Suspicious Link Checker (Is This Link Safe?)
Check links for phishing red flags without opening them.
This is a heuristic check of the address only, not a guarantee. The link is never opened or fetched, so shortened links and page content cannot be checked. When in doubt, type the company's address yourself.
Use via API
Check a link for phishing red flags without visiting it: lookalike and punycode domains, brand names in subdomains, IP hosts, shorteners, risky TLDs and schemes, credentials in URLs. Returns a 0–100 score and a verdict. Offline heuristics, not a blocklist lookup. Send JSON, get JSON back.
POST https://pithlab.com/api/v1/tools/url-safety-checker
curl https://pithlab.com/api/v1/tools/url-safety-checker \
-H "Authorization: Bearer $PITHLAB_KEY" \
-H "Content-Type: application/json" \
-d '{"input":"https://paypal.com.account-verify.example.xyz/login?session=1"}'About the Suspicious Link Checker
Paste a link or a whole message to spot phishing tricks: lookalike domains, hidden @ addresses, raw IPs, shorteners and fake file types. Never opens the link.
How to use the Suspicious Link Checker
- Paste a single link, or a whole email, text or chat message. Every link in it is picked out and checked.
- Read the real domain for each link. This is the part someone actually owns, which can differ a lot from what the link appears to say.
- Go through the red flags, each explained in plain English, and the overall score.
- If in doubt, do not click. Go to the company's website by typing its address yourself, or contact them another way.
Examples
Input
https://[email protected]/verify
Output
https://[email protected]/verify Verdict: Suspicious (score 45/100) Real domain: secure-login.xyz [high] Text before @ hides the real address [low] Often-abused ending: .xyz [low] Uses urgent account words
Input
https://xn--80ak6aa92e.com/
Output
https://xn--80ak6aa92e.com/ Verdict: Likely dangerous (score 70/100) Real domain: аррӏе.com [high] Lookalike characters [high] Imitates apple
Frequently asked questions
Does this tool open or visit the link?
No. It only reads the text of the link in your browser. Nothing is fetched, nothing is sent to a server and links are never made clickable. That also means it cannot see what the page contains or where a shortened link redirects.
If it finds no red flags, is the link safe?
Not necessarily. This is a heuristic check of how the address is built, not a guarantee. A brand-new scam site with a plain-looking domain can pass, and a hacked legitimate site will look normal. If a message pressures you to act quickly, go to the site directly instead.
What is a lookalike (homoglyph) domain?
Some letters in other alphabets look identical to Latin ones, such as Cyrillic а and Latin a. Scammers register domains like аррӏе.com that read as apple.com. Browsers store them as Punycode (xn--…), which this tool decodes and checks for mixed or imitating alphabets.
How does it find the real domain?
It uses a built-in subset of the Public Suffix List covering common endings such as .co.uk, .com.au and shared hosts like github.io. Rare country endings not in the subset are treated as single-part, so the real domain shown may be one level off for those.
Why can't it tell me where a bit.ly link goes?
Finding out means visiting the shortener, and this tool works entirely offline for your privacy. Many shorteners offer a preview page (for example adding + to a bit.ly link), or ask the sender for the full address.