Check the message separately from the domain you entered
An unexpected message can display a familiar website name while asking you to act through a different link or contact. This tool compares the host you submit with FXCN's saved records. It does not inspect the message, follow the link or establish who is asking for a password, download or payment.
Keep account access and the public-domain check separate
Enter only a public domain. Do not paste a password-reset link, account identifier or one-time token here. Such a full link belongs in a private evidence file if you need to retain it; the domain comparison does not require those details.
The tool extracts a host, normalises its letter case and removes a leading www. for comparison. A path or port is not the host being compared. Check the domain displayed in the result before treating it as the website you intended to assess.
You do not need to open an unexpected link to use this tool. If you cannot confidently identify the public host without disclosing personal information, leave the input alone and use an independently known contact to ask about the message.
The FTC describes messages that imitate familiar companies and use account or payment stories to prompt a click or disclosure. When you know the company, it advises contacting it through a website or phone number you already know is real rather than the message's contact details. A recognisable logo does not answer that identity question.
Three observations can concern different things
These fictional examples use reserved example domains. They are not warnings about real sites and should not be opened. The table shows why the visible message, the value you submit and any browser address are separate evidence.
| Observation | Illustrative value | Host if submitted | What remains unknown |
|---|---|---|---|
| Words displayed in a message | sample.example | sample.example | Those words do not identify the actual destination behind a link. |
| A link address recorded from that message | https://relay.example/x7 | relay.example | This tool does not visit it or follow any redirect. |
| An address already observed in a browser | https://account.example/login | account.example | The tool does not reconstruct how the browser reached that address. |
The three names are deliberately different. Entering the first does not check the second or third. A result for one observation cannot be transferred to the others simply because they occurred during the same conversation.
If a message's displayed name and link address differ, record the difference. It raises a question about the relationship; the difference alone is not a completed fraud investigation. Confirm any claimed relationship through an independently verified channel rather than through the sender who supplied it.
A link can ask for action the domain comparison never evaluates. Keep “which host was compared?” and “is this request authorised?” as separate questions, even when the host matches a saved broker website.
Read a match as a result from saved data
- Saved website match
- The host matches a website field in FXCN's broker data. This does not verify the sender, the message, a payment account or the legality of a particular contract.
- Text similarity
- The entered host resembles names in the saved broker data. Read the listed addresses as comparison records; similarity does not establish that the entered site impersonates them.
- No match
- The current comparison found no matching record. It does not establish that the site is safe, fraudulent, licensed or unlicensed.
- Input not recognised
- The tool did not obtain a usable domain from the input. This is an input result, not a clean security report.
If a saved risk record appears, read its stated reason and any original evidence supplied. Keep its date and scope in view. A historic report about one event is not proof of every allegation attached to a later message.
The tool does not fetch the entered site, test an attachment or app, inspect a login session, follow redirects or query a regulator's live register during the comparison. It cannot determine whether a transfer recipient is the contracting firm. Do not use the result as permission to disclose credentials or send money.
Verify the request through a contact obtained independently
- Preserve the request: keep its time, sender details, displayed wording and any public link address. Do not publish a reset token or full personal account identifier in your evidence summary.
- Find a known contact: use a previously verified account channel or independently obtained official details. A phone number pasted in the same unexpected message is not independent corroboration.
- Describe the exact action: ask whether the firm sent this request and whether the particular payment, download or account change belongs to its process. Verification of a general website does not answer that specific action.
- Record the response: retain who answered, through which channel and what they confirmed. If they identify another legal entity or service, check that identity separately.
If you have already disclosed credentials, describe what was shared through the genuine account-support channel and secure the affected account using that service's actual recovery process. If money was sent, retain the transfer reference and contact the payment provider about the transaction. A domain comparison cannot reverse either event or promise recovery.
If the other party claims regulatory authorisation, check the actual legal entity, service and contact information through the relevant official register. A licence number copied into an email does not authenticate its sender.
Questions after comparing a domain
Can a familiar domain in the message make its sender genuine?
No. Anyone can write a website name in a message. Compare the actual public host where relevant and verify the sender and requested action independently.
Does this tool check the final destination of a short link?
No. It compares the host extracted from your input and does not follow redirects. Do not describe that result as an assessment of the unseen destination.
Does a saved broker website match approve a payment request?
No. The match concerns the stored website field. The contractual party, recipient and requested action still need their own evidence.
Source and comparison boundary
FTC: How To Recognize and Avoid Phishing Scams — imitated messages and independent contact. The source is consumer guidance, not a finding about any domain entered here.
The saved-data descriptions above reflect FXCN's actual tool behaviour reviewed on the stated date. No example domain was visited and no personal account or payment was tested.