A link checker evaluates a web address before or while it is opened and looks for technical signals associated with malicious destinations. In dfndr security, the feature is called URL Checker. It can add a useful security check, but it cannot prove that a sender, purchase, payment request, or business story is legitimate.
How a link checker evaluates suspicious URLs
A link checker analyzes a URL and provides a risk assessment. Its purpose is to add technical evidence to a decision that should also consider the registered domain, the source of the message, the reason for the request, and the action the page wants the user to take.
This page explains the tool. For a manual inspection process, see how to tell if a link is safe and how to identify a fake URL.
How does dfndr security check links?
According to the current dfndr security listing on Google Play, the app provides real-time protection against scams and fake websites and uses Android’s Accessibility permission to alert users when they click a malicious link. Feature names, availability, and behavior may vary by app version, device, region, permissions, and subscription.
When the app reports a dangerous destination, stop before entering information, downloading a file, or granting a permission. When it reports no known threat, continue evaluating the context. Newly created, redirected, or compromised pages may not yet be classified.
How to inspect a link before opening it
On a computer, hover over the link and read the destination. On a phone, press and hold when the app supports a preview or copy option. Do not shorten, edit, or remove parameters before analysis because doing so can change the destination being evaluated.
Before acting:
- identify the registered domain;
- compare it with the organization’s official domain;
- confirm that the message was expected;
- question urgent requests for credentials, money, or downloads;
- open the official app or a saved bookmark when an account is involved;
- use the checker as an additional signal, not final authorization.
QR codes should be treated as links. Review the destination shown by the scanner before continuing, especially when a code appears on a removable sticker or unexpected message.
How to interpret a link-checking result
- Known or suspected threat: do not open the page or share the link with others.
- No threat detected: verify the domain, sender, and requested action independently.
- Inconclusive or unexpected result: treat the destination as unverified.
- Browser or Android warning: do not bypass it merely because the message appears urgent.
HTTPS and a padlock mean that traffic to the destination is encrypted. They do not establish that the destination belongs to the company it imitates. A phishing site can use HTTPS while securely collecting information for a criminal.
When is a link checker most useful?
Additional analysis is valuable for unexpected delivery notices, password resets, shared documents, job offers, invoices, account warnings, shortened links, and QR codes. It is especially important when the page asks for a password, one-time code, Social Security number, payment information, remote access, or software installation.
The CISA guidance on recognizing phishing recommends resisting pressure to act and reporting suspicious messages. If a message claims to come from a known company, navigate independently instead of relying on the included link.
What a link checker cannot confirm
A technical scan cannot determine whether a seller will deliver a product, whether a caller is really from a bank, or whether a payment request came from a relative. A legitimate website can be used in a deceptive story, and a compromised trusted account can distribute harmful links.
PSafe’s analysis separates three questions:
- Destination: does the URL show known technical risk?
- Story: did the claimed person or organization actually make the request?
- Action: what could happen if the user submits information, installs something, or sends money?
A favorable technical result cannot repair a false story. The safest decision combines all three checks.
What to do after opening a suspicious link
Close the page and do not continue interacting. If no information was entered and nothing was downloaded, review browser and device warnings and monitor for unusual behavior. If a password was submitted, change it through the official service, end unfamiliar sessions, and enable two-factor authentication.
Contact the bank or payment provider immediately if money or financial information was involved. Remove unexpected downloads or permissions and follow what to do after clicking a fake link.
Frequently asked questions about link checkers
Does a clean result guarantee that a link is safe?
No. It means the tool did not identify a known threat using the information available at that time.
Can a shortened link be checked?
It can be analyzed, but shortening hides the final destination. Reveal and verify the destination when possible and read are shortened links safe?.
Does the checker confirm an online store?
No. Store ownership, inventory, delivery, return policies, and payment legitimacy require separate verification.
Can QR codes lead to malicious pages?
Yes. A QR code can encode the same websites, downloads, payment requests, and account actions as a visible link.
What should I do when dfndr reports a dangerous link?
Stop, avoid sharing information, and report or delete the message using the platform’s available controls.