Got a message that wants something from you?
Paste it below. Pull checks the sender and links against public scam data, then shows you how to reach the real organization yourself.
How Pull decides
- It reads the message. Pattern rules pick out the sender, the links, and what the message asks you to do. No AI is involved.
- It checks the evidence. Links and senders are looked up in public sources: domain registration records and DNS, plus Google Safe Browsing, URLhaus and urlscan.io when those are switched on.
- It adds up the red flags. Fixed rules give each red flag points. Every flag shows where the evidence came from, so you can check it yourself.
- It tells you who to contact. Pull takes the organization from the sender's name and looks up its real website on Wikidata, so you can reach them on your own terms.
| Points | Examples |
|---|---|
| +5 | A scam list or scanner already flags the link, or a link shows one address but goes to another |
| +3 | A website registered in the last 30 days; asks for passwords, codes, gift cards or crypto; the sender or links don't match the organization it claims to be |
| +2 | Pressure or threats; link shorteners; links to bare number addresses; websites less than six months old |
| +1 | The sender's domain has no anti-forgery (DMARC) record |
5 points or more means likely scam. 2 to 4 means suspicious. Below that, Pull says it found no red flags. It never says a message is safe.
Why it's called Pull
A scam is information pushed at you. The scammer chooses the link, the phone number and the deadline. The safe move is to pull instead: look the organization up yourself and contact it through a channel you chose.
What happens to your message
Pull doesn't store your message. To measure accuracy it saves only the verdict, which red flags fired and how long each check took. The message text stays on Pull's server. To do the checks, only its links, sender domain and the organization's name go to the services listed above.
No check is perfect. Google Safe Browsing and the other lists can miss new scams and sometimes flag real websites, so "no red flags" is never a guarantee.