Checking links one at a time is fine until you have forty of them. Then the tool stops fitting the job. This page takes a list and returns a verdict for each entry in a single pass, so you can scan down a column instead of opening twenty tabs.
Who this is for
Support and moderation teams
A user reports a batch of suspicious links, or a moderation queue fills with posts containing addresses. Paste the list, see which ones are flagged and why, and act on the ones that matter instead of opening each in turn.
Marketing and content teams
Before a newsletter goes out, check that every outbound link still resolves where it should and that no partner domain has expired into someone else's hands. Link rot is not only a broken-experience problem; abandoned domains get re-registered, and the new owner is not always benign.
Anyone auditing a vendor or partner list
Third-party domains change ownership quietly. A periodic pass over the list of domains you link to, embed from or accept traffic from catches the ones that have gone bad since you last looked.
Researchers and students
Working through a set of domains from a dataset or a report, the per-link breakdown gives you domain age, certificate details and blocklist status without writing a script or holding an API key.
What each link gets
- Redirect tracing. The full chain, including the final destination and any hop that drops from encrypted to unencrypted.
- Domain age. Registration date from the registry record, which is the single strongest cheap signal for fraud.
- Certificate inspection. Validity, issuer, age and whether the certificate matches the hostname.
- Google Safe Browsing. Whether the destination is already on Google's blocklist.
- Hostname heuristics. Brand impersonation, digit substitution, credential-bait words and heavily abused top-level domains.
Reading the results efficiently
Work from the pill on the right of each row. Anything marked medium, high or critical deserves reading in full. Entries marked safe carry a short explanation rather than a bare tick, because "no cheap signal fired" is a more honest summary than "this is fine".
Why twenty
Each link involves a live registry lookup, a certificate handshake and a redirect trace against real servers. Those take real time and real upstream capacity, and this endpoint needs no account and no key, so requests are rate limited. Each batch accepts up to twenty URLs. For larger volumes, or to run this on a schedule, a scheduled run against the full multi-engine scanner is the right approach; email us and we'll help.
Accepted formats
One link per line. The protocol is optional, so example.com and https://example.com/path both work. Duplicates are removed automatically. Blank lines are ignored. Anything that cannot be parsed as a web address is reported as an error on its own row rather than silently dropped, so the output always lines up with the input you gave it.
Limits worth knowing
These are the cheap checks: no antivirus engines, no sandbox detonation, no page content analysis. They are excellent at catching disposable scam infrastructure, which is most of what circulates, and they say nothing about a compromised legitimate site or a malicious file hosted on an otherwise clean domain. Treat a clean bulk result as "nothing obvious", then escalate anything that still looks wrong.