About

Cyber threats often hide behind visually deceptive URLs and high-risk Top-Level Domains. This tool performs a deep architectural analysis of a link to identify patterns common in phishing and malware distribution. While traditional blacklists are reactive, this scanner uses a proactive heuristic model to evaluate the risk score R based on domain entropy, character substitution, and TLD historical abuse rates. It specifically targets typosquatting, where attackers use visually similar characters (e.g., g0ogle instead of google) to deceive users. Understanding these technical markers is critical because most malicious domains are registered and abandoned within 48 hours, often bypassing static blacklists.

Reference Data

TLD Class	Abuse Score	Common Use Case	Risk Level
.com / .org / .net	0.02	Legacy Corporate	LOW
.zip / .mov	0.88	File Delivery (Phishing)	CRITICAL
.top / .xyz	0.65	Low-cost bulk registration	HIGH
.tk / .ml / .ga	0.72	Free TLDs (Botnets)	HIGH
.bank / .gov	0.001	Verified Institutions	VERIFIED
.cc / .su	0.58	Offshore Hosting	ELEVATED
.io / .dev	0.05	Tech Startups	LOW

Frequently Asked Questions

Typosquatting is a form of social engineering where attackers register domains that are visually similar to popular brands, such as "rnicrosoft.com" (using "rn" to look like 'm'). This tool checks for character substitutions, homoglyphs, and common misspellings to identify these deceptive links.

No tool can guarantee 100% safety. A "Safe" result means the URL structure does not match known malicious patterns or high-risk heuristics. Always check for a valid SSL certificate and ensure the content matches your expectations before entering credentials.

Google recently released these TLDs, and security researchers have noted they are frequently used to trick users into downloading malicious files, as the URL looks like a filename. Our engine adds a high penalty to these extensions.

Entropy measures the randomness of characters in the domain. Legitimate brands usually have low entropy (easy to read), whereas algorithmically generated domains (DGAs) used by malware command-and-control servers have high entropy (e.g., 'a1b2c3d4e5f6.com').