URL Safety Analyzer

A redirect chain is the sequence of URLs a browser visits when following a shortened or forwarded link. Each hop can pass through a different domain — including tracking servers, affiliate platforms, or malicious landing pages — before reaching the final destination. A link that appears to go to a trusted site may redirect through an attacker-controlled domain. ShieldScope traces each hop and shows the full chain with HTTP status codes.

ShieldScope checks for common URL deception techniques: brand impersonation in the domain or path (e.g., paypa1.com, amazon-support.xyz), lookalike TLDs, excessive subdomains used to bury the real registrant domain, recently registered domains (common in phishing campaigns), missing or invalid SSL certificates, and suspicious path structures. These are heuristic signals — each finding declares its confidence level.

Domain age is when a domain was first registered. Attackers frequently register new domains for phishing campaigns and abandon them after use — so a domain registered days or weeks ago is a meaningful signal when combined with other factors. Legitimate brands typically have domains registered years earlier. A newly registered domain impersonating a known brand is a strong combined indicator of phishing.

ShieldScope follows redirects passively — it reads HTTP response headers and status codes only. It does not execute JavaScript, render page content, crawl links, or perform active probing. Analysis is based on DNS, WHOIS data, SSL certificate inspection, and URL structure. No content is injected, no forms are submitted, and no data is stored from the submitted URL.