# URL Safety Checker Detect phishing and fraud signals in a URL by deep structural analysis β€” punycode/IDN homograph attacks (mixed Latin/Cyrillic), embedded credentials (user:pass@host trick), high-risk TLDs, double-encoding and control-character smuggling, subdomain brand deception, and numeric/IP host obfuscation. Static analysis only, no network. Complements the URL Validator (which does basic protocol/IP checks). > Canonical page: https://elysiatools.com/en/tools/url-safety-checker - **Category:** Security - **Keywords:** url safety, phishing, fraud, punycode, idn, homograph, suspicious url, cybersecurity, spoofing, scam detection ## Overview This tool performs **deep phishing/fraud detection** on a single URL by inspecting its structure. It is intentionally complementary to the **URL Validator**: the validator checks basic protocol/IP/XSS signals, while this tool focuses on the deception techniques attackers use to make a malicious URL *look* legitimate. **What it checks (6 dimensions):** - **IDN Homograph (Mixed Script)** πŸ”΄ β€” Internationalized Domain Names (punycode `xn--`) that mix scripts (e.g. Latin + Cyrillic). This is the "Π°pple.com" attack: a Cyrillic "Π°" looks identical to a Latin "a" but resolves to a different domain. - **Embedded Credentials (userinfo)** πŸ”΄ β€” the `user:pass@host` trick: `https://apple.com@evil.com` puts the brand before "@", but the REAL destination is `evil.com`. Browsers hide the userinfo, making this very deceptive. - **High-Risk TLD** 🟠 β€” TLDs frequently abused for spam/scams (cheap/free registration: `.tk .xyz .top .click` and dozens more). Not inherently malicious, but a strong caution signal. - **Encoding Anomalies** 🟠/🟑 β€” double percent-encoding (`%2561`), encoded protocol sequences, and C0 control characters β€” all used to smuggle payloads past WAFs or fool readers. - **Subdomain Deception** 🟠 β€” a brand name placed in a subdomain position (`paypal.security-update.com`); the registrable domain is `security-update.com`, unrelated to PayPal. - **Numeric/IP Obfuscation** 🟠 β€” raw IP hosts (`192.168.1.1`) or obfuscated numeric forms (hex/decimal) that hide the destination. **Risk score.** Each finding adds to a 0-100 score (critical 35, high 20, medium 10, low 4), mapped to Low/Medium/High/Critical. **Limitations.** This is **static structural analysis only** β€” no network request is made, so it cannot detect newly-registered malicious domains, compromised legitimate sites, or redirect chains. It does NOT replace real-time threat intelligence like Google Safe Browsing. A "Low" rating means no structural phishing signals were found, NOT that the destination is safe. ## Inputs - **URL** (text): Paste a URL to check, e.g. https://Π°pple.com/ or https://paypal.security-update.tk/ ## When to use - When verifying suspicious links in emails or messages before clicking them. - When analyzing potential phishing campaigns or security alerts to identify brand spoofing. - When validating user-submitted URLs in applications to flag high-risk domains or obfuscated hosts. ## How it works - Input a single URL into the checker to initiate the static structural analysis. - The tool parses the URL to inspect six key dimensions, including mixed-script homographs, embedded userinfo credentials, and subdomain deception. - It calculates a risk score from 0 to 100 based on the severity of the detected structural anomalies. - The tool outputs a detailed risk rating (Low, Medium, High, or Critical) along with specific findings for each category. ## Use cases - Inspecting suspicious links containing mixed Latin and Cyrillic characters to expose IDN homograph spoofing. - Identifying hidden destination domains in URLs that use embedded credentials to mask the real host. - Screening user-submitted links for high-risk top-level domains (TLDs) and obfuscated numeric IP addresses. ## Frequently asked questions ### Does this tool check if a URL is currently online or active? No. This tool performs static structural analysis only and does not make network requests to verify if a domain is active. ### What is an IDN homograph attack? It is a deception technique where attackers use characters from different scripts (like Cyrillic and Latin) that look identical to mimic legitimate domains. ### How does the tool detect subdomain deception? It checks if a known brand name is placed in a subdomain position while the actual registrable domain belongs to an unrelated entity. ### Does a 'Low' risk rating guarantee that a URL is completely safe? No. A low rating only means no