Online Tool Store
Phishing URL Analyzer
Check a URL against seven common phishing red flags — @ tricks, IP hosts, brand lookalikes, and more — entirely offline in your browser.
This works right here on your device — nothing gets sent out.
Heuristic checks only — a clean result doesn't guarantee a URL is safe, and a flagged result doesn't guarantee it's malicious. Always verify through the official site or your browser's built-in protection before entering credentials.
How it works
- Paste a URL you're unsure about.
- It's checked against seven common phishing red flags: protocol, "@" tricks, raw IP hosts, excessive hyphens, brand lookalikes, URL shorteners, and subdomain depth.
- Each check shows pass or flagged, with an overall summary at the top.
FAQ
Does this check a live blocklist or reputation database?
No — it only looks at the structure of the URL string itself (things like "@" symbols, IP-address hosts, lookalike characters). It never contacts the URL or any external service.
Can a URL pass every check and still be malicious?
Yes — these are common phishing patterns, not a guarantee. A well-crafted phishing link can avoid every one of these signals.
Why is the "@" symbol suspicious?
Everything before an "@" in a URL is typically ignored as userinfo, so "paypal.com@evil.ru" actually goes to evil.ru, not paypal.com.
Is the URL I paste sent anywhere?
No — it's parsed with the browser's built-in URL API and checked with regular expressions, entirely on your device.
How we compare
| Feature | Online Tool Store | Google Safe Browsing lookup | VirusTotal URL scan |
|---|---|---|---|
| Never sends the URL anywhere | ✓ | ✗ | ✗ |
| Checks a live reputation database | ✗ | ✓ | ✓ |
| Instant, no waiting on a scan queue | ✓ | ✓ | ✗ |
Use this as a quick, private first pass on a suspicious link's structure — pair it with a real reputation checker before making a final call on anything sensitive.