Safe Browser

About the safe browser

Paste any URL and NetSight opens it in a sandboxed headless browser at our edge. You get a screenshot, the final URL after redirects, and a threat-intelligence roll-up combining browser safety flags, a multi-engine scan, URL abuse data and known indicators of compromise. Your own machine never fetches the URL.

What we run

• IP-logger detection - matches the link and its redirect destination against a curated list of 150+ known IP-grabber services and their custom-domain aliases.
• URL-shortener detection - flags common shorteners that can mask any destination.
• Brand-lookalike detection - catches typosquats of high-value targets like payment providers, gaming platforms and major mail services.
• Multi-source threat intelligence - aggregated verdicts from several external reputation and malware-tracking providers.
• Safe-browsing database - social-engineering, malware and unwanted-software flags.
• Headless screenshot of the final page via our browser.
• Redirect trace - where the URL actually lands after 301/302.

NetSight Score

Every analysis boils down to a single number from 0 to 100. The NetSight Score is an aggregate of all signals we find: IP-logger matches, brand lookalikes, threat-intel hits, URL shorteners, punycode tricks, suspicious TLDs, redirect chains and more. Higher means riskier.

• 0-14 Safe - no signals beat the threshold. Green bar.
• 15-34 Caution - minor signals (shortener, suspicious TLD, unknown brand). Orange bar.
• 35-59 Suspicious - multiple signals or a single strong one (brand lookalike, 1-2 VT flags). Orange bar.
• 60-100 High risk - IP logger, a URL abuse or IOC listing, a browser safety flag, or multiple scanner verdicts. Red bar.

The breakdown of every contributing signal is shown under the score so you can see why.

IP loggers and how they work

IP-logger sites (IPLogger, Grabify, 2no.co, Blasze etc.) turn a short link into a tracker. When you click the link, the logger records your public IP address, approximate city, ISP, browser user agent and referrer, then forwards you to an innocent-looking destination. Common shorteners like bit.ly or tinyurl can be chained in front to hide the logger.

The typical pattern in scam DMs: "Look at this photo of you!" → https://iplogger.org/xxxxx → victim's IP ends up in an attacker's dashboard. Use this tool before you click.

NetSight maintains a curated blocklist and immediately flags matches with a red warning, even before the slower threat-intel scans complete.

When it's useful

• Checking a link from a suspicious DM, email or game chat without risking your IP or browser.
• Verifying a phishing landing page before reporting it.
• Confirming a URL shortener's actual destination.
• Investigating harassment links aimed at doxxing you or someone you know.

How it works

When you submit an address, two things start at the same time. A remote browser loads the page in an isolated environment, and the address is looked up against several reputation sources. Your own browser never contacts the target. It only receives the finished report, which is why a malicious page cannot run code on your device, read your cookies or see your IP address. The destination server sees a request from the analysis service instead.

Checks before the page is loaded

Some checks run directly in your browser the moment you press Preview and need no network call to the target. They look at the structure of the address itself:

• whether the host or any parent domain is on the list of known IP-logging services, a link shortener or a canary-token service
• whether the hostname contains a well-known brand name but does not belong to that brand's official domains (brand lookalike)
• punycode hostnames (xn--) that can imitate Latin letters, raw IP addresses instead of a hostname, a long chain of subdomains, a top-level domain that is frequently used for short-lived scam sites, and plain HTTP without encryption

Only http and https addresses are accepted. Other schemes are rejected, and some categories of sites are blocked by policy and not analysed at all.

What the isolated browser records

After the page has rendered, the report collects the final URL, the page title, the redirect chain, a screenshot, forms, scripts, iframes and cookies, the response security headers, and every network request the page made while loading. From this the tool derives further signals: a redirect to a different registrable domain, a password form that submits to another domain, external iframes, urgent account language next to a password field, obfuscated script code, code that reads many device characteristics for fingerprinting, requests to data-collection endpoints, hosting on temporary tunnel domains, a script that copies a shell command to the clipboard, and a notification permission prompt. The registration age of the domain is checked as well, and domains registered within the last 90 days add to the score.

The page may also be tested for scripts that look up the visitor's IP address through a lookup service or open a WebRTC connection to learn the real address behind a VPN. These are the same techniques an IP logger relies on.

Why the isolation protects you

Browser exploits, drive-by downloads, malicious scripts and tracking pixels act on the machine that renders the page. Here that machine is a disposable remote browser, so any damage stays there. You see an image and structured data, not active content.

How to read the results

• Lands on shows the final address after all redirects. If it differs from the link you were given, compare the two domains carefully, because the final domain is the one that actually serves the page.
• NetSight Score and signals add up the individual findings. A single strong signal can outweigh many small ones, so open the breakdown instead of looking only at the colour.
• Threat intelligence lists the result of each external lookup separately. A line marked as not supported or missing means that source gave no answer, not that it found the address clean.
• Page heuristics are pattern matches on the page code and the forms. They point to behaviour that deserves a closer look, but a legitimate site can occasionally trigger them.
• Page structure and Network show how many forms, scripts, iframes and cookies the page uses and which third-party domains it loads from. Many third-party hosts are common on ordinary news and shop sites, so the number alone is not a verdict.
• Security headers count how many of seven common protective response headers are present. Missing headers describe the site's hardening, not whether it is malicious. A phishing page can have all of them, and a harmless legacy site can have none.

What a clean result does not prove

• A new phishing or malware page is often not yet listed anywhere, so reputation sources may still report it as clean.
• The page is analysed as a single anonymous visit. Sites can show different content depending on the visitor's country, device, referrer or a time delay, and can serve a harmless page to automated browsers.
• Only the first page load is examined. Content that appears after a login, a click or a later redirect is not covered.
• Results may come from a recent earlier analysis of the same address, so a page that changed since then can look different.
• A missing screenshot means the page blocked the remote browser, not that the page is harmless.
• The score is a heuristic. It supports your judgement and does not replace it, and it is not a guarantee that a link is safe to open on your own device.

Examples

A link in an unexpected email

A message claims your account will be suspended and asks you to confirm your details through a link. Paste the link here instead of clicking it. If the result lands on a domain that has nothing to do with the sender, shows a brand lookalike signal, a young domain or a password form that submits to a different domain, treat the message as phishing and report it. If it lands on the provider's real domain, still prefer opening the provider's site yourself by typing its address.

A shortened link in a chat message

A shortener hides the destination. Run it through the tool and read the redirect chain and the Lands on line. A shortener alone raises the score only slightly. If the chain ends on a known IP logger, the report shows a red warning, and the correct reaction is simply