What we check
Eight risk signals. Instant results.
The moment an email loads, Haven analyzes every link against eight categories of risk. Hover any signal to see what it catches.
Brand impersonation
Catches URLs that mimic trusted brands, like paypa1.com instead of paypal.com.
Lookalike characters
Spots sneaky character swaps and mixed-script tricks designed to fool the eye.
Domain structure
Flags raw IP addresses, risky endings like .xyz, and excessive subdomains.
Suspicious keywords
Detects phishing words like 'verify' and 'login' paired with brand names.
Redirect unwrapping
Reveals where shortened and tracking links actually take you.
Destination mismatch
Checks the link matches the brand the email claims to be from.
Hosting platform
Identifies links on free platforms known for hosting phishing pages.
TLD risk
Weighs how often a domain ending shows up in phishing attacks.
Answers to Your Questions
Get answers to commonly asked questions about Haven's link analysis.
Contact us