URL Safety Checker

Server assisted New Internet Security & Privacy

Paste a link to see what its text alone gives away: a brand inside somebody else's domain, look-alike letters, a raw IP address, a shortener, a disguised program download. The signs are scored as hints, not proof. When the Mutqan server holds a Google Web Risk or abuse.ch URLhaus key, the link is also checked against that list; when it does not, the result says the lookup was not run.

Privacy: The domain, address or URL you enter is sent from the Mutqan server to the public data service named on this page (a registry, a resolver, a certificate log or a measurement network). Nothing is stored.

How can you tell whether a link is safe before opening it?

A link can be judged before it is opened from two kinds of evidence: what the address itself shows — the registered domain, look-alike characters, a borrowed brand name, a shortener, a disguised download — and whether a reputation service such as Google Web Risk or URLhaus already lists it. Neither is proof: text heuristics miss a well-named new phishing domain and blocklists lag behind fresh campaigns, so a clean result lowers the risk without removing it.

Security note: A link that passes every check can still lead to a harmful page. Never enter a password, a one-time code or card details on a page you reached from an unexpected link — open the service by typing its address or from its own app.

How to use URL Safety Checker

  1. Paste the link exactly as you received it: right-click it and copy the link address rather than the visible text.
  2. Leave "Also run the reputation lookup on the server" ticked to ask the configured services, or untick it to keep the whole check in your browser.
  3. Press Check link and read the registered domain under "How the link is read" first — it is the site the link would really open.
  4. Work through the warning signs from the top, then follow "What to do next" before opening anything.

URL Safety Checker features

  • Reads a link the way a browser does: scheme-less hosts, host:port, text before an @ sign and internationalised names
  • Flags a brand inside somebody else's domain, a brand's domain used as a subdomain, look-alike letters (Cyrillic, Greek) and one-letter typos of known brands
  • Spots link shorteners, free-hosting and tunnel hosts, abuse-heavy cheap TLDs, raw IP addresses and explicit ports
  • Catches disguised downloads such as .pdf.exe, redirect parameters that forward to another domain, and passwords or tokens in the query string
  • Optional reputation lookup against Google Web Risk and abuse.ch URLhaus when their keys are configured on the server — and a plain "not configured" when they are not
  • Every warning sign explained in plain words with its severity; the scoring weights and thresholds are published on this page

Inputs and outputs

Inputs

  • Link to check — any address as received: with or without http(s)://, with a path and query, an internationalised domain, or a javascript: or data: link. Up to 8,192 characters for the heuristics; the reputation lookup accepts up to 2,048.
  • Also run the reputation lookup on the server — ticked by default; untick it to keep the check entirely in your browser.

Outputs

  • Result — the heuristic score out of 100 with its reading, the number of warning signs and of high-severity signs, and how many reputation services were asked.
  • Reputation lookup — for each service: not configured, asked without an answer, listed as unsafe (with the threat types), or not listed.
  • Warning signs — every sign with its severity and a plain-words reason, the strongest first.
  • How the link is read — scheme, host as written and in Unicode, estimated registered domain, suffix, subdomains, port, path, query and the normalised link.
  • What to do next — short advice matched to the result.

URL Safety Checker example

A sign-in link that borrows a brand

Input:

http://paypal.com.secure-login.example.top/signin

Output:

Heuristic score: 100/100 — Dangerous-looking · 7 warning signs, 2 high
Registered domain: example.top
High — "paypal" in somebody else's domain
High — "paypal.com" is only a subdomain here
Medium — .top domain
Medium — Credential words: signin
Low — Plain HTTP · 3 subdomain levels · Credential words in the host: login, secure
Reputation services asked: 0/2 — not configured on this server (heuristics only)

How to read the URL Safety Checker results

Read the registered domain first. It is the site you would really reach; every label to its left was chosen by whoever registered it, so paypal.com.secure-login.example.top belongs to example.top, not to PayPal.

A score of 0–19 reads "safe-looking": no strong warning sign in the text. 20–54 reads "suspicious": several signs, or one strong one. 55–100 reads "dangerous-looking": stacked strong signs such as a borrowed brand on a cheap domain, or a look-alike letter.

A reputation service that lists the link outweighs the heuristics: treat the link as unsafe. "Not listed" only means the service had no record at the moment of the check — phishing pages often live for hours, before any list knows them.

"Not configured on this server" and "asked, no answer" mean the reputation part did not happen. The result then rests on the text of the link alone and says so.

