Domain + URL Lookup

You're using Domain + URL Lookup as a guest (3 lookups/day). Sign up or sign in for 100 lookups/day.

About this tool

Enter a domain or URL to run CyberBlink's own deterministic structure analysis (hostname shape, encoding, credential syntax, and more) combined with standard DNS resolution -- entirely CyberBlink-owned, no external threat-intelligence feed is queried.
A result of “Suspicious” requires meaningful evidence from at least two independent categories of anomaly, never a single unusual property or a large volume of minor ones.
“No Known Threat Evidence” means this analysis found no basis for suspicion in what it checked -- it is not a safety guarantee, and is not proof the domain or URL is harmless.
This tool never fetches, renders, or follows redirects for a submitted URL, and does not (yet) assess IP addresses or file hashes -- those are reported honestly, not silently misclassified.
This is what CyberBlink itself detects about a domain or URL's structure -- it does not check whether the indicator has been observed in threat-intelligence feeds. For IP addresses, subnets, or file hashes, or to check an indicator against CyberBlink's cached threat-intelligence data, use IOC / Threat Intel Lookup instead.

Example result

Illustrative example, not a live lookup

Here is what CyberBlink returns for a submitted URL that mixes a literal IP address, plaintext HTTP, and embedded userinfo (“user:pass@”) credential syntax -- the credentials themselves are stripped before display, as shown below. Submitted value (illustrative): http://admin:P@ssw0rd123@10.0.0.5/wp-admin. This is the exact production result component a real, signed-in lookup uses, fed a fixed example instead of a live analysis.

Analysis result

http://10.0.0.5/wp-admin

Verdict: Suspicious
Confidence: Confidence: moderate
Type: URL

Reasons

URL uses http:// rather than https://.
URL uses a literal IP address as its hostname instead of a domain name.
Submitted URL included userinfo ("user:pass@") credential syntax before the hostname.
URL's authority section contains 2 "@" characters, exceeding the 1-character heuristic threshold.
Independent evidence families involved: HOST_IDENTITY, URL_STRUCTURE.

Evidence

HeuristicCyberBlink URL-structure heuristics: URL uses http:// rather than https://.
HeuristicCyberBlink URL-structure heuristics: URL uses a literal IP address as its hostname instead of a domain name.
HeuristicCyberBlink URL-structure heuristics: Submitted URL included userinfo ("user:pass@") credential syntax before the hostname.
HeuristicCyberBlink URL-structure heuristics: URL's authority section contains 2 "@" characters, exceeding the 1-character heuristic threshold.

Limitations

This assessment uses only CyberBlink-owned deterministic domain/URL analysis and standard DNS resolution -- no external threat-intelligence feed, WHOIS/RDAP registration data, or Certificate Transparency log is consulted (see docs/ioc/IOC-SOURCE-GOVERNANCE.md).
"No Known Threat Evidence" means this analysis found no basis for suspicion in what it checked -- it is not a safety guarantee, and is not proof the domain or URL is harmless.
This tool never fetches, renders, or follows redirects for the submitted URL -- only its structure and its hostname's DNS resolution are analyzed.
DNS resolution was skipped: the submitted host is already a literal IP address, not a name to resolve.

How this works

For a domain, CyberBlink queries standard DNS A, AAAA, CNAME, MX, and NS records (RFC 1035) and reports exactly which record types resolved -- never a third-party DNS-reputation feed. DNS is skipped entirely for a URL whose host is already a literal IP address, as in the example above, since there is no name to resolve.
Both domains and URLs are checked against CyberBlink's own deterministic structural heuristics: hostname shape (IP-literal hosts, excessive subdomain depth, punycode/IDN labels, unusually long or high-entropy labels), and for URLs specifically, transport (plain HTTP, non-default ports), URL structure (embedded userinfo credentials, excessive path depth or query complexity, redirect-style parameter names), and encoding anomalies (double or malformed percent-encoding).
A “Suspicious” verdict requires evidence from at least two independent categories of anomaly at once -- a single unusual property, or many minor ones from the same category, is never enough on its own.

Analyze a domain or URL

Enter a domain (e.g. example.com) or a URL (e.g. https://example.com/login) to run CyberBlink's deterministic domain/URL structure and DNS analysis.