Pause and keep the context
Do not reply or open the destination. Consider who sent the content, what action it requests, and whether the communication was expected.
First check
Do not open the link until you know which domain it uses.
A button may say “Bank,” “Delivery pending,” or “Verify account,” while its real destination uses an unrelated domain. Long-press to preview the link or copy it without opening it when the source app supports that action.
Read the domain carefully. Extra subdomains, swapped letters, unnecessary hyphens, lookalike characters, or an unexpected top-level domain can indicate impersonation. HTTPS encrypts the connection, but it does not prove that the site itself is trustworthy.
Recommended process
Five steps for reviewing a suspicious URL.
Copy the URL without visiting it
Use the copy-link option or share the text with EdgePhishGuard. If the address is inside a screenshot, import the image and extract the URL with OCR.
Inspect the real domain
Look for misspellings, visually similar characters, extra names before the recognized domain, and paths designed to imitate a login page.
Run the EdgePhishGuard analysis
Paste or share the URL. The app combines structural URL rules, compact reputation lists, and phishing signals, with the primary analysis running on the device.
Verify through an independent channel
If the message claims to represent an organization, open its official app or type its known address yourself. Do not use contact details from the suspicious message.
Interpret the result
A risk score supports your decision; it does not replace human verification.
Low risk
No strong signals exceeded the configured threshold. Still verify the sender and domain when a request is unexpected.
Review
The URL contains details that deserve a second check. Do not enter information until the destination is confirmed through an official channel.
High risk
Enough signals were triggered to recommend that you avoid the link and do not share credentials, codes, or financial information.
Why results can change
Domains, campaigns, and tactics evolve. No detector can guarantee that it will identify every threat, and a low result does not make an unexpected request trustworthy.
Visible evidence
Read the explanation before you decide.
EdgePhishGuard displays the estimated probability, domain, and signals behind a warning. The goal is to provide context instead of asking you to trust only a “safe” or “dangerous” label.
Analyzed content is not sent to a server for phishing detection. Separate remote services may support configuration, list updates, or app stability, as explained in the privacy policy.
Independent guidance
Combine the app with basic security habits.
CISA advises people to recognize urgent or emotionally appealing language, requests for personal information, and incorrect addresses or links. If a request may be genuine, contact the organization through information you already trust.
Next guide
Is the destination hidden in a QR code?
An additional Android check
Analyze the link before you open it.
Install EdgePhishGuard from its official Google Play listing. Do not open a link solely because a tool found no strong signals.