structural phishing signals were detected; it cannot identify newly registered malicious domains or compromised legitimate sites. ### How does this tool differ from the URL Validator? The URL Validator checks basic protocol, IP, and XSS signals, whereas this tool focuses on structural deception and phishing techniques. ## Related tools - [Security Headers Checker](https://elysiatools.com/en/tools/security-headers-checker): Audit HTTP response headers for security compliance β€” parses the raw headers you paste (no network) and grades them against the OWASP secure-header set with value-level checks: HSTS max-age, CSP unsafe-inline/eval, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP and more. Outputs a letter grade (A+ to F) plus per-header findings with copy-ready fix recommendations. - [AGEX Passphrase Strength Checker](https://elysiatools.com/en/tools/agex-passphrase-strength-checker): Evaluate a passphrase for AGEX file bundles and recommend the most suitable protection profile - [Env File Secret Rotation Planner](https://elysiatools.com/en/tools/env-file-secret-rotation-planner): Paste a .env file and get a staged secret-rotation plan. Detects database URLs, API keys, auth tokens, private keys, cloud credentials, payment keys and encryption secrets, scores each by exposure and age, and schedules them across a 4-week rotation timeline with a dual-key checklist and a generated .env.example. Optional last-rotated dates and a configurable cadence (30/90/180/365 days) drive compliance scoring. - [Accessibility Checker](https://elysiatools.com/en/tools/accessibility-checker): Detect common WCAG 2.1 accessibility issues in HTML, fetched pages, or design images and return fix-ready guidance - [AI Domain Name Idea Generator](https://elysiatools.com/en/tools/ai-domain-name-idea-generator): Generate up to 10 creative domain names with AI and filter out already-registered ones via DNS + RDAP. - [Color Vision Accessibility Checker](https://elysiatools.com/en/tools/color-vision-accessibility-checker): Measure WCAG contrast, simulate major color-vision deficiencies, and optionally flag low-contrast regions in a UI screenshot - [Dimensional Analysis Unit Cancellation Tutor](https://elysiatools.com/en/tools/dimensional-analysis-unit-cancellation-tutor): Step-by-step factor-label unit cancellation with inverted-factor diagnosis and optional student-answer checking. - [Dockerfile Linter & Best-Practices Checker](https://elysiatools.com/en/tools/dockerfile-linter): Hadolint-style static analysis for Dockerfiles without a Docker daemon: 30+ rules across image pinning, package-manager hygiene, layer caching, secrets and signal handling, with severities, line numbers and fix examples. ## Samples - [Speech Learning & Safety Audio Samples](https://elysiatools.com/en/samples/audio-learning-safety-samples): Deterministic synthetic WAV inputs for pronunciation comparison, dictation preflight, alert degradation, and voice privacy tools. - [URL Slug Samples](https://elysiatools.com/en/samples/slug): Collection of valid and invalid URL slug examples for testing (lowercase letters, numbers, hyphens, optional underscores) - [URL Query Analyzer Samples](https://elysiatools.com/en/samples/url-with-query-samples): Comprehensive collection of URLs with query parameters for testing URL parsing, encoding validation, and parameter extraction - [Android Image Processing Java Samples](https://elysiatools.com/en/samples/android-image-processing-java): Android Java image processing examples including reading/saving images, scaling, and format conversion ## Related content - [Authentication, Password, and Token Security Tools](https://elysiatools.com/en/hubs/auth-token-security): Generate and validate passwords, review JWTs, compare password-hash workflows, and inspect auth-related security basics in one hub. - [Document Encryption, Redaction, and Field Security Tools](https://elysiatools.com/en/hubs/document-field-security-workflows): Compare PDF password protection, permission control, encrypted PDF export, CSV/XLSX field encryption, AES bundles, and document redaction tools in one security workflow hub. - [Identifier, Config, and Input Validation Tools](https://elysiatools.com/en/hubs/validation-validate): Compare validators for email, phone, IP, dates, cron, barcodes, payment details, env files, and other real-world inputs in one hub. - [Identifier, Address, and Code Format Validators](https://elysiatools.com/en/hubs/validation-format): Curated tools for identifier, address, account, and code format validation in one hub.