Multi-level URL decoding, component parsing, and automated phishing indicator detection.
Detects: IP hostnames, punycode, multi-layer encoding, @ injection, open redirect params, suspicious TLDs. All client-side.
Inspects a URL's structure, extracts components (scheme, host, path, query parameters, fragment), and evaluates it for common indicators of suspicious construction: encoded characters, misleading subdomains, non-standard ports, excessive redirects, and URL patterns commonly used in phishing.
Decodes percent-encoded characters to reveal what a URL is actually requesting, which is useful when reviewing suspicious links from emails or logs.
Malicious URLs are frequently obfuscated to evade detection and trick users. A URL like paypal.com.login.suspicious-domain.xyz uses a legitimate brand name as a subdomain to appear trustworthy. Percent-encoding hides the actual destination.
This tool is useful for rapid triage of suspicious URLs before clicking them, analyzing links from phishing emails, and reviewing redirect chains in access logs. Pair it with the URL Threat Feed tool for broader threat intelligence context.