Skip to content
Get incident response
Kytheos

Free tool

Guardian scam check

Received a link or message you are not sure about? Paste it here. Guardian shows the signs of a scam it finds, the evidence for each, and what to do next.

What do you want to check?

What you paste is checked in memory and never stored. We do not open the link: we only ask public DNS, the domain registry and well known link shorteners. Remove names and account numbers if you like; Guardian does not need them.

What Guardian looks for

Fake addresses

Look-alike spellings of banks, payment apps, couriers, platforms and government services worldwide, letters from other alphabets that look the same, brand names in front of someone else's domain, and short links that hide where they go.

Brand new sites

Scam sites are usually days or weeks old. Guardian reads the registration date from the domain registry where the registry publishes it.

Scam scripts

Requests for an OTP or PIN, remote access apps, fake police and "digital arrest" threats, account blocking, parcel fees, prizes, task jobs and investment promises, in 15 languages including Spanish, Arabic, Chinese, Hindi and Russian.

Guardian never calls anything safe. The best answer is "no warning signs found", because new scams appear every day. If a check cannot be completed we say so and never count it as a pass.

All free tools