ToolsEmail

Link checker

Paste a link, a list of links, or the text of a suspicious email. For each link you see where it really goes: the security wrapper removed, the address taken apart, and anything that looks wrong pointed out. Nothing is clickable.

Read and explained in your browser: what you paste stays in it
Optional: ask a link's own server where it redirects, one request when you press the button

The links

How this works

This page finds the web addresses in what you pasted. Defanged ones (hxxps://, [.], (dot), [://]) are turned back into addresses for analysis, and shown defanged again in the output.
It removes security wrappers, up to 5 layers deep, by reading the address inside them: Microsoft Safe Links, Proofpoint URL Defense (v1, v2 and v3), Barracuda Link Protection, Google and Facebook redirectors, and any other address that carries a web address in a parameter such as url, redirect or next. Mimecast protected links can't be undone without Mimecast, and the page says so.
It splits the destination into scheme, user name, host (Unicode and Punycode), registered domain, port, path, each query parameter and fragment, and flags tricks: look-alike names, a brand in front of another domain, IP addresses written in disguise, @ in the address, shorteners, downloads and values that look like a recipient's address.
Only if you press Ask where this redirects: abbott.cloud's server makes one GET request to the link and returns its status and headers. The body is never read and redirects aren't followed. This page reads the Location header, shows it as the next step and analyses it the same way. You can continue step by step, up to 5 times.

What's kept: nothing. The links you paste aren't put in this page's address, stored or sent anywhere unless you use the Ask button for that link.

Limitations:

Nothing found is not the same as safe. A new, clean-looking address can still be malicious, and this page doesn't look up reputation.
Asking contacts the link's own server from this site's server, so its owner may see the request. A site can answer differently to automated requests than to a person, and only public names on ports 80 and 443 can be asked.
Wrapper formats are read from their documented shape. Ones that need the vendor's service (Mimecast tokens) can't be read, and a wrapper not listed above is seen as an ordinary link.
The registered domain uses a short built-in list of suffixes, not the full Public Suffix List.
Up to 50 links, 200,000 characters and 100 query parameters per link are read; the page says when a cap applies.
To protect the sites being asked, abbott.cloud allows a limited number of requests a minute from each visitor and to each website.

Code: links.js (this page), linkcheck.js (unwrapping and checks), htmltext.js and maildomains.js (shared link and look-alike checks), net.js (requests).