HookCheck is a free, public, privacy-first decision-support tool that detects phishing and scams instantly. No accounts, no login, no personal data stored.
Submit a suspicious message, URL, screenshot, or QR code. HookCheck aggregates multi-layered security signals and explains its reasoning in clear, plain language.
HookCheck runs two independent evidence layers on every submission. No single layer silently overrides the other — every report displays findings separately by source so users can make informed decisions.
The first layer runs entirely server-side without external network calls. Because it is deterministic, it cannot be bypassed or fooled by adversarial input.
Typosquatting & Homoglyphs: Calculates edit distances (Levenshtein
≤ 2) against a curated list of commonly-impersonated domains and flags
Unicode substitutions that visually spoof legitimate brands.
- Brand Subdomain Impersonation: Flags when trusted brand names
appear as subdomains of unrelated registered domains (e.g. paypal.com. login-verify.ru).
- TLD & URL Features: Identifies suspicious top-level domains
commonly used in phishing, excessive URL length, known shorteners,
plaintext HTTP, and credential-harvesting keywords in paths.
- Text Pattern Analysis: Detects social engineering language patterns
— urgency cues, payment demands, credential harvesting phrases, and
suspicious contact channels.
Queries VirusTotal's public registry to check domains against 70+ antivirus and threat intelligence engines.
- Corroborating Evidence: VirusTotal findings are treated as supporting data — a "clean" result does not suppress strong flags raised by heuristics, preventing newly registered phishing campaigns from bypassing detection.
The overall threat level is computed from a weighted combination of both layers (60% Heuristics, 40% VirusTotal). Floor rules ensure that strong signals from either layer are never diluted below a meaningful threshold. The result is presented as a categorical verdict (Likely Safe, Medium Risk, High Risk, or Critical Threat) rather than a numeric score.
- Unified Submission Surface: A single interface that automatically
detects input type. Paste text, paste a URL, or drop an image — no manual
mode selectors.
- QR Code & Screenshot Processing: Decodes QR codes for quishing
protection and extracts text from screenshots via OCR, passing payloads
through the full analysis pipeline.
- Privacy-First Cache: Results are cached for up to 24 hours using
only SHA-256 hashes of normalised inputs. Raw submissions are never
persisted.
- Verdict-First Interface: A clear threat badge and plain-language
summary up front, followed by granular per-layer evidence panels.
- Shareable Reports: Analysis reports are available via non-
sequential, randomly generated permalink URLs. All report pages are marked
noindexto prevent search engine indexing.