LegitInformant

URL inspector - take a link apart before you click it

Split a link into its real destination, its tracking junk, and the redirect buried in the query string.

Nothing leaves your browser. This tool does its work on your own machine — there is no upload, no server request, and nothing is stored.

The link is parsed as text. It is never opened, requested or followed.

Where a link can lie to you

The @ trick

In a URL, anything between the scheme and an @ is a username, not a destination. So https://www.yourbank.com@evil.test/login goes to evil.test, and the bank's name is just a username being sent along with the request. This is legal URL syntax that has existed for decades, and it remains one of the most effective disguises there is because the real domain sits where nobody reads.

The rule that always works: the real host is whatever comes immediately before the first single slash, reading left to right, ignoring everything before an @.

The brand-in-the-subdomain trick

yourbank.com.account-verify.test is not a yourbank.com address. It is a subdomain of account-verify.test, and anyone who owns that domain can create it in seconds at no cost. Read a hostname from the right: the last two labels are the domain, everything before them was chosen freely by whoever owns it.

A link inside the link

Many legitimate sites accept a ?next= or ?redirect= parameter so they can return you somewhere after login. Attackers use exactly that feature to borrow a trusted domain's reputation: the link you see and hover really is the trusted site, and the trusted site then forwards you elsewhere. This tool decodes any URL it finds hiding inside a parameter and shows it separately.

Tracking parameters

utm_source, fbclid, gclid and their relatives tell the destination which ad, email or post you came from. They are not dangerous, but they are not needed either — the cleaned link shown in the result is the same page without them.

The limit of reading a link

Everything above is visible in the text. What is not visible is where the link actually ends up after the server responds, since a redirect can point anywhere and can change between one visit and the next. For that, paste the link into the full check: it follows the chain, records each hop, and scores the destination against blocklists and registration history.

Common questions

How can a link show one domain and open another?

The commonest trick uses the userinfo field. Everything before an @ in the host part is a username, not a destination, so https://example.com@evil.test goes to evil.test. Another is a redirect parameter, where the real target is a second URL encoded inside the query string.

What are the utm_ parameters in my links?

Campaign tracking tags added by marketing tools. They tell the destination site which ad or newsletter you came from. They are not dangerous, but they are usually safe to delete, and this tool shows you the link without them.

Does the inspector open the link?

No. It parses the text you paste, in your browser. If you want the redirect chain actually followed and the destination scored, run the link through the main check on the homepage instead.

These tools check form, not honesty. A valid checksum, a passing SPF record or a decoded link tells you something is well formed — never that the person behind it is telling the truth. When money is involved, verify on a phone number you already had, and run the link or address through the full check as well.