Phishing URL Analyzer

Runs in browser New Internet Security & Privacy

A deeper, explained reading of one link, entirely in your browser. It shows the domain the browser would really connect to and the text it ignores, the alphabets in the host and how the name reads on screen, checks brand names, look-alike characters and near-miss spellings, and — if you name the domain you expected — compares the two. Every finding is a hint with the reason phishers use it and how to verify it yourself, never a verdict.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

How is a phishing URL made to look like a real one?

A phishing URL is built to be mistaken for an address you trust: a brand name inside somebody else's domain, the real domain written as a subdomain (paypal.com.example.top), text before an @ sign that the browser ignores, a near-miss spelling, or a homograph — letters from another alphabet that look Latin, which Unicode UTS #39 calls confusables. Whatever the trick, the owner of a link is its registered domain, the label just before the public suffix.

How to use Phishing URL Analyzer

  1. Paste the link exactly as you received it (copy the link address, not the visible text).
  2. Optionally type the domain you believe the link belongs to, such as paypal.com or your bank's domain.
  3. Press Analyse link and start with "Domain that really opens" in the overview.
  4. Read the brand checks and the comparison, then go through "Signs explained" and the checklist before deciding anything.

Phishing URL Analyzer features

  • Anatomy of the address: the host the browser really connects to, the registered domain that owns it, the labels its registrant chose and any text before an @ that the browser ignores
  • Homograph analysis: the alphabets used in the host, its Unicode and xn-- network forms, and how the name reads on screen once look-alike letters are folded
  • Brand checks: a brand name inside somebody else's domain, a brand's real domain used as a subdomain, one-letter typos, and brand names hidden by look-alike characters (paypa1, rnicrosoft) — the last one an extra check of this analyzer
  • Optional comparison with the domain you expected: same owner or not, letters apart, same appearance on screen, and whether your domain appears only as a subdomain or before an @
  • Every sign explained: what the link shows, why phishers use the pattern and how to verify it yourself
  • Runs entirely in your browser — the link is never sent anywhere

Inputs and outputs

Inputs

  • Link to analyse — the address as received, with or without a scheme; internationalised domains, @ tricks and long tracking links are all accepted (up to 8,192 characters).
  • Domain you expect (optional) — the site you believe the link belongs to, as a domain (paypal.com) or a full address; only its host is used.

Outputs

  • Overview — heuristic score with its reading, the number of signs, the number of brand-related findings and the domain that really opens.
  • Anatomy of the link — host, registered domain, chosen labels, ignored text before an @, Unicode and network forms, alphabets used and the on-screen reading.
  • Brand and look-alike checks — brand names found, brands hidden by look-alike characters, brand domains used as subdomains and near-miss spellings.
  • Compared with the domain you expect — shown when you enter one.
  • Signs explained — each sign with what the link shows and why it matters; and a short checklist before you click.

Phishing URL Analyzer example

A trusted name hidden before an @ sign

Input:

Link: https://www.paypal.com@paypa1-secure.xyz/login/verify
Domain you expect: paypal.com

Output:

Heuristic score: 85/100 — Dangerous-looking (a hint, not a verdict)
Domain that really opens: paypa1-secure.xyz
Text the browser ignores (before the @): www.paypal.com
Brand hidden by look-alike characters: paypal (in "paypa1-secure")
Compared with paypal.com: a different registered domain · does not look the same on screen · paypal.com appears only in the ignored text before the @
Signs: High — Text before an @ sign · Medium — .xyz domain · Medium — Credential words: login, verify · Low — Credential words in the host: secure

How to read the Phishing URL Analyzer results

"Domain that really opens" is the decisive line. If it is not a domain you know belongs to the organisation, the rest of the address — however familiar it looks — was written by someone else.

A brand-related finding (a brand in somebody else's domain, a brand domain as a subdomain, a hidden or near-miss brand name) is the strongest phishing pattern in an address. One such finding beside credential words such as login or verify is the typical shape of a credential-harvesting link.

In the comparison, "looks the same on screen" with "a different registered domain" means a look-alike: the two names differ in the network but not to the eye.

