I Built PhishScope: A Tool for Analyzing Suspicious Links and Phishing Indicators
.example top-level domain, which is permanently reserved for documentation purposes (RFC 2606) and cannot be registered or resolved. No real company, brand, or live malicious site is referenced anywhere in this post.
A phishing URL can look completely fine at first glance. Something like:
...reads as ordinary. Nothing about it screams danger. But "does this look safe" is exactly the wrong question for an analyst to be asking, because a URL like that one can be hiding a redirect chain, a lookalike subdomain, or a parameter carrying a payload — none of which show up just by reading the text.
That's the gap I built PhishScope to close — a tool that breaks a suspicious URL down into individual, checkable indicators (domain, subdomain, structure, redirects, parameters, reputation, impersonation signals) instead of asking you to eyeball it and guess.
Why "Does It Look Suspicious" Isn't Good Enough
While learning phishing analysis, I kept running into the same limitation: judging a link by whether it "looks suspicious" is a gut check, not a methodology. Two links can look equally clean on the surface and be completely different underneath — one perfectly legitimate, one funneling through several redirects to a fake login page hosted on a domain registered yesterday.
I wanted to build something that breaks that gut-check decision down into the individual signals a real investigation would actually examine, so the assessment is built on evidence instead of a first impression.
What Hides Behind a Normal-Looking URL
Here's the kind of thing surface reading misses. A URL might display as:
Everything an analyst actually needs to catch that — the real subdomain structure, the redirect chain, the suspicious parameter — is invisible if you only read the link as displayed. This is exactly the category of investigation PhishScope is built to run through systematically:
How PhishScope Works
Every submitted URL moves through the same pipeline:
Link Inspection
The first pass parses the URL's actual anatomy — protocol, full hostname, path, query parameters — and separates what's genuinely there from what a casual read might assume is there. This is where a lookalike subdomain like examplebank.com.secure-check.example gets correctly identified as belonging to secure-check.example, not examplebank.com, despite how it reads to the eye.
Suspicious URL Indicators
Beyond raw structure, the inspection flags patterns known to correlate with malicious URLs — excessive subdomain nesting, encoded characters hiding the real destination, unusually long or randomized-looking paths, and mismatches between a URL's claimed brand and its actual domain.
Domain Analysis
The domain itself gets evaluated on its own merits — how old it is, how it's structured, and whether it matches patterns typical of throwaway phishing infrastructure (freshly registered, minimal history, disposable-looking naming) versus an established, reputable domain.
Redirects
A URL's displayed destination and its actual destination are often two different things. PhishScope follows the redirect chain to see where a link truly leads, since the final landing page — not the first URL shown — is usually where the real risk lives.
Suspicious Parameters
Query parameters can carry more than they appear to — encoded redirect targets, tracking tokens tied to a specific phishing campaign, or payloads meant to pre-fill a fake login form with a victim's information. These get inspected individually rather than ignored as "just part of the link."
Suspicious Result Walkthrough
Individual Phishing Indicators
Rather than collapsing everything into one verdict immediately, PhishScope shows each flagged indicator on its own — which one fired, and why — so the final assessment is traceable back to specific evidence instead of feeling like a black box.
Potential Impersonation Indicators
A specific, important category on its own: patterns suggesting the URL is trying to impersonate a known brand — a company name embedded as a subdomain of an unrelated domain, spoofed styling cues referenced in the page, or a path structure copying a real login flow.
Risk Scoring
All the individual indicators feed into a combined risk score — weighted so that a single low-severity flag doesn't dominate the outcome, but multiple correlated flags (a young domain, plus a redirect chain, plus a brand-impersonation subdomain) push the score up meaningfully, the same way a real analyst would weigh accumulating evidence rather than any one red flag in isolation.
What a Safe Result Looks Like
Seeing a clean result laid out the same way as a flagged one matters just as much — it shows exactly what "nothing wrong here" looks like at the indicator level, instead of just an unexplained green checkmark.
I initially thought I could just build a "does this URL look suspicious" checker with a handful of obvious rules. It wasn't until I started actually cataloguing indicators individually — domain age separately from redirect behavior, separately from parameter analysis, separately from impersonation patterns — that I realized each one is basically its own small investigation. That's when PhishScope stopped feeling like a script and started feeling like an actual analyst tool.
What Investigating Indicators Individually Teaches
Core Takeaways From Building PhishScope
- A URL's displayed text isn't the URL's actual destination: Subdomains, redirects, and encoded parameters can all diverge from what's shown.
- Domain age and history matter more than people expect: Legitimate services rarely look like a domain registered last week.
- Impersonation hides in structure, not just content: A brand name embedded in a subdomain of an unrelated domain is a structural tell, independent of anything the page itself says.
- Correlated indicators beat any single flag: One odd parameter alone proves little; that same parameter alongside a new domain and a redirect chain is a very different story.
- Traceable evidence builds trust in the verdict: Showing which specific indicators fired makes the final risk score something you can verify, not just take on faith.
Submit a URL and see the indicator-by-indicator breakdown instead of a single yes/no.
Open PhishScopeWhat's Next
I'm planning to expand domain reputation checks with more historical signal and add support for analyzing full email bodies alongside standalone URLs, closer to what MailGuard XDR does for headers and attachments. If there's an indicator category you think is missing, or a real phishing URL pattern PhishScope handled poorly, I'd like to hear about it.
0 Comments