Reference

What runs when you check a link, what each finding costs, and — the part worth reading — where this stops being useful.

What happens when you press Check

  1. 01
    The URL is reduced to its registered domain Using the Public Suffix List, so https://login.paypal.com.example.xyz/login becomes example.xyz — the only part of that address anyone had to pay for. Paths, queries and fragments are discarded.
  2. 02
    Seven checks run against a 8.0-second budget Each gets a slice of whatever time is left. Anything that cannot finish is reported as unavailable and lowers the confidence rating. A lookup that failed never counts as a lookup that passed.
  3. 03
    Findings are scored and shown with their reasoning Every point traces back to a named finding, so you can disagree with the number rather than take it on faith.

The seven checks

Domain age

registry RDAP

Registration date, registrar, expiry and registry status flags. Phishing infrastructure is usually days old.

Certificate

TLS handshake on :443

Validity, expiry, self-signing, and whether it was actually issued for this hostname. Port 443 is probed even for http:// links.

Reputation

Safe Browsing · PhishTank

Whether the URL has already been reported and confirmed by somebody else. Not configured on this instance, so it currently reports as unavailable.

Name structure

the URL itself

IP literals, abuse-prone TLDs, hyphen padding, deep subdomains, punycode, credentials embedded before the hostname.

Brand match

local brand list

Look-alike spellings, compared after folding characters that are easy to confuse — so paypa1, pаypal and pay-pal all resolve to the same thing. A brand is also looked for inside a longer name, spelled correctly or one character out, which is what catches be-duolinguo.

Page content

the page itself

The title and the OpenGraph names — what a browser tab, a bookmark and a chat preview show. A page titled “Duolingo” on a domain Duolingo does not own has said what it is. Body text is left alone: an article that mentions PayPal is not pretending to be PayPal.

Redirects

HTTP requests

Every hop followed one at a time, and the domain you would actually land on rather than the one you were shown.

Scoring

Findings carry fixed values, summed and capped at 0–100. This table is generated from the same configuration the scoring engine reads, so it is always what actually ran.

Registration

Registered within the last week, or not registered at all +38
Registered within the last month +30
Less than three months old +18
Less than six months old +10
Registered more than two years ago -12
Registered more than five years ago -20

Certificate

Certificate has expired +30
Certificate was issued for a different hostname +30
Certificate chain could not be verified +25
Certificate is self-signed +22
No HTTPS at all +20
Certificate expires within a fortnight +4

Reputation

Listed by Safe Browsing or PhishTank +60
Submitted to PhishTank, not yet reviewed +15

Name

Reads as a known brand once confusable characters are folded +35
One or two characters away from a known brand +25
Raw IP address instead of a hostname +25
Near-spelling of a brand sits in a subdomain of an unrelated domain +24
Brand name sits in a subdomain of an unrelated domain +22
Near-spelling of a brand padded into the registered name +22
Credentials embedded before the hostname +20
Brand name padded into the registered name +15
High-abuse top-level domain +15
Internationalised (punycode) hostname +14
Name looks machine-generated +12
Urgency or security wording in the hostname +12
Percent-encoded characters in the path +10
Three or more hyphens +8
Three or more subdomain levels +8
Hostname over 30 characters +8
Served on a non-standard port +8
URL over 100 characters +6
Is the genuine domain for a known brand -20

Page

The page presents itself as a brand the domain does not belong to +28

Redirects

Redirects from HTTPS down to HTTP +12
Three or more hops +10
Ends on a different domain than the one given +8
High 70–100
Medium 40–69
Low 15–39
Minimal 0–14

The negative entries are the only thing that brings a score down, and they are deliberately weak: credit fades as risk points accumulate and is gone entirely by 40. An expired certificate on a twenty-year-old domain is still an expired certificate.

What this will not catch

  1. A phishing domain registered this morning appears on no blacklist, holds a perfectly valid free certificate, and may redirect nowhere at all. It can score in the low teens and still be a trap. Absence of evidence is the weakest thing this tool produces, and it says so in the result rather than rounding it up to reassurance.

