MailFixly

Home / Sign-in URL checker

Free tool · nothing leaves your browser

Is this sign-in page real?

Paste the address you are about to sign in on. This checks whether the domain genuinely belongs to Microsoft, Google or Yahoo, and flags the tricks fake pages use to look like they do.

Check a sign-in address

Copy the whole address from your browser address bar. Only the domain is examined.

Try one: a genuine Microsoft page · the subdomain trick · a lookalike

What this actually checks

Most people spotting a fake sign-in page are told to "check the URL", which is good advice that nobody can act on reliably, because the interesting part of a web address is not where people look. This tool checks the five things that matter.

CheckWhat it catches
Real owner of the domainWhether the registrable domain genuinely belongs to Microsoft, Google or Yahoo
The subdomain tricklogin.live.com.attacker.net — contains a real domain but is owned by someone else
Brand baitWords like outlook, verify or secure in a domain that is not the provider's
Punycode / homographsxn-- domains that can render as ordinary-looking letters
Plain HTTP and raw IPsSign-in pages that are unencrypted or hosted on a bare IP address

Why the subdomain trick works on almost everyone

Take these two addresses:

https://login.live.com/oauth20_authorize.srf
https://login.live.com.account-verify.net/oauth20_authorize.srf

The second is not Microsoft. The domain that owns a page is the part immediately before the final suffix, so the owner there is account-verify.net, and login.live.com is just a subdomain it chose to name that way. Anyone can create it.

This defeats the natural instinct, which is to scan the address for a familiar name and relax when you find one. It also defeats naive checkers that ask only whether the real domain appears somewhere in the address. This one looks for the construction specifically.

The genuine sign-in domains

Worth knowing by sight, because the reliable habit is typing the address yourself rather than checking one you were sent.

ProviderGenuine sign-in domains
Microsoft / Outlook / Hotmaillogin.live.com, login.microsoftonline.com, account.microsoft.com, outlook.com, outlook.live.com
Google / Gmailaccounts.google.com, myaccount.google.com, mail.google.com
Yahoologin.yahoo.com, mail.yahoo.com

What to do if a page fails the check

  1. Do not type anything into it. Not your password, not your email address, not a verification code. Close the tab.
  2. Go to the provider directly. Open a new tab and type the address yourself, or use your own bookmark. Never return through the same link.
  3. If you already entered a password, change it now on the provider's real site, and change it anywhere else you reused it.
  4. Check your recovery details. The first thing an attacker changes is the recovery email or phone, to lock you out of your own recovery.
  5. Review recent activity in your account's security settings for sign-ins you do not recognise.

MailFixly will never ask for your password. No page on this site has a password field, and this tool sends nothing anywhere. If you find a page claiming to be us that asks you to sign in, it is not us — tell us about it.

Privacy

The check runs entirely in your browser. There is no network request in the tool, nothing is logged, and nothing is stored. You can verify that by opening your browser developer tools and watching the network tab while you use it, which we would rather you did than take our word for it. See our privacy policy.

Frequently asked questions

Does this tool send my URL anywhere?
No. The check runs entirely in your browser using JavaScript on the page. There is no network request in the tool at all, nothing is logged, and nothing is stored. You can confirm this by opening your browser developer tools and watching the network tab while you use it.
What is the subdomain trick?
A fake page uses an address like login.live.com.account-verify.net. It contains a real Microsoft domain, so it passes a careless glance and defeats naive checkers that only ask whether the real domain appears somewhere in the address. The domain that actually owns the page is the part immediately before the final suffix, which here is account-verify.net. This checker looks for exactly that construction.
Does a green result mean the page is definitely safe?
It means the domain genuinely belongs to that provider, which is the single most useful thing to know. It cannot tell you a page is safe in every other respect. Always reach sign-in pages by typing the address or using your own bookmark, never through a link in an unexpected message.
Why does it flag addresses that are not HTTPS?
A password sent over plain HTTP travels unencrypted and can be read in transit. No genuine provider asks for a password over an unencrypted connection, so an HTTP sign-in page is either broken or hostile.
What is punycode and why is it flagged?
Punycode lets domain names use non-Latin characters, which is legitimate. It also allows characters that render almost identically to ordinary letters, so a domain can look like a familiar brand while being something else entirely. Punycode in a sign-in address is not proof of an attack, but it is worth knowing about before you type a password.
Outlook will not let you sign inWhen the password is right and sign-in still fails. Forgot your passwordReset and recovery, and what the recovery form scores. All Outlook and Hotmail helpEvery guide, organised by symptom.