How to Inspect a Suspicious Link: Punycode, Redirects, WHOIS

Most phishing advice says "hover over the link and check the domain". That works until the domain is spelled with a Cyrillic "а", the real destination hides behind three redirects, or the hostname is the last thing in a 140-character URL nobody reads to the end. Checking a link properly takes about five minutes and a fixed order of operations, and you never need to open it in your normal browser session.

I build PixelValut, a set of browser-side developer and security tools, and I have been triaging suspicious links for clients and my own inbox for years. This is the exact workflow I use, with real command output so you know what each step should look like.

How do you safely check if a link is malicious?

Direct answer: Do not click it. Copy the URL, parse it to find the real hostname, decode any Punycode or percent-encoding, expand shorteners and redirect chains with header-only requests, then check the final domain's registration age and DNS. A lookalike hostname, a very new domain or a redirect that ends somewhere unrelated is enough to treat it as hostile.

The five places a malicious link hides its destination

The first three are about reading the hostname correctly. The last two are about where the request ends up.

Step 1: Parse the URL instead of eyeballing it

Paste the link into the PixelValut URL Parser or, if you prefer a terminal, Python's standard library. Here is the actual output for the three tricky examples from the table:

$ python3 parse_urls.py   # urllib.parse.urlsplit on each URL
https://[email protected]/verify
  scheme=https username=www.paypal.com hostname=login-check.example path=/verify
https://paypal.com.account-verify.example/login?next=%2Fsignin
  scheme=https username=None hostname=paypal.com.account-verify.example path=/login
https://example.com/redirect?url=https%3A%2F%2Fevil.example%2F
  hostname=example.com query=url=https%3A%2F%2Fevil.example%2F

The first line is the clearest lesson: www.paypal.com is parsed as a username. The browser goes to login-check.example. For the second, the registrable domain is the last two labels (or three for suffixes like .co.uk), so account-verify.example owns everything to its left. For the third, the host is legitimate but the encoded url parameter is the real destination; run it through the URL Encoder/Decoder and the target is obvious.

Step 2: Decode Punycode and inspect every character

Internationalized domain names let any Unicode letter appear in a hostname. On the wire, they are encoded as Punycode with an xn-- prefix. That encoding is your friend, because it makes lookalikes visible:

$ python3 -c "print('pаypal.com'.encode('idna'))"
b'xn--pypal-4ve.com'

$ python3 -c "import unicodedata; print(unicodedata.name('аpple.com'[0]))"
CYRILLIC SMALL LETTER A

Two strings that render identically in most fonts are different domains with different owners. Browsers apply mixed-script rules and will often display the xn-- form in the address bar for suspicious combinations, but email clients, chat apps and PDF viewers are less consistent.

In the browser, paste the hostname into the Punycode Converter, which encodes to the xn-- form and warns on mixed-script labels, then into the Unicode Inspector to list each code point, its name and its script. One Cyrillic or Greek letter inside an otherwise Latin brand name is the giveaway.

Step 3: Expand shorteners and follow redirects with headers only

A HEAD or header-only request asks the server where it would send you without rendering the page or running its JavaScript. Two real examples from today:

$ curl -sI https://youtu.be/dQw4w9WgXcQ | grep -iE '^(HTTP|location)'
HTTP/2 303
location: https://www.youtube.com/watch?v=dQw4w9WgXcQ&feature=youtu.be

$ curl -sI https://www.pixelvalut.com | grep -iE '^(HTTP|location)'
HTTP/1.1 301 Moved Permanently
Location: https://pixelvalut.com/

Both are benign: one hop, same organization, HTTPS throughout. A malicious chain usually looks different: a shortener, then a tracking or "cloaking" domain, then a fresh domain, sometimes with an http:// hop in the middle. Repeat the request against each Location until you get a 200 or a loop, or let the URL Unshortener and Redirect Chain Checker do it; both follow headers only and show every hop.

One caveat I learned the hard way: some phishing kits return a harmless redirect to non-browser clients or to IP ranges belonging to cloud providers, and the real one only to a phone on a residential connection. A clean chain lowers risk; it does not prove safety.

