account's active sessions and recent sign-ins. If the page asked for a one-time code as well, assume the attacker used it immediately and revoke any session you do not recognise.
Everything on this page runs in your browser. The URL and HTML you paste are never uploaded, logged or transmitted, which is why the tool works on internal pages and staging environments that a hosted scanner could never reach. You can confirm it by opening your browser's Network tab and running a check: nothing goes out.
Last updated: