{{ summaryTitle }}
{{ summaryValue }}

{{ summaryLine }}

Live hits{{ hasResult ? computation.values.live_hit_count : '—' }} Completed{{ hasResult ? computation.values.completed_check_count : '—' }} Local score{{ computation.ok ? `${computation.values.local_signal_score} / 100` : '—' }}
Enter one HTTP(S) URL or host. A host-only value is normalized with HTTPS.
Off by default to avoid disclosing the full URL unless you choose this source.
{{ includeGoogleEnabled ? 'On' : 'Off' }}
Domain-oriented evidence for the hostname exactly as submitted.
{{ includeSurblHostEnabled ? 'On' : 'Off' }}
The parent candidate is heuristic and should be confirmed on uncommon suffixes.
{{ includeSurblRootEnabled ? 'On' : 'Off' }}
Useful for login, account-recovery, payment, or wallet links.
{{ strictHttpsEnabled ? 'On' : 'Off' }}
This changes prepared follow-up links, not live verdict scope.
Use 0 for 8000 ms, or choose 1500–15000 ms.
ms
AreaSignalEvidenceNext stepCopy
{{ row.area }}{{ row.signal }}{{ row.evidence }}{{ row.nextStep }}
Prepared follow-up checks
{{ link.label }}
Local signal profile

Which URL-shape signals contribute to the repo-authored local review score?

The chart renderer is unavailable. The same signal weights remain available in the triage plan and CSV export.

SourceScopeVerdictEvidenceCheckedOpenCopy
{{ row.source }}{{ row.scope }}{{ row.verdict }}{{ row.evidence }}{{ row.checked }}—
Source evidence

Point-in-time provider observations and their exact scope.

Blacklist Checker (DNSBL/RBL) Check a mail host or sender IP across selected DNSBLs, distinguish policy listings from resolver errors, and inspect provider evidence.
URL Parser Parse a URL or query string locally, inspect components and duplicate parameters while masking token-like values for a safer review copy.
Hypertext Transfer Protocol (HTTP) Redirect Checker Trace a public HTTP redirect chain hop by hop to identify loops and HTTPS downgrades, compare timing and generate a replayable cURL command.
Hypertext Transfer Protocol (HTTP) Header Checker Check a public URL’s HTTP headers across redirects and review security, cache behavior, browser state and cross-origin exposure.

A suspicious link can hide its intent in more than the domain name. The scheme may use plain HTTP, a familiar brand may appear in a subdomain or path, a query parameter may point to another destination, and encoded characters can make the address difficult to read. Checking the string before opening it preserves evidence and reduces unnecessary exposure.

Reputation sources answer questions at different scopes. An exact-URL service can report one complete destination, while a domain list may report a hostname or a broader parent-domain candidate. Those findings are not interchangeable: one harmful path does not condemn every page on a host, and a quiet path does not clear redirects, sibling paths, downloads, or content added later.

ScopeQuestion answeredWhat remains unknown
Exact URLHas this full destination been reported?Other paths, redirect targets, and future content
Exact hostDoes a domain-oriented source list this hostname?Sibling subdomains and path-level behavior
Parent-domain candidateDoes a broader domain candidate appear on the list?Whether the candidate follows the full public suffix rules
Local string reviewWhich suspicious URL-shape clues are present?Whether the destination actually serves harmful content

A blacklist is time-sensitive evidence rather than a certificate of safety. New abuse may not be listed yet, old findings may persist, and a provider can be unavailable or access-limited. Login, payment, recovery, identity, and wallet links deserve independent verification through a known official channel even when every enabled source is quiet.

Do not test a suspicious destination by opening it in a normal browser. Preserve the original link as text, compare the real hostname with the organization you expected, and use a managed sandbox or incident-response process when content inspection is necessary.

How to Use This Tool:

Paste the original HTTP or HTTPS link without visiting it. A hostname-only value is treated as HTTPS.

  1. Enter one address in Target URL. Remove surrounding prose, but keep the path and query string because they can change exact-URL evidence.
  2. Review the source choices under Advanced. Google Safe Browsing is off by default because enabling it discloses the exact URL; SURBL checks are domain-oriented.
  3. Enable Strict HTTPS review when plain HTTP should carry a stronger local warning, then choose a request timeout from 1,500 through 15,000 ms or use 0 for the 8,000 ms default.
  4. Select Check URL and read the scoped source evidence. A skipped, limited, or failed source is a coverage gap, not a clear result.
  5. Follow the triage recommendation. Preserve listed evidence, retry incomplete checks, and verify sensitive links through a known contact or managed security service.

Interpreting Results:

  • Listed means at least one enabled live source reported its own checked scope as unsafe or listed. Avoid opening the link directly.
  • Limited means a SURBL query path was access-limited. It is inconclusive and takes precedence over a high local score when no source reports a hit.
  • Review means no live hit was returned and the local score reached at least 50 points. Inspect the exact triggers.
  • Partial means no hit or access limit was returned, but at least one live request failed.
  • No listing means none of the enabled completed scopes returned a listing and no higher-priority state applied. It never means “safe.”

Technical Details:

The address is accepted only as HTTP or HTTPS and is limited to 4,096 characters. Host-only input receives an HTTPS scheme. Parsing separates the host, port, path, query keys, and fragment without requesting the destination or following redirects. Private IPv4 literals, IP literals, documentation names, and selected special-use suffixes are identified before live checks.

Formula Core

The local score is the sum of every triggered URL-shape weight, capped at 100 points.

Slocal = min(100,∑i=1nwi)

Here, each w is the fixed point value of a triggered signal. Scores below 20 are Low, scores from 20 through 49 are Review, and scores of 50 or more are High. These labels describe string features, not the probability that a URL is malicious.

SignalPointsTrigger
Plain HTTP10 or 1818 when strict HTTPS review is enabled
Embedded user information20Text appears before @ in the authority
Punycode hostname16A hostname label contains xn--
Private or public IP-literal host20 or 16The hostname is an IP address
Documentation or special-use name8 or 18Reserved example host or selected special-purpose namespace
Non-default port6Not port 80 for HTTP or 443 for HTTPS
Credential-lure term10A known lure word appears in the host, path, or query
Redirect parameter12A query key such as redirect, return, or url appears
Heavy encoding8At least three percent-encoded octets appear
Long URL6 or 12More than 140 characters; 12 above 220
Deep subdomain chain8At least three labels above the parent-domain candidate
Deep path6At least four path segments
Digit-heavy hostname6Digits exceed 35% of alphanumeric host characters
Long query string6More than 80 characters

Lookup Core

When enabled, Google Safe Browsing checks the normalized exact URL and can report malware, unwanted-software, or social-engineering evidence. SURBL checks the exact hostname and, when different, a parent-domain candidate through public DNS. SURBL bitmask answers are decoded into source categories; 127.0.0.1 is treated as access-limited rather than clear.

The parent-domain candidate uses a bounded list of common multi-label suffixes rather than the complete Public Suffix List. It can therefore be wrong for uncommon suffixes. IP literals are skipped for SURBL because that source is domain-oriented.

Decision Rule Core

The overall state follows strict precedence: any live hit produces Listed; otherwise any access-limited SURBL path produces Limited; otherwise a local score of at least 50 produces Review; otherwise any provider error produces Partial; all remaining cases produce No listing. Skipped checks do not count as completed clear evidence.

The public-history window changes prepared follow-up links only. It does not expand the scope or time range of the live verdicts.

Privacy and Accuracy Notes:

No external request runs on initial load. Starting a check sends each enabled source only the data needed for its scope: the exact URL to Google Safe Browsing, or a derived domain query to the public DNS resolver used for SURBL. Local string signals are calculated in the browser.

  • Remove secrets, session tokens, and personal data from a URL when they are not needed to preserve the suspicious evidence.
  • The destination itself is not opened, crawled, downloaded, or followed through redirects.
  • Provider data can contain false positives, false negatives, stale entries, and temporary access failures.
  • Use an authorized sandbox or managed reputation service when the next step requires content inspection.

Worked Examples:

Quiet sources, suspicious structure

A long HTTP login link with embedded user information, a redirect parameter, and several encoded octets can exceed 50 local points even when enabled reputation sources return no listing. The result becomes Review; inspect the hostname and obtain the genuine login address through a known channel.

A listed parent domain

If the exact hostname is quiet but the parent-domain candidate returns a SURBL listing, preserve which scope was listed. Do not rewrite that evidence as an exact-URL finding, but do not open the link until the broader domain issue has been investigated.

References: