Phishing URL inspector
Almost every phishing attack turns on one thing: making a link look like it goes somewhere it doesn’t. Paste a URL and this pulls it apart to show where it truly points, and flags the specific tricks used to disguise it. No fetch, all in your browser.
How it works
The one thing that decides where a link goes is the registrable domain, roughly, the name plus its public suffix (example.com, example.co.uk). Everything else is decoration the domain’s owner controls: any subdomain (secure-paypal.evil.com), any path (evil.com/paypal.com/login), any brand name dropped in to reassure you. The inspector isolates the registrable domain and highlights it, because reading that, not the reassuring words around it, is the whole skill.
On top of that it checks the classic disguises: homoglyph and punycode lookalikes (a Cyrillic а standing in for a Latin a, or an xn-- internationalised domain); brand impersonation where a trusted name sits in the subdomain or path but the real domain is something else; typosquats a character or two away from a known brand (measured with edit distance); the userinfo “@” trick, where everything before an @ is ignored by the browser; raw-IP hosts, abused TLDs, URL shorteners, and urgency wording.
The honest limits: it reasons about the string only. It never requests the URL, so it can’t follow a shortener’s redirect or judge what the page actually does, and its registrable-domain logic uses a compact suffix list rather than the full Public Suffix List. It’s a fast structural gut-check, not a sandbox. The instinct it’s meant to build, find the real domain first, is the one that stops most phishing cold.