Phishing URL Inspector
Take apart a suspicious link before anyone clicks it. This inspector shows the true registrable domain, decodes the structure and flags the tricks used in phishing -- credentials before the @ sign, punycode lookalikes, buried brand names and open redirects. The link is never opened or requested.
The URL is parsed locally with the browser's own URL engine. This tool never visits, requests or submits the link, and nothing you paste is stored.
How to read a link like an analyst
- Read the hostname right to left. The registrable domain is the last two labels -- everything to its left is controlled by whoever owns that domain.
- Anything before an @ sign is a username, not a host. https://paypal.com@evil.test goes to evil.test.
- Treat shorteners as unknown destinations; expand them in a sandbox, never on your work machine.
- A valid HTTPS certificate proves encryption, not honesty. Phishing sites use HTTPS as standard.
Security note
If a link arrived in a suspicious message, report it to your security team and do not open it, even after a clean-looking analysis here. Structural checks catch common tricks -- they cannot see the page content behind the link.
Related tools
Email Header Analyzer
Paste raw email headers to review the delivery path plus SPF, DKIM and DMARC results.
File Hash Calculator
Compute SHA-256, SHA-384 and SHA-512 file hashes without uploading the file anywhere.
IOC Defanger / Refanger
Safely defang and refang URLs, domains, IPs and emails when sharing indicators.