Domain age
registry RDAP
Registration date, registrar, expiry and registry status flags. Phishing infrastructure is usually days old.
What runs when you check a link, what each finding costs, and — the part worth reading — where this stops being useful.
registry RDAP
Registration date, registrar, expiry and registry status flags. Phishing infrastructure is usually days old.
TLS handshake on :443
Validity, expiry, self-signing, and whether it was actually issued for this hostname. Port 443 is probed even for http:// links.
Safe Browsing · PhishTank
Whether the URL has already been reported and confirmed by somebody else. Not configured on this instance, so it currently reports as unavailable.
the URL itself
IP literals, abuse-prone TLDs, hyphen padding, deep subdomains, punycode, credentials embedded before the hostname.
local brand list
Look-alike spellings, compared after folding characters that are easy to confuse — so paypa1, pаypal and pay-pal all resolve to the same thing. A brand is also looked for inside a longer name, spelled correctly or one character out, which is what catches be-duolinguo.
the page itself
The title and the OpenGraph names — what a browser tab, a bookmark and a chat preview show. A page titled “Duolingo” on a domain Duolingo does not own has said what it is. Body text is left alone: an article that mentions PayPal is not pretending to be PayPal.
HTTP requests
Every hop followed one at a time, and the domain you would actually land on rather than the one you were shown.
Findings carry fixed values, summed and capped at 0–100. This table is generated from the same configuration the scoring engine reads, so it is always what actually ran.
The negative entries are the only thing that brings a score down, and they are deliberately weak: credit fades as risk points accumulate and is gone entirely by 40. An expired certificate on a twenty-year-old domain is still an expired certificate.
A phishing domain registered this morning appears on no blacklist, holds a perfectly valid free certificate, and may redirect nowhere at all. It can score in the low teens and still be a trap. Absence of evidence is the weakest thing this tool produces, and it says so in the result rather than rounding it up to reassurance.
Only the page's title is examined, never what it looks like. A pixel-accurate copy of a bank login sitting on a clean five-year-old domain, titled anything other than the bank's name, looks entirely unremarkable here.
Only HTTP-level redirects are followed. A page that forwards you with JavaScript or a meta refresh registers as a single hop, and the destination reported is the one before the handoff.
Several registries — .be, .de and .it among them — publish no registration data at all. There the age check reports as unavailable and confidence drops. It does not quietly treat them as fine.
The brand list is maintained by hand, so a legitimate regional domain that is not on it — apple.co.uk, say — can read as a look-alike of the one that is.
It is analysed, shown to you, and forgotten. There is no record of what was checked — no history, no lookup table, no counter, no analytics, no accounts. Close the tab and nothing of it remains here.
This is a constraint rather than a boast. People bring this tool the links they are unsure about, and those are disproportionately password resets, unsubscribe links and invoices — addresses with a live single-use token sitting in the query string. Keeping them would be a liability no feature justifies, so there is nowhere to keep them.
the reputation check
Asking whether a URL has been reported means sending them the URL. There is no way around it, and it is the whole value of the check. What comes back is cached here for half an hour — a few flags and the names of any threats found, and never the address itself, which both services echo back in their replies.
the redirect and page checks
Its server receives one request, from ours and never from your browser, for the exact address you pasted. Nothing is filled in, submitted or clicked, and your IP address, cookies and session are never involved.
the domain age check
Only the registered domain is asked about — example.xyz, never the path or query. The reply is public registration data, cached for a day under a hashed key so the cache cannot be read as a list of what people checked.
Fetching a link can be the same as clicking it. A one-time address — an unsubscribe link, a magic sign-in link, a password reset — may be spent by being loaded, whoever loads it. Checking such a link here can consume it, and for a genuine one that means the link no longer works when you come to use it. This is worth knowing before you check anything you were actually sent and intend to use.
Two things briefly outlive a request, neither of them your link. A one-way hash of your IP address is held for about a minute, which is what limits the tool to 20 checks a minute and stops it being used as somebody's free scanner. And the answers from the registry and reputation services are cached as described above, so a second look at the same domain is not a second round of requests to other people's servers.
Three cookies, none of them tracking. One carries the token that proves the Check form was submitted from this site rather than forged elsewhere; the other two are the session it belongs to, which is kept in the cookie itself rather than in a table here — the alternative records an IP address and a browser fingerprint against every visitor, which is a history under another name. All three are encrypted and expire on their own, and none of them records who you are or what you checked. There are no analytics, no third-party scripts, no advertising or measurement cookies, and nothing to consent to.
Errors are logged without the address. When a check fails the log records which check and what kind of failure, never the URL — the error messages from HTTP libraries end with the address they were fetching, and writing those down verbatim would quietly recreate the history this page says does not exist.
No key required, 30 requests a minute. Unusable input returns 422 with {"error":"invalid_url"}.
$ curl -s https://isthislinksafe.be/api/analyze \ -H 'Content-Type: application/json' \ -d '{"url":"https://paypal-login.xyz"}' { "score": 74, "risk": "High", "domain": "paypal-login.xyz", "confidence": "High", "checks": { "domainAge": { "passed": false, "age": 3 }, "ssl": { "passed": true }, "blacklists": { "passed": false }, "typosquatting": { "passed": false, "similarTo": "paypal.com" }, "redirects": 2 } }
checks is the stable contract. Full per-check output, including the reasoning shown on a result page, sits under details. A check that could not run reports "status":"unavailable" rather than a pass.