  2. Only the page's title is examined, never what it looks like. A pixel-accurate copy of a bank login sitting on a clean five-year-old domain, titled anything other than the bank's name, looks entirely unremarkable here.

  3. Only HTTP-level redirects are followed. A page that forwards you with JavaScript or a meta refresh registers as a single hop, and the destination reported is the one before the handoff.

  4. Several registries — .be, .de and .it among them — publish no registration data at all. There the age check reports as unavailable and confidence drops. It does not quietly treat them as fine.

  5. The brand list is maintained by hand, so a legitimate regional domain that is not on it — apple.co.uk, say — can read as a look-alike of the one that is.

What happens to the link you paste

It is analysed, shown to you, and forgotten. There is no record of what was checked — no history, no lookup table, no counter, no analytics, no accounts. Close the tab and nothing of it remains here.

This is a constraint rather than a boast. People bring this tool the links they are unsure about, and those are disproportionately password resets, unsubscribe links and invoices — addresses with a live single-use token sitting in the query string. Keeping them would be a liability no feature justifies, so there is nowhere to keep them.

Who sees the address anyway

Google Safe Browsing · PhishTank

the reputation check

Asking whether a URL has been reported means sending them the URL. There is no way around it, and it is the whole value of the check. What comes back is cached here for half an hour — a few flags and the names of any threats found, and never the address itself, which both services echo back in their replies.

The site being checked

the redirect and page checks

Its server receives one request, from ours and never from your browser, for the exact address you pasted. Nothing is filled in, submitted or clicked, and your IP address, cookies and session are never involved.

The registry

the domain age check

Only the registered domain is asked about — example.xyz, never the path or query. The reply is public registration data, cached for a day under a hashed key so the cache cannot be read as a list of what people checked.

  1. Fetching a link can be the same as clicking it. A one-time address — an unsubscribe link, a magic sign-in link, a password reset — may be spent by being loaded, whoever loads it. Checking such a link here can consume it, and for a genuine one that means the link no longer works when you come to use it. This is worth knowing before you check anything you were actually sent and intend to use.

  2. Two things briefly outlive a request, neither of them your link. A one-way hash of your IP address is held for about a minute, which is what limits the tool to 20 checks a minute and stops it being used as somebody's free scanner. And the answers from the registry and reputation services are cached as described above, so a second look at the same domain is not a second round of requests to other people's servers.

  3. Three cookies, none of them tracking. One carries the token that proves the Check form was submitted from this site rather than forged elsewhere; the other two are the session it belongs to, which is kept in the cookie itself rather than in a table here — the alternative records an IP address and a browser fingerprint against every visitor, which is a history under another name. All three are encrypted and expire on their own, and none of them records who you are or what you checked. There are no analytics, no third-party scripts, no advertising or measurement cookies, and nothing to consent to.

  4. Errors are logged without the address. When a check fails the log records which check and what kind of failure, never the URL — the error messages from HTTP libraries end with the address they were fetching, and writing those down verbatim would quietly recreate the history this page says does not exist.

API

No key required, 30 requests a minute. Unusable input returns 422 with {"error":"invalid_url"}.

POST /api/analyze
$ curl -s https://isthislinksafe.be/api/analyze \
    -H 'Content-Type: application/json' \
    -d '{"url":"https://paypal-login.xyz"}'

{
  "score": 74,
  "risk": "High",
  "domain": "paypal-login.xyz",
  "confidence": "High",
  "checks": {
    "domainAge": { "passed": false, "age": 3 },
    "ssl": { "passed": true },
    "blacklists": { "passed": false },
    "typosquatting": { "passed": false, "similarTo": "paypal.com" },
    "redirects": 2
  }
}

checks is the stable contract. Full per-check output, including the reasoning shown on a result page, sits under details. A check that could not run reports "status":"unavailable" rather than a pass.