Step 4: Check domain age and registration

Brand-new domains are a strong signal. Legitimate login pages almost never live on a domain registered last week. RDAP, the structured successor to WHOIS, gives you the dates directly. Here is the real record for pixelvalut.com:

$ curl -sL https://rdap.org/domain/pixelvalut.com   # relevant fields, queried 27 Oct 2026
registration   2025-07-06T15:25:09Z
expiration     2027-07-06T15:25:09Z
last changed   2026-06-22T17:45:26Z
status         client transfer prohibited
nameservers    DNS1.REGISTRAR-SERVERS.COM, DNS2.REGISTRAR-SERVERS.COM

In the browser, the WHOIS Lookup and Domain Age Checker read the same RDAP data. What I look for:

• Registration within the last few weeks for a domain asking for credentials or payment.
• A one-year registration combined with a brand name in the hostname.
• Nameservers or hosting unrelated to the brand it imitates. A quick DNS Lookup of A and MX records shows where it really lives.

Age alone is not proof. Old domains get compromised, and new startups launch every day. It is one input in the scoring below.

Step 5: Look at TLS and mail authentication, but do not over-trust them

A padlock means the connection is encrypted to whoever controls that hostname. Free certificates are issued automatically to phishing domains as easily as to real ones, so HTTPS is not a trust signal on its own. The SSL Checker is still useful for one thing: the certificate's subject names tell you which hostnames share it, which occasionally exposes a cluster of lookalike domains. My older guide on checking an SSL certificate in 10 minutes covers what each field means.

If the link arrived by email, check whether the message passed SPF, DKIM and DMARC for the domain it claims to come from. My walkthrough on checking SPF, DKIM and DMARC records shows how to read those results in message headers.

A scoring framework you can apply in two minutes

Any single high-risk signal and I treat the link as hostile. Two medium signals and I verify through a separate channel: I type the brand's address myself or call the sender.

The 8-step checklist

1. Copy the link; never click it from the message.
2. Parse it and write down the real hostname.
3. Read the hostname right to left to find the registrable domain.
4. Convert to Punycode and inspect code points for mixed scripts.
5. Decode percent-encoded query parameters that contain URLs.
6. Expand shorteners and follow every redirect with headers only.
7. Check the final domain's registration date, nameservers and A/MX records.
8. If anything is high risk, report it and reach the service through a bookmark or typed address.

If you run a domain yourself, the defensive side matters too: my guide on auditing DNS records before a migration shows how to keep your own records tidy so you are harder to impersonate.

Frequently asked questions

Is it safe to click a link just to see where it goes?

No. Opening a page can run scripts, trigger downloads and confirm to the sender that your address is active. Header-only requests and parsing tools reveal the destination without rendering anything.

Does HTTPS mean a site is legitimate?

No. HTTPS means the connection is encrypted to that hostname. Certificate authorities issue domain-validated certificates automatically, including to phishing domains, so the padlock tells you nothing about who runs the site.

What is an IDN homograph attack?

It is a domain that uses characters from another script, such as Cyrillic "а", to imitate a Latin brand name. Converting the hostname to Punycode exposes it, because the lookalike becomes an xn-- string that no longer resembles the brand.

Can URL shorteners be trusted?

The shortener itself is usually fine; the destination is the unknown. Expand the link with a header-only tool first. Some services also offer preview pages, but checking the redirect chain yourself works for every shortener.

How new is "too new" for a domain?

There is no official threshold. In my own triage, a domain registered within the last few weeks that asks for a login or payment is high risk. Combine age with the other signals rather than relying on a single cutoff.

What should I do after finding a phishing link?

Do not interact with it. Report the message through your email provider's phishing option, tell your IT or security team if it was a work account, and, if you already entered a password, change it immediately and enable multi-factor authentication.

Follow & Connect

• Website: PixelValut Tools
• YouTube: PixelValut (@pixel-valut)
• TikTok: PixelValut (@pixelvalut007)
• GitHub: Muhammad Ali Mughal (@ali111887)
• LinkedIn: Muhammad Ali Mughal