paypal.statement-verify.clickOwner: statement-verify.click
The differentiator
It reads the link against the conversation.
Most URL checkers score a domain. PrivateCue reads the link against what the person claimed two lines above it, and caps weak evidence.
Message says“This is Chase fraud team.”
Address leads to
chase-secure-verify.topActual ownerchase-secure-verify.topNot chase.com
The differentiator
It reads the link against the conversation.
A domain checker scores the address. It cannot see that the person wrote “this is Chase” and then sent a link belonging to somebody else — the claim two lines above is exactly what a URL-only checker misses. How the module works.
Three kinds of finding, deliberately unequal
- Contextual — needs the conversation to exist: an institution named, a link that is not theirs; a link straight after a money demand. Behavioural evidence, and it carries real weight.
- Brand — the address versus the name in front of it: combosquats, typosquats, homoglyphs, a brand parked in a domain it does not own.
- Structural — properties of the string alone: a bare IP, a shortener, a deep subdomain chain. Weak on their own, and capped so they stay weak.
A strange link cannot accuse on its own. With no fraud script matched, structural findings add at most four points to a hundred. Nothing is fetched, nothing is checked against a blocklist, and no real domain is ever called fraudulent.
Find the owner, not the reassuring word.
Most people stop at the brand name. The registrable domain identifies the owner—and it often sits farther to the right.
Read ownership from right to left←
https://login.microsoftonline.com.attacker.net/verify
Subdomain decorationAnyone controlling the owner can write thisRegistered ownerThis is the part that mattersPage pathAlso chosen by the owner
chase-secure-verify.topOwner: chase-secure-verify.top
login.microsoftonline.com.attacker.netOwner: attacker.net
secure-bank.com@10.0.0.4/loginDestination: 10.0.0.4
One useful habitAsk: which part of this identifies the owner? Find the last two domain labels before the first single slash, then check whether that owner matches the organisation being claimed.
A strange address cannot accuse on its own.
4/ 100
Maximum structural weightwhen no fraud script appears in the conversationShorteners, campaign parameters, machine-generated hosting names and unfamiliar country-code domains all occur in legitimate traffic. Treating them as verdicts would create noise, not safety.
PrivateCue gives real weight to contextual mismatch: an institution is named, but the address belongs elsewhere; a link arrives directly after a money demand; the claim and destination do not agree.
StructuralWeak aloneBrand mismatchNeeds careConversation contextStrongest
Same unfamiliar linkDifferent context, different meaning
Here is the event map I mentioned.
short.link/8q2Structural onlyWeak signalThe unusual address cannot carry the result.
Your account is locked. Pay the release fee now.
short.link/8q2Demand + urgency + linkContextual signalThe surrounding script changes the evidence.
No lookup, no blocklist, no verdict.
Nothing is fetched, resolved, WHOIS-queried or sent to a reputation database. The analysis stays in your browser, works offline and reveals nothing about what you are investigating.
The module describes the shape of an address and any mismatch with the surrounding claim. It can never assert that a named real domain is fraudulent. You receive the reasoning and keep the judgement.
This answers a focused question: they named one organisation—so why does the link belong somewhere else?
address + conversationAnalysed hereYour browser
UploadsWHOISBlocklists
Analyse a conversation
Links are read in context, so the useful check is the whole thread rather than one URL pasted into a box.