URL Intelligence
Phishing & Threat Detection
URL Intelligence inspects a link before you open it, combining lexical analysis, live page inspection and threat feed correlation into one verdict.
Every signal URL Intelligence pulls
Phishing detection
Risk score & verdict
Threat intelligence feeds
Brand impersonation detection
URL lexical analysis
Webpage content analysis
Who reaches for this engine
Deciding whether a link in an email or message is safe to open before you open it.
Confirming that a login page is impersonating a real brand rather than a lookalike, and identifying what it harvests.
Screening URLs pulled out of threat intelligence feeds or breach dumps to see which are still live.
Under the hood
Analyzes URLs for phishing indicators, brand impersonation, credential theft, and malware distribution. Combines lexical analysis, webpage content inspection, threat intelligence feed correlation, and risk scoring to deliver a comprehensive verdict with actionable findings.
Questions about URL Intelligence
- How do you decide if a URL is phishing?
- Three independent signals are combined. Lexical analysis looks at the URL itself — punycode, brand names in the subdomain, unusual TLDs, deceptive paths. Live inspection fetches the page to see what it actually asks for, since credential-harvesting pages are distinctive. Threat feed correlation checks the URL against known malicious infrastructure.
- What is brand impersonation detection?
- It compares the URL and page content against the brands an attacker most often copies. A login page that asks for a bank or email provider's credentials while being served from an unrelated domain is flagged as impersonation, which is a stronger signal than any individual keyword check.
- Is URL Intelligence safe to run on a suspicious link?
- Yes — the link is analysed, not executed, and you do not need to open it yourself. The service inspects it server-side and reports the verdict, findings and risk score back to you as text, so nothing is loaded in your browser and you are not exposed by visiting it.
- What exactly goes into the final risk score?
- The verdict is the weighted combination of the three signal groups — lexical analysis of the URL itself, the live inspection of what the page asks for, and correlation against known malicious infrastructure. Alongside the score the tool returns the findings that drove the verdict, so the number is never an unexplained black box.
- Is URL Intelligence fully released?
- It ships as beta. The detection pipeline is live and usable, covering phishing, impersonation, credential theft and malware distribution. As with any beta the signal set is expected to tighten over time, which is why the verdict always carries the underlying findings rather than a bare score.