Phishing URL Scanner
AI-scored risk analysis for suspicious links, redirects and payloads.
- Homograph characters clean
- Impersonated brand detected
- Insecure protocol detected
- URL shortener clean
What this plugin does
The Phishing URL Scanner combines lexical heuristics (homograph characters, brand impersonation, suspicious keywords) with reputation lookups to produce a 0–100 risk score. The preview version runs the heuristics client-side; the full scanner also detonates the URL in a sandbox to capture screenshots and final redirect chains.
The URL is tokenised and checked for Punycode, digit-letter swaps, brand tokens and known phishing keywords.
Protocol, subdomain depth, path length, query entropy and known shortener domains are scored.
The full scanner loads the URL in an isolated headless browser and records redirects, form fields and screenshots.
Signals we analyse
- Homograph / Punycode (xn--) characters
- Brand impersonation tokens (paypa1, m1crosoft, …)
- Insecure http:// protocol on a login flow
- URL shorteners hiding the true destination
- Suspicious keywords: login, verify, secure, update
Common use cases
- Triage user-reported suspicious emails
- Automate URL scoring inside SOAR playbooks
- Prove to a customer why their message was quarantined
What a full scan returns
This is what the paid, deep-scan version of the plugin produces — a full breakdown you can export as PDF or JSON.
- failVerdictPhishing
- failRisk score88 / 100
- failHomographdigit '1' replacing 'l'
- failImpersonated brandPayPal
- failFinal redirecthttp://credential-harvest.tk/collect
Frequently asked questions
Do you actually visit the URL?
Only the full scanner does, inside an isolated sandbox. The preview is purely lexical.
How do you avoid false positives?
The AI model weights reputation, WHOIS age and TLS issuance history alongside heuristics.
Can I bulk-scan URLs?
Yes — the API accepts batches of up to 500 URLs per request.
Other free plugins
Ready for the full Phishing URL Scanner?
Preview mode uses simulated data. Unlock live results, historical trends, exports and API access.