URL Analyzer — How to Use and Read the Parse
Use the OpenTrojan URL Analyzer to parse a URL's structure locally, surface obfuscation and phishing signals, and decide whether to check its reputation.
Quick Answer
URL Analyzer parses the URL structure locally to surface obfuscation and phishing indicators, and never fetches the target; use it to decide if the URL warrants a reputation check.
Definition
URL Analyzer parses a URL's components locally and flags obfuscation or phishing signals without contacting the target.
What it is
URL Analyzer (/tools/url-analyzer/) parses a full URL into scheme, host, path, query and fragment locally, and flags obfuscation. It never fetches the target.
How to use
- Paste the raw URL into
/tools/url-analyzer/. - Read the parsed structure and any flags (punycode, userinfo, IP-in-host, encoding tricks, mismatched display vs destination).
Interpretation
- Host vs display — a URL that shows one site but points elsewhere is a classic phishing sign.
- Encoding / special characters — heavy percent-encoding or look-alike characters can hide the real destination.
- The flags suggest suspicion, not certainty; pair them with a reputation check for evidence.
Limitations
- Local parsing cannot see where the URL actually resolves or what the server returns (it deliberately does not fetch).
- Some flags (e.g. punycode) are legitimate; treat each as a signal, not a verdict.
Privacy
Analysis is entirely in the browser — the URL never leaves your machine, keeping the target unknown to the tool and protecting you from accidental contact.
Next steps
- Verify destination reputation → URL Reputation guide.
- Full triage of a suspicious link → Malicious URL analysis playbook.
References
Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.