how to spot a phishing link
Most phishing links do not rely on a perfectly cloned site, they rely on an address that looks right at first glance. The browser follows exact rules to decide what the real host of a URL is, and that gap, between what the eye reads and what the browser resolves, is exactly where the trick hides.
The real host is `xn--gogle-qmc.example`, which decodes to `ɡgogle.example` with a confusable character standing in for "g".
Swapping "l" for "1" is the cheapest substitution to catch by Levenshtein distance and one of the most common in real campaigns.
A legitimate service rarely asks for a login at a bare IP address without HTTPS: the missing named certificate is already a strong signal on its own.
We do not open the link directly and we do not perform direct HTTP/TLS/DNS fetches against the target from our infrastructure. What may happen is a lookup against existing feeds, blocklists and reports from third parties, without active scan submission.
Because RFC 3986 reserves that segment for HTTP authentication credentials embedded in the URL (`user:password@host`), an old feature rarely used legitimately today; the browser follows the spec exactly and treats everything before the `@` as a login, not part of the domain, which opens the door for the trick.
Punycode (RFC 3492) is the scheme that encodes non-ASCII letters in a domain into the `xn--` format DNS understands; it exists to allow legitimate internationalized domains, but it also allows registering a domain with letters from another alphabet that look visually identical to Latin ones, the basis of the homograph attack.
No, the analysis is passive: it examines only the URL structure (host, encoding, confusable characters, brand pattern) without fetching the content or querying a third party, so a newly registered domain, technically clean but malicious, can pass through with no signal at all.
Because the shortener hides the real destination domain behind a generic host, removing precisely the information that would let someone judge the link before clicking; that does not make the link malicious by itself, but it raises the risk by hiding exactly the data the other signals analyze.
Paste a URL to start the analysis.
We do not open the target directly from our server. The structural layer runs in the browser, and the external layer only queries existing feeds, blocklists and provider reports when available.