Analyze URLs for phishing and suspicious indicators
URL Scanner inspects a web address before you visit it, flagging signals commonly associated with phishing, malware, and scam pages. Paste any http:// or https:// link and the tool breaks it down into its components — scheme, hostname, port, path, and query string — then checks each part against known deception patterns such as look-alike domains, punycode/homograph tricks, embedded IP addresses, excessive subdomains, URL shorteners, and credential-harvesting keywords like 'login', 'verify', or 'secure-account'.
It is used by security-conscious users, help-desk and SOC staff triaging reported links, and developers validating user-submitted URLs. Because everything runs in your browser, it is a fast first-pass check for a suspicious email link or QR-code destination without clicking it.
The scanner first normalizes and parses the URL using the standard structure scheme://userinfo@host:port/path?query#fragment. Splitting the address this way exposes tricks that a quick glance misses — for instance http://paypal.com@evil.example/ actually sends you to evil.example because everything before the @ is treated as user info, not the destination.
It then applies a set of weighted heuristics. Host checks include: raw IPv4/IPv6 literals instead of a domain name, punycode prefixes (xn--) that can render as a trusted brand, an unusually high subdomain count, and hyphen-heavy or very long hostnames. Path and query checks look for phishing keywords, encoded characters (%xx sequences that hide the real target), and known URL-shortener domains that mask the final landing page. The scheme check warns when a login-style page is served over plain http instead of https.
Each triggered signal contributes to an overall risk rating. Because these are pattern-based heuristics rather than a live blocklist, the tool tells you what looks suspicious and why — a legitimate site can occasionally trip a rule, and a brand-new malicious domain may look clean, so treat the result as guidance, not a guarantee.
No. The analysis is purely structural and heuristic — it parses the text of the URL and checks its parts against known patterns. It does not send a request to the site, so the destination server never sees your check.
Yes, it is completely free with no sign-up. The scan runs in your browser, so the URL you paste is not uploaded or stored on our servers.
No tool can. This scanner uses pattern-based heuristics, so it reliably flags common tricks like homograph domains, IP-address hosts, and credential keywords, but a freshly registered malicious site with a clean-looking URL may not raise any flags. Always combine it with caution and other checks.
Heuristics can produce false positives. Legitimate sites sometimes use long query strings, many subdomains, or URL shorteners — all of which the tool treats as signals. Read the specific reasons given and judge them in context.
Punycode (hostnames starting with xn--) encodes non-ASCII characters so internationalized domain names work in DNS. Attackers abuse it to register domains that visually mimic real brands, so the scanner flags punycode hosts for manual review.
No. HTTPS only means the connection is encrypted; anyone can obtain a free certificate, including phishers. The scanner notes the scheme but weighs the domain and path far more heavily than the presence of TLS.
Do not open it. Verify the true domain with a Whois or DNS lookup, avoid entering any credentials, and if it impersonates a company, report it to that company and to your email or browser provider.