🇳🇬 Nigeria-First, Africa-Aware

Put threats under the microscope. Scanner & Hunter up front.

Built for Nigerian banking & fintech realities — BVN/NIN lures, bank-clone domains, OTP/USSD scams — with explainable, SOC-ready outcomes.

Open Scanner Open Hunter 🇳🇬 Nigeria-trained model

Why lead with Scanner + Hunter?

Speed for analysts, autonomy for discovery. Minimal clicks, maximum clarity. Everything else is here — but secondary.

CheckThatURL 🇳🇬 Nigeria-first
Privacy: We don’t store your URLs or page content. Scans are ephemeral and processed in-memory. Feedback is optional and anonymous. Learn more.

Scan any link. Instant verdicts. Clear Nigeria-aware reasons.

AI-powered phishing detection tuned to Nigeria’s banking & fintech landscape.

Press Enter or click Check to scan.

Nigeria-aware detection

We analyze domain, content, link-graph, and live behavior signals with localized feature engineering for Nigeria — including BVN/NIN prompts, bank-clone lexicons, .ng/domain tricks, USSD/OTP baits, and local payment/wallet flows.

🕵🏽 Agentic Hunter — autonomous discovery for Nigerian playbooks

Control Panel

Seed keywords / domains (Nigeria-focused)

Comma-separated. Examples: “BVN update, NIN portal, GTBank verify, Access Bank login, Momo wallet reset”.

Hunter uses safe headless browsing to discover, test, and score live suspect links from Nigerian-tuned seeds and learned patterns.

Status: Unknown

Recent Discoveries

Latest 50 (auto-refresh while running).
TimeURLSourceRiskVerdict
No data loaded yet.
Backend endpoints: GET /hunter/status, POST /hunter/start, POST /hunter/stop, GET /hunter/discoveries?limit=50.

Why a Nigeria-First Approach Matters

Local attacker playbooks

Threat actors adapt to Nigerian banks, telcos, and wallets. Our features reflect those patterns.

Explainable by design

Verdicts grouped across domain, content, links, and behavior — analysts can audit the “why”.

Privacy without compromise

Zero URL storage by default, in-memory processing, self-hostable enterprise mode.

Hybrid signal fusion

Heuristics + ML + LLM rationale + live browser simulation.

SOC-ready outcomes

Forward outcomes and evidence to SIEM; export redirect chains & interactions.

CBN-fit positioning

Built to align with Nigerian financial-sector realities and oversight needs.

What simple “checkers” typically do

  • Depend on global blocklists / reputation only.
  • Little or no browser behavior simulation.
  • Opaque scores without Nigerian context.
  • Heavy data retention and privacy trade-offs.

What CheckThatURL does for Nigeria

  • Behavior-first inspection of redirects, timers, popups, consent, OTP/USSD prompts.
  • Nigeria-aware features (BVN/NIN lures, bank-clone lexicons, .ng misuse).
  • Explainable verdicts grouped by signal class for SOC & audit.
  • Zero-retention default; self-hosted modes for regulated environments.

How a verdict is produced (Nigeria-aware)

1) Signal Collection

Domain (.ng nuances), content (BVN/NIN/OTP/USSD), link graph (bank variants), and live behavior signals.

2) Behavioral Simulation

Headless browser follows redirects, detects timers/popups/consent, records OTP/USSD prompts.

3) Hybrid Fusion

Heuristics + ML + LLM-assisted rationale tuned to Nigerian patterns.

4) Explainable Output

Verdict + grouped reasons + evidence, ready for SOC review.

Product Capabilities

Behavioral Simulation

Redirects, timers, popups, consent, OTP/USSD prompts — captured and analyzed.

Explainable Verdicts

Grouped reasons across domain, content, links, and behavior — SOC-friendly.

Nigeria-Aware Features

BVN/NIN lure detection, bank-clone signatures, .ng TLD misuse, local spellings & wallets.

Hybrid Detection

Heuristics + ML + LLM rationale to boost accuracy and reduce false positives.

Privacy by Design

Zero URL storage by default. In-memory processing. Enterprise retention controls.

Integrations

Deploy across your environment — and centralize visibility.

Splunk Elastic Microsoft Sentinel QRadar Okta / Azure AD (SSO) REST API Email Gateway Browser Extension

Assurance & Reliability (for Nigerian FS)

Audit-ready Evidence

Export redirect chains, OTP/USSD prompts, consent clicks, and grouped reasons.

Data Handling

Ephemeral by default. Configurable retention in enterprise/self-hosted deployments.

Engineering for Trust

Evaluation, drift checks, safe defaults, and change control — designed for SOC workflows in regulated environments.

Docs & Quickstart

REST API

Quickstart: POST /check

Send a URL for analysis. Optional quick=1 for faster heuristics.

POST https://checkthaturl.com/check?ui=redacted
Content-Type: application/json

{"url":"https://bankname.ng/secure-login"}

Response (truncated):

{
  "verdict": "Phishing",
  "risk": 0.86,
  "explanation": "BVN/OTP lure + suspicious .ng subdomain + redirect maze",
  "domain_risks": [...],
  "behavior": { "redirect_chain": [...], "clicks": 2 }
}
SDK / Integrations
  • Browser Extension — inline verdicts on hover/click.
  • Email Scanner — scan inbound links, annotate messages.
  • SIEM Forwarders — Splunk, Elastic, Sentinel, QRadar.
  • SSO — Okta / Azure AD; RBAC for least privilege.
Contact for full docs

Operational Excellence

20+ checks
Static & behavioral signals
Sub-sec
Quick mode responses
Explainable
Analyst-friendly reasons
SIEM-ready
Event forwarding & audit

Pricing

Starter

Everyday Safety

$0

Core scanning for individuals in Nigeria.

  • Nigeria-aware verdicts
  • Explainable reasons
  • Zero-retention default
Start Free
Pro

Team Protection

$49 / seat / mo

For SMEs and startups.

  • API access + tokens
  • Browser extension
  • Email scanner add-on
Talk to Sales
Enterprise

SOC & SIEM Ready

Custom

For banks, fintechs, telcos, and government.

  • SIEM forwarders & exports
  • SSO/SAML, RBAC
  • Self-hosted & retention controls
Request POV

Final pricing depends on usage, deployment model, and compliance needs.

Bring Nigeria-First CheckThatURL to your SOC

Free POV for banks/fintechs/telcos: Email Scanner, Browser Extensions, API, SIEM integrations.

Request POV See Pricing Docs