The host is the only part that decides where you go
A URL has a scheme, an optional userinfo section, a host, an optional port, a path, a query and a fragment. Your browser resolves the host and connects to it. Nothing in the path or the query influences that at all, which is why a link can read https://update.example.net/paypal.com/account/verify and go somewhere with no connection to PayPal whatsoever.
Domains are read right to left. The rightmost labels are the registered domain — the part someone bought — and everything to the left of it is subdomains, which that owner creates freely and at no cost. paypal.com.secure-billing.example.net is a subdomain of example.net. The paypal.com at the front is a string the attacker typed, no different from a folder name. This tool puts the host at the top of the output for exactly that reason: it is the question, and everything else is context.
Punycode and lookalike characters
DNS carries ASCII, so internationalised domain names are encoded into an ASCII form beginning xn--. The tool decodes that and shows what the label really says. The security problem is that many scripts contain characters that render identically to Latin ones — Cyrillic а, е, о and р are the standard example, and Greek ο joins them. A domain composed entirely of Cyrillic letters can be visually indistinguishable from a famous Latin one while being a completely different registration.
Browsers defend against this with mixed-script heuristics and will often display the raw xn-- form instead of the pretty one when a name looks suspicious. That defence is imperfect and script-dependent. If the address bar shows xn-- on what claims to be a household-name site, that is not a rendering quirk to ignore.
The tricks this looks for
| Shape | What it looks like | Why it works |
|---|---|---|
| Userinfo | https://apple.com@evil.example/ | Everything before the @ is credentials the browser discards; the eye stops reading at the first slash |
| Brand as subdomain | login.microsoft.evil.example | Subdomains are free and unlimited, so any brand name can appear on any domain |
| Deep subdomain chain | a.b.c.d.secure.evil.example | A phone address bar truncates, and the real domain is at the end that gets cut off |
| Bare IP address | http://198.51.100.7/login | No domain to report, no reputation to lose, no registrar to complain to |
| Punycode homograph | xn--pple-43d.com | Renders as a familiar word using characters from another script |
What no URL inspection can do
This page never contacts the address. It parses a string and reasons about its shape. That means it cannot see the certificate, the page content, a redirect chain, or any reputation feed — so a shortener hides its destination completely, and a compromised page on a genuinely legitimate domain looks entirely clean here.
The corollary runs the other way too. Plenty of ordinary marketing mail routes through tracking domains that trip several of these flags at once, and that is normal rather than sinister. Treat the output as a way to see the address clearly, not as a verdict. When the link concerns money or an account you care about, the reliable move needs no analysis at all: ignore the link and reach the service the way you normally would, by typing the address you know or opening the app.
Questions people ask
Does inspecting a URL here visit the site?
No. The string is handed to the browser's URL parser and taken apart in memory. No request goes to the host, nothing is fetched, and no cookie or referrer reaches it. This is genuinely different from clicking, which is the point of pasting a suspicious link in rather than opening it.
No warnings — is the link safe?
It means the address has no obviously deceptive structure, which is a much smaller claim. Only the shape of the string is examined; the page behind it could be anything, including a phishing kit on a domain that looks entirely reasonable. Homograph substitutions such as rn for m are also not detected. For anything involving credentials, go to the service directly rather than through a link.
Can it expand a shortened link?
No. Resolving a bit.ly or t.co address means following the redirect, which requires an actual request to the shortener and would defeat the reason for using this. The structure of the short URL itself is all that can be examined, and it tells you nothing about the destination — which is exactly why shorteners are convenient for hiding one.
Why does a long subdomain chain get flagged?
Because mobile address bars truncate. Given eight labels, a phone shows the first few and elides the rest, so the registered domain at the end — the only part that identifies the owner — is the part you never see. Legitimate sites do occasionally have long hostnames, so it is a prompt to check where the chain ends rather than an accusation.