When to use URL Safety Checker

  • Deciding whether to open a link that arrived in an unexpected e-mail, SMS or chat message.
  • Triaging a link a colleague reported as suspicious before escalating it to the security team.
  • Reviewing the links in your own campaign or notification messages for patterns readers and spam filters distrust: shorteners, plain http, long tracking parameters.
  • Showing staff in awareness training what a borrowed-brand or look-alike address looks like, with the reason for each sign.

Troubleshooting

  • "The text does not look like a web address" — a single word has no dot. Paste the whole address, for example example.com/page.
  • "The URL contains spaces or quote characters" — copy the link itself (right-click → Copy link address), not the sentence around it.
  • The reputation lookup shows a rate-limit, busy or timeout message — the heuristics still ran. Wait a minute and check again, or untick the lookup.
  • A shortened link shows only the shortener's domain — expand it first with a redirect checker, then check the destination it leads to.

Frequently asked questions about URL Safety Checker

Does a "safe-looking" result mean the link is safe?

No. The heuristics read only the text of the link; they never open the page. A newly registered phishing domain with an ordinary name comes out "safe-looking", and a legitimate link can carry a warning sign. Treat the result as one input, and do not type passwords or card details into a page you reached from an unexpected link.

Which reputation services does it ask?

Google Web Risk and abuse.ch URLhaus, each only when its key is configured on the Mutqan server. When neither key is set, the result reads "Not configured on this server" and only the heuristics in your browser ran. A service that was not asked, or did not answer, is never shown as a clean result.

Is the link opened or visited during the check?

No. Neither your browser nor the Mutqan server loads the page. The heuristics run in your browser on the text you pasted; the reputation lookup sends only the link text to the configured services. The site the link points to receives nothing from this tool.

Why is a shortened link marked as a warning sign?

A shortener (bit.ly, t.co, tinyurl.com and similar) hides the real destination until the link is opened, so the text tells you nothing about where you would land. Expand it with a redirect or short-link tool first, then check the destination address here.

A link I trust was flagged. Is the tool wrong?

Possibly. Every sign is shown with its reason, so you can judge it: a long tracking link, plain http or a login path are common on real sites. What matters most is the registered domain shown under "How the link is read" — if it is the organisation's own domain that you already know, the other signs weigh much less.

Can I check a link without sending it anywhere?

Yes. Untick "Also run the reputation lookup on the server" and the check runs entirely in your browser; nothing leaves your device. You lose the provider lookup, not the heuristics.

Technical notes

The link is parsed as browsers parse it (WHATWG URL Standard, syntax from RFC 3986): a scheme-less address is read as http://, text before an @ is userinfo the browser ignores, and an internationalised host is shown both in Unicode and in its ASCII xn-- form (IDNA 2008, RFC 5891; Punycode, RFC 3492).

Each sign has a fixed weight — high 35, medium 20, low 10, info 0 — and the score is their sum, capped at 100. A score of 20 or more reads as suspicious and 55 or more as dangerous-looking. A one-letter typo of a brand counts in full only when another sign points the same way, because many ordinary words sit one letter away from a brand name.

The registered domain is estimated with a built-in list of common two-label country suffixes (com.sa, co.uk, co.in …) and hosting platforms (github.io, pages.dev, amazonaws.com …), not the full Public Suffix List. On a hosting platform the label in front of the platform is treated as the publisher's choice, so a brand name there is not excused by the platform's own name.

The reputation lookup asks Google Web Risk (uris:search for MALWARE, SOCIAL_ENGINEERING and UNWANTED_SOFTWARE) and URLhaus with the normalised link. A Web Risk listing is shown with Google's advisory notice, as its terms require.

Limitations and methodology

The page behind the link is never fetched, so a convincing form on an ordinary-looking domain, a compromised legitimate site, or a page that changes after the check cannot be seen.

The brand list is short and deliberate: the global names phishing kits imitate most, plus Saudi and Indian banks and portals. Impersonation of any other name is caught only through the generic signs.

Without a provider key on the server no reputation list is consulted. With one, "not listed" reflects that list at that moment only.

The registered-domain estimate uses a built-in suffix list, not the full Public Suffix List, so a rare multi-label suffix may be split differently.

Security and privacy

The heuristics run in your browser. With the reputation lookup ticked, the link text goes to the Mutqan server and from there to the configured services (Google Web Risk, abuse.ch URLhaus); Mutqan stores nothing, and those services apply their own policies. A user name or password written before an @ in the link is left out of the lookup. Links can also carry tokens or personal identifiers in the path or query — remove them, or untick the lookup, before checking a link taken from a private message.

References