Evaluación heurística de enlaces en tiempo real: detección de ataques homográficos Punycode, ofuscación de parámetros y riesgos de phishing.
Stateless edge execution • Zero database retention • No user tracking or behavioral profiling
Every network lookup executes inside a temporary, isolated V8 sandbox deployed across Cloudflare's global edge. Each isolate is instantiated on demand, parses public DNS or TLS socket records in transient RAM, returns the result stream, and terminates immediately.
IncogSay operates under a strict zero-retention guarantee. Target domains, submitted URLs, and user IP addresses are never written to disk, stored in relational databases, or logged in persistent files. We do not maintain historical query logs or link lookups to user identities.
All tools are completely free and functional without registration, user logins, or account creation. We never deploy invasive session fingerprints, third-party analytics trackers that capture input payloads, or behavioral profilers. Your queries remain ephemeral and anonymous.
Pega la URL sospechosa en el cuadro de análisis.
Pulsa "ESCANEAR URL" para descomponer la estructura sintáctica del enlace.
Revisa la puntuación de riesgo heurístico, certificados SSL asociados y detección de caracteres IDN falsificados.
Toma una decisión informada antes de interactuar o introducir credenciales en el sitio web.
Los ciberdelincuentes ocultan con frecuencia la verdadera dirección de destino mediante redirecciones opacas, acortadores de enlaces anidados y parámetros codificados en Base64. Analizar la URL en un entorno aislado previene la exposición directa de tu navegador a exploits o páginas de recolección de credenciales.
Link and URL inspection uses multi-layered heuristic analysis to trace redirect hops, calculate domain entropy, and isolate phishing evasion techniques before client browser execution.
Traverses HTTP 301/302/307/308 responses, client-side meta refresh tags, and JavaScript location replacements to expose final landing pages obscured by intermediary tracker cloaks.
Evaluates character frequency distribution across hostnames and URL path tokens. Flags randomized strings (≥ 3.8 bits/char) characteristic of Domain Generation Algorithms and disposable payloads.
Detects Cyrillic, Greek, and Latin cross-script visual lookalike substitutions in Internationalized Domain Names (IDNs), uncovering spoofed bank, portal, and authentication login domains.
Inspection executes in an isolated sandbox isolate. Neither the scanned URL, client IP address, nor response headers are written to persistent disk or forwarded to advertising telemetry.
Common administrative and operational scenarios solved by this tool
Safely inspect suspicious links reported by employees or customers without clicking them in a browser. Deobfuscate shortened URLs (bit.ly, tinyurl, t.co) to reveal the actual destination server before sandbox analysis.
Trace complex 301, 302, and JavaScript redirect loops across ad networks, affiliate links, and campaign tracking domains. Identify broken hops, insecure intermediate HTTP downgrades, and excessive latency overhead.
Uncover lookalike domains that use Cyrillic or Greek characters to impersonate trusted banks, software vendors, and enterprise portals. Identify weaponized Internationalized Domain Names (IDNs) designed to evade human visual detection.
Decode QR codes from parking meters, physical correspondence, or emails to inspect the embedded URL payload without triggering camera-app browser navigation, protecting against mobile credential harvesting.
Direct, peer-reviewed engineering answers to core deployment, troubleshooting, and compliance questions.
Es una técnica de suplantación donde los atacantes sustituyen caracteres latinos por caracteres idénticos de alfabetos cirílicos o griegos (codificados en Punycode xn--) para crear webs idénticas a marcas legítimas.
Combinamos análisis estructural de patrones de ofuscación, entropía léxica de Shannon, verificación de antigüedad de dominio y análisis de certificados TLS.