Check a link for typosquats, brand-in-subdomain tricks, mixed-alphabet homographs, and hidden destinations. Public Suffix List parsing, explainable per-rule scoring, and the link is never fetched.
Initializing in your browser…
Read the certificate chain a server sends and say whether it is complete, in order and in date, and build the OpenSSL commands that fetch it.
An upper bound on how strong a password is, from the patterns that actually make one guessable, with the model and its limits stated in full.
Build a personal knowledge base with [[bidirectional links]], tags, backlinks, search, note metadata, and import/export. Implements Zettelkasten method
A "your account is locked" email links to the URL below and you want a sober breakdown before anyone in the team clicks it.
URL pasted
http://paypa1-secure-login.account-verify.ru/login?next=update
Risk findings
Owner (registered domain): account-verify.ru +70 [identity] "paypal" is in the subdomain, not the actual domain +30 [content] Hostname reads like a prompt to act: secure, login, verify, account +12 [connection] The connection is not encrypted Risk score 100 of 100: strong signs of a malicious link
The Public Suffix List separates the real owner, account-verify.ru, from the reassuring text in front of it, and "paypa1" is matched to the brand because comparison happens on the shape the eye sees rather than on the exact characters. Words like secure and verify count here because they are in the hostname, where a real service has no reason to put them; the same words in a path would score nothing. Each finding shows its own contribution, so the verdict can be checked rather than trusted. The link is never fetched, which is why this is structural evidence rather than a threat-intelligence verdict.
Before you click a suspicious link, paste it here. The analyzer works out who really owns the address using the Public Suffix List, then checks it for typosquats, brand names hidden in subdomains, mixed-alphabet homographs, destinations concealed behind an @ sign, and the structural patterns phishing campaigns share. Every finding shows what it contributed to the score. The link is never fetched.
The analysis starts by working out who actually owns the address, because almost every phishing trick is an attack on that one question. The hostname is parsed against the Public Suffix List, which separates the registered domain from the subdomains in front of it and from the suffix behind it. That distinction is the whole game: in paypal.com.secure-login.tk the owner is secure-login.tk and "paypal.com" is just text someone put in front of it, while in www.bbc.co.uk the owner is bbc.co.uk and co.uk is a two-part suffix, not a subdomain. The result panel names the registered domain explicitly, so the answer to "where does this actually go" is the first thing you read.
Brand impersonation is then checked in three distinct ways, because the three attacks look different. A domain whose name imitates a brand is caught by folding the label down to the shape the eye sees: digits that stand in for letters, sequences like rn that read as m, and the i, l and 1 family that are indistinguishable in most sans-serif fonts. On top of that a Damerau edit distance catches single insertions, deletions, substitutions and transpositions, which is why dropbxo.com is recognised as dropbox rather than dismissed as merely similar. A brand name sitting in the subdomain of a domain someone else owns is reported as exactly that. And a brand name combined with words like secure, support or billing inside the registered domain is treated as the lure it usually is. Crucially, the check runs the other way too: when the registered domain is one the brand genuinely uses, that counts as positive evidence and login or account pages on it are expected rather than suspicious. An earlier version of this tool rated paypal.com itself as Caution; it now rates it clean and rates paypa1.com as dangerous.
Internationalised domains are handled by decoding them rather than by suspecting them. Any xn-- label is decoded back to the characters it represents, and the analysis then looks at what those characters are. A name written consistently in one writing system is normal and scores nothing; münchen.de is a German word, not an attack. A single label that mixes alphabets, Latin letters with a Cyrillic or Greek lookalike dropped in the middle, is the actual homograph attack and is flagged heavily. The decoded form is shown alongside the raw one so you can see what your browser will display.
The remaining signals are weighted by where they appear. Words like login, verify and secure carry real weight in a hostname, where a legitimate service has no reason to put them, and none at all in a path, where /login is simply where a real site puts its login page. Suffixes are judged on registration economics rather than geography: a penalty applies to suffixes that are free or near-free and therefore attract disposable campaign domains, and no penalty at all applies to a country suffix for being foreign. Shorteners are split in two, because bit.ly genuinely hides its destination while youtu.be is operated by the site it points at. The rest covers credentials embedded before an @ sign, bare IP addresses used as hosts, javascript: and data: schemes, non-standard ports, executables disguised with a double extension, deep subdomain chains, and generated-looking names.
Every finding shows what it contributed to the score, grouped by whether it concerns identity, the connection, the structure of the address, or what it points at, so the verdict is auditable rather than a number to take on faith. The weights were calibrated against a corpus of 42 real well-known URLs and 45 synthetic attack patterns, and the current engine rates none of the real ones as risky while flagging all 45 of the attacks. The whole thing runs on the text of the address in your browser: nothing is fetched, no lookup is made, no reputation service is consulted, and nothing you paste leaves the page. That is a deliberate limit as much as a privacy promise, and the tool says so: a clean result means no warning signs in the address, not that the destination is trustworthy, and a brand-new phishing domain that copies nothing and misspells nothing will look exactly like an ordinary site.
Check links claiming to be from a bank, a courier, or an IT department. The owner line answers the only question that matters in seconds.
Verify unfamiliar URLs shared in a channel, and see immediately whether a shortener means the destination is unknowable.
Show how the same brand name means completely different things in a domain, a subdomain, and a path. The worked examples demonstrate a typosquat, a subdomain trick, a homograph, and an @ sign attack side by side.
Paste the reported link, copy the JSON report with its findings and scores, and attach it to the ticket without ever loading the page.
No. Every conclusion comes from the text of the address, worked out in your browser. No request is made to the target, no shortener is expanded, no reputation service is queried, and nothing you paste is sent anywhere.
Because a clean result means no warning signs in the address, which is not the same as a safe destination. A phishing domain registered yesterday with an ordinary-looking name has nothing in its text to give it away. The tool states this explicitly on every clean result rather than implying certainty it does not have.
It maintains a list of the registered domains major brands genuinely use. When the domain is on that list, the brand name is positive evidence and account pages on it are expected. When a domain merely reads like a brand, the name is folded to the shape the eye sees (the 1 becomes an l) and compared, which identifies it as an imitation rather than the real thing.
Because most of them are simply names in a language that needs more than ASCII. The tool decodes the punycode and looks at the characters: one consistent writing system is normal and scores nothing, while a single label mixing Latin with Cyrillic or Greek lookalikes is the actual attack and is flagged.
Because a country suffix says nothing about intent, and scoring it would mostly produce false positives on ordinary foreign sites. What does correlate with abuse is the cost of registration, so suffixes that are free or near-free carry weight regardless of which country they belong to.
No, and the limit is structural rather than a matter of tuning. Impersonation, lookalike characters, and structural tricks are visible in the address and are caught reliably. A convincing site on a plainly named domain is not, because there is nothing in the text to see. Against a corpus of 45 synthetic attack patterns the current engine flagged all of them, and against 42 real well-known URLs it flagged none, but a corpus measures the patterns it contains.
This runs as client-side JavaScript. Keys, tokens, payloads, and other inputs never leave your device.