Suspicious URL Check
Inspects a link’s shape before you open it — lookalike characters, IP-literal hosts, @ tricks, deep subdomains, odd ports, shorteners — and on request traces its redirects and looks up the domain’s registration date. No reputation database.
A link in a text message gives you a few seconds and a string to decide with. This pulls the string apart — the real host, characters that look like other characters, the tricks that put a familiar name somewhere it has no authority — and, if you ask, follows the redirects and looks up how old the domain is.
The shape analysis runs inside your browser. Only the two buttons below — trace the redirects, check the registration date — make a server look at the address for you. There is no reputation database here: a clean result does not mean the link is safe.
How to use it
Paste the link without opening it
Copy the link rather than tapping it. On a phone, long-press and copy — that is the whole point of checking first.
Look at where the host actually ends
In `https://kakao.com.login-secure.example.net/…` the site is `example.net`. Everything before the last two labels is decoration, and `@` in a URL makes everything before it a username rather than a host.
Check the lookalike characters
A Cyrillic `а` renders identically to a Latin `a`. The tool shows the punycode form, which is where a homograph domain stops looking like the brand it imitates.
Trace the redirects for a shortener
A shortened URL says nothing by itself. The trace shows each hop and the final destination, fetched from a server rather than from your device.
Common questions
Does a clean result mean the link is safe?
No, and this is the limit that matters most. There is no reputation database here — a well-formed link to a brand-new phishing site on a plausible domain produces a clean result. The tool reports the shape of the URL, and shape is not intent.
Does checking a link visit it?
The shape analysis does not — it is string parsing in your browser. The redirect trace and the registration lookup do fetch, from a server, so the destination sees a request from that server and not from you.
Why does a domain’s age matter?
Phishing domains are usually days old, because they get taken down. A domain registered last week and imitating a fifteen-year-old bank is a strong signal — though a legitimate campaign site is also new, so it is a signal and not a verdict.
A link I know is fine gets flagged.
Legitimate sites do use shorteners, deep subdomains and odd ports. The flags are things worth a second look, not accusations — read which one fired and judge it.
Feed it from
WHOIS Lookup
Shows domain registration, registrar, nameservers and expiry, plus RDAP data where it exists.
QR & Barcode Reader
Reads QR codes and common barcodes from an uploaded image, a screenshot or the camera.
Redirect Chain Tracer
Follows a shortened or tracking URL through every redirect and shows the final destination.
Email Header Analyser
Parses raw email headers into a delivery timeline with per-hop delays, reads the receiving server’s SPF, DKIM and DMARC verdicts, and flags From/Reply-To/Return-Path mismatches.
Next
These accept what this tool produces, so the result can go straight in.
Punycode Converter
Converts internationalised domain names to and from punycode and warns about lookalike characters.
QR & Barcode Reader
Reads QR codes and common barcodes from an uploaded image, a screenshot or the camera.
Redirect Chain Tracer
Follows a shortened or tracking URL through every redirect and shows the final destination.
WHOIS Lookup
Shows domain registration, registrar, nameservers and expiry, plus RDAP data where it exists.
CORS Tester
Sends the preflight a browser would send from a chosen origin plus a GET with that Origin, and explains by the Fetch standard’s rules exactly which header blocked it.
Currency Converter
Converts between about thirty currencies at the ECB’s daily reference rates, crossed through the euro, or at a rate you type in.