Loading page
About this tool
Colour-codes the scheme, userinfo, host, port, path and query of any URL and flags the parts phishing links abuse.
Link Anatomy Highlighter splits a URL into its RFC 3986 parts — scheme, user info, subdomain, registered domain, port, path, query and fragment — and colours each one so you can see which piece actually decides where the click goes. It then flags the structures used in phishing: text before an @ sign, punycode (xn--) hosts, brand names parked in a subdomain, redirect parameters carrying a second URL, and paths ending in an executable. The whole analysis happens in the browser, so the link is read as text and never opened or sent to a server.
Open Link Anatomy Highlighter on AltFTool — it loads instantly in your browser.
Add your input to the workspace.
Adjust the options until the result looks right.
Copy or download the output and put it to work.
Works offline on the text of the link, so it flags brand-new domains that no blocklist has seen yet.
Each finding names the exact part of the URL it came from and why that part is abused.
The link is parsed locally, never fetched, so inspecting a hostile URL cannot trigger it.
The two labels immediately before the first single slash — the registered domain. In https://login.secure.example.com/account the destination is example.com; everything to the left of it is a subdomain the same owner can invent at will, and everything after the slash is a path they also control.
Everything before an @ in the address is the userinfo field from RFC 3986, and browsers ignore it when deciding where to connect. In https://www.bank.com@203.0.113.9/login the browser goes to 203.0.113.9; the bank name is decoration, which is why this remains one of the most common link disguises.
It is the ASCII encoding of an internationalised domain name, always beginning xn--. It matters because letters from Cyrillic or Greek can render identically to Latin ones, so a homograph domain looks like the real brand in the address bar while resolving somewhere else. Reading the xn-- form shows what was actually registered.
No. HTTPS only proves the connection is encrypted and the certificate matches the domain you are visiting — and free certificates take minutes to obtain, so most phishing sites now have one. Judge the registered domain, not the padlock. This tool is educational and does not replace your bank or employer's own reporting process.