Check if a link is safe before you click it
Paste a link and we'll score it for phishing, malware, and deceptive redirects, then tell you in plain language whether it looks safe. No account needed, and checking a URL does not create a short link or a public page for it.
How the check works
Every check you run here uses the same screening pipeline that runs when a link is created on ilync. A short link cannot be a blind redirect out of this platform: the destination is inspected before the link goes live, and re-inspected for as long as it exists.
The report comes back as a score from 0 to 100 — higher is safer — plus a verdict. A hard failure caps the score below 40 (Dangerous); soft warnings cap it below 80 (Suspicious). Each individual check is listed separately so you can see exactly what passed, what warned, and what failed instead of trusting a single number.
What we check
Threat denylist
The host is matched against a denylist of domains known to host malware, phishing kits, and credential-harvesting pages.
DNS and private-network screening
The domain has to resolve, and it has to resolve to a public address. Resolutions that point at loopback, link-local, or other private ranges are rejected.
Local heuristics
Structural tells that are cheap to check: look-alike hostnames, suspicious TLDs, punycode, raw IP hosts, and credential-bait words in the path.
Reputation
The destination is checked against known-threat reporting. An explicit unsafe report fails the check outright.
Redirect chain
The full redirect chain is followed to the final host, so a short link that quietly lands somewhere else is reported as what it actually is.
Phishing classifier
A local machine-learning model scores the page for phishing. This is the same screening that runs on every link created on ilync.
Link safety questions
How do I check if a link is safe before I click it?
Paste the full URL into the box above and press Check. You get a 0–100 safety score, a plain-language verdict — Safe, Suspicious, or Dangerous — and the result of every individual check that ran. No account, no sign-up, and nothing is shortened or published.
What does ilync actually check?
Six things: a threat denylist, DNS resolution including rejection of private-network addresses, local URL heuristics, destination reputation, the full redirect chain to its final host, and a machine-learning phishing classifier.
Is the safety checker really free and do I need an account?
Yes to both. Anonymous visitors get a small per-minute rate limit and a daily quota, which is enough to check every link in an email or a DM thread. An API key raises the rate limit if you are checking in bulk.
Can I run link safety checks from my own code?
Yes. POST /api/safety-check is a public, unauthenticated endpoint that accepts a single url and returns the same score, rating, and signals. Anonymous requests are rate limited; requests with an API key get a higher limit.
Building this into your own product? The safety endpoint returns the identical report as JSON. Every link you shorten is screened with it automatically.