b2KIT

Phishing URL Pattern Detector

Detect phishing URLs using heuristics: IDN homograph detection, brand impersonation, suspicious subdomains, and path analysis.

Tested tool guide Tested browser tools Checked August 16, 2026

What Phishing URL Pattern Detector does, with a checked example

This tool inspects a URL's structure the way a phishing link is built: the hostname, the registrable domain, the script of each character, and the path. It flags IDN homographs (Cyrillic or Greek characters that render like Latin letters), brand names placed where they do not belong, subdomain tricks that make a foreign domain read like a trusted one, and path keywords such as 'login' or 'verify'. Nothing is fetched; the URL is analyzed entirely in the browser. The thing most people get wrong: a clean report is not a safety certificate. The tool sees the link's shape, not the page behind it.

Worked example

A concrete input and expected output from the current implementation.

Input

https://www.paypal.com.verify-login.xyz/account/signin

Expected output

Flags raised:
- Brand impersonation: the label 'paypal' appears in a subdomain of verify-login.xyz, which is not paypal.com.
- Suspicious subdomain: 'paypal.com' reads as a dotted prefix under an unrelated registrable domain, the classic lookalike structure.
- Suspicious path: '/account/signin' matches keywords common on credential-harvesting pages.
Registrable domain: verify-login.xyz. Risk level: high.

The last two labels, verify-login.xyz, are the registrable domain; everything before them, including the 'paypal.com' prefix, belongs to whoever owns that domain. A URL shaped so its left part reads like a trusted site while the real owner is elsewhere is exactly what the brand and subdomain checks exist to catch.

How the result is produced

1

Host parsing and registrable domain

The URL is split into scheme, host, port, path, and query. The host is reduced to its dot-separated labels, and the trailing labels that form the registrable domain (for a plain TLD, the last two) become the anchor of trust. Each earlier label is searched for brand names and brand-plus-TLD sequences; 'paypal' in any label other than the registrable domain triggers a brand impersonation flag, which is why paypal.com.evil.xyz is reported while paypal.com is not.

2

Homograph characters and path scoring

Each label's characters are checked against confusable sets: Cyrillic, Greek, and other scripts contain letters that render almost identically to Latin ones, and a label mixing scripts is reported with the suspect characters named. The path is scored against keywords typical of credential pages, such as signin, verify, secure, and update, and combined with the domain findings into a risk level.

Good uses

  • An email claiming to be from your bank carries a link to an address you do not recognize; paste it here before clicking.
  • A message says a link is an official account page, but the address shows the company name somewhere unusual; check where the brand actually sits in the host.
  • You typed a domain in the address bar and landed on a near-identical page; paste the address to see whether lookalike characters or a lookalike domain are involved.

Limits and checks

  • No flags is not a pass. The checks are pure URL-shape heuristics: the page behind the link, its certificate, and its reputation are never inspected. A malicious site on a compromised or brand-new domain can present an unremarkable URL, so a clean report only means the address does not follow known phishing patterns.
  • Legitimate links get flagged too. A vendor's own subdomain containing its product name, or a company whose name includes another brand's trademark, can trip the same rules the phishing checks use. Treat flags as a prompt to verify ownership, not as proof of malice.
  • The tool sees only the URL you paste. Shortened links and redirects hide the real destination and cannot be followed, so a bouncing or abbreviated address is judged on its visible shape alone.

Common questions

Does a clean result mean the link is safe to click?

No. A clean report means the URL does not look like the known phishing patterns this tool checks; it cannot vouch for the page behind the link. A compromised legitimate site or a brand-new domain can host a malicious page behind an ordinary address. Read a flagged result as 'verify this sender', and read a clean one as 'still verify the sender'.

How do I read a URL the way the detector does?

Find the registrable domain, the name right before the TLD: in paypal.com.verify-login.xyz that is verify-login.xyz, and in paypal.com it is paypal. Everything further left is decoration that whoever controls that domain can place arbitrarily, so read the host from right to left and trust only the last two labels for a plain TLD.

References and verification

The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools

Password Generator

Generate strong, random passwords with customizable length, character sets, and complexity requirements.

Password Strength Checker

Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.

Random String Generator

Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.

QR Code Generator

Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.

QR Code Reader

Scan and decode QR codes from uploaded images or your device camera to extract embedded data.

File Checksum Calculator

Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.