Multi-level URL decoding, component parsing, and automated phishing indicator detection.
Detects: IP hostnames, punycode, multi-layer encoding, @ injection, open redirect params, suspicious TLDs. All client-side.