The score is the same 0–100 hint as in the URL Safety Checker: under 20 safe-looking, 20–54 suspicious, 55 and above dangerous-looking. None of these readings is a verdict about the page.

When to use Phishing URL Analyzer

  • Explaining to a colleague, step by step, why a reported link is a phishing attempt.
  • Preparing awareness-training material with real examples of borrowed brands, homographs and @ tricks.
  • Checking whether a domain you are about to register, or a partner's domain, can be confused with a well-known brand.
  • Investigating a suspected look-alike of your own organisation's domain by entering your domain as the expected one.

Troubleshooting

  • Nothing appears under "Compared with the domain you expect" — the field is optional; type a domain such as example.com to see the comparison.
  • "The expected domain could not be read" — enter only a domain or a full https:// address, without spaces.
  • An internationalised link shows xn-- labels — that is the network form the browser really connects to; the Unicode form is shown next to it.
  • A shortened link shows only the shortener — expand it first with a redirect checker, then analyse the destination.

Frequently asked questions about Phishing URL Analyzer

How is this different from the URL Safety Checker?

The URL Safety Checker gives a quick score and, when the server is configured for it, asks reputation lists. The analyzer never leaves your browser and goes deeper into one link: the anatomy of the address, brand and look-alike checks, a comparison with the domain you expected, and an explanation of every sign with a way to verify it.

What is a homograph (IDN) attack?

A domain written with letters from another alphabet that look like Latin ones — a Cyrillic "а" in аpple.com — reads like the real name but is a different domain, here xn--pple-43d.com. The analyzer lists the alphabets used in the host, shows its network (xn--) form and how the name reads on screen.

Why should I enter the domain I expect?

Phishing works because a link looks close enough to a name you trust. When you type the domain you believe the link belongs to, the analyzer says whether the link really opens it, how many letters apart the two are, whether they look the same on screen, and whether your domain appears only as a subdomain or before an @ sign.

Does the analyzer send the link anywhere?

No. It runs entirely in your browser: the link is never sent to the Mutqan server or to any other service, so it is safe to analyse a link that carries a personal token.

Can a link with no findings still be phishing?

Yes. The analysis reads the address only. A phishing page on a newly registered, ordinary-sounding domain, or on a legitimate site that was hacked, shows no pattern in its address. Open sensitive services by typing their address yourself.

Technical notes

The address is parsed with the WHATWG URL Standard (the parser browsers use) on the RFC 3986 syntax: the userinfo before @ is separated from the host, an internationalised host is converted to its ASCII form (IDNA 2008, RFC 5891), and the host is split into the registered domain and the labels in front of it.

Look-alike detection follows the idea of the confusable "skeleton" in Unicode Technical Standard #39 (UTS #39, Unicode Security Mechanisms): Cyrillic, Greek and Armenian letters that render like Latin ones are folded to the Latin letter, and ASCII tricks such as rn → m, vv → w, 0 → o and 1 → l are folded too; two names with the same skeleton look alike on screen.

Near-miss spellings use an edit distance with transpositions (Damerau–Levenshtein): one edit for brand names under eight letters, two for longer ones, and short names only when the length and first letter match. The hidden-brand check looks for a brand name inside the skeleton of each label the registrant chose.

The score and the signs come from the same heuristics engine as the URL Safety Checker (weights high 35, medium 20, low 10; suspicious from 20, dangerous-looking from 55). The analyzer's own extra checks — the hidden brand and the comparison with your expected domain — are reported beside the score and do not change it.

Limitations and methodology

Only the address is analysed; the page is never opened, so a phishing page on an ordinary-looking or hacked domain shows nothing here.

Brand checks cover a deliberate list of the most imitated global brands plus Saudi and Indian banks and portals; for any other organisation, use the expected-domain comparison.

The look-alike folding covers the common Cyrillic, Greek, Armenian and Latin-variant confusables and ASCII tricks, not every confusable pair in UTS #39.

The registered domain is estimated with a built-in suffix list rather than the full Public Suffix List.

Security and privacy

This tool runs entirely in your browser. The link and the expected domain are analysed on your device and never sent to the Mutqan server or to any other service; nothing is stored.

References