Suspicious URL Analyzer

Checking the address bar is the advice everyone gives, and there is a trick built into URLs that defeats it completely. In https://www.paypal.com@secure-verify.example/ the part that reads as PayPal is a username, and the browser goes to secure-verify.example. The Suspicious URL Analyzer takes a link apart and names what it actually resolves to, along with the other deceptions that live in the address itself.

Punycode is the other half of the problem. Browsers show xn--pypal-4ve rather than what it decodes to, because what it decodes to is pаypal with a Cyrillic а that is drawn identically to a Latin a. The tool decodes every label and flags any single word drawing on two alphabets at once.

Nothing is fetched and nothing is uploaded; the link is only read. That is a genuine limit as much as a privacy property, and the page says so rather than implying a verdict it cannot give.

Walkthrough: The Link That Says PayPal

Load Sample opens on https://www.paypal.com@secure-verify.example/account/login. The summary answers the only question that matters first — it really goes to secure-verify.example — and the misleading half is listed underneath as decoration, struck through, because that is exactly its role. Below that sits one finding marked high, explaining that everything between the scheme and the @ is credentials rather than a destination. Cycle the sample and you get a punycode homograph, a bare IP on plain http, a link with paypal.com buried in a subdomain of account-security.example, and finally an ordinary address that produces no findings at all.

The Algorithm Behind the Homograph Check

• Each xn-- label is decoded with the RFC 3492 bootstring algorithm, per label rather than across the whole host, since münchen.example encodes as xn--mnchen-3ya.example and not as one blob. The decoder was checked against Node’s own url.domainToUnicode on six hosts and agreed on all six.
• Every decoded label is then bucketed by script. More than one script inside a single word is the finding, because that is the attack: a Latin a and a Cyrillic а are separate characters that render the same. Japanese is treated as one family, since Han beside kana is ordinary rather than suspicious.
• That distinction is the whole point of doing it this way. münchen is one script and passes cleanly; pаypal is two and does not. A tool that flagged every non-ASCII domain would be useless in most of the world.
• Names are also compared against a list of commonly spoofed brands by edit distance. Anything within 2 characters is reported with the distance, so a near-miss spelling gets caught even when every character is plain ASCII.
• Brand placement is checked separately: in paypal.com.account-security.example the registrable domain is the last two labels, and everything left of them is chosen freely by whoever owns it. Reading left to right stops at the first familiar word, which is what that shape exploits.

Not a Substitute for a Reputation Check

• A clean result means nothing suspicious is visible in the address, not that the site is safe. A phishing domain registered this morning under an unremarkable name passes every check here, and the verdict panel repeats that rather than letting a green tick speak for itself.
• There is no reputation feed, no Safe Browsing lookup and no fetch of the page, because all three would mean sending the link somewhere. That trade is deliberate: the tool stays useful for a link you are not willing to hand to a third party.
• The suffix check is context, never a verdict. Plenty of ordinary sites sit on the flagged endings, and they are marked lowest severity for that reason — though .zip and .mov earn extra caution for also being file extensions.
• Hostnames five labels deep and percent-encoded paths are likewise reported as things to notice rather than accusations, and the decoded path is shown so you can read what the encoding was hiding.
• Paste something that is not a link and it says so plainly: “That is not a URL this tool can take apart. Paste the whole address, including the part before the first slash.” A bare domain with no scheme is assumed to be https rather than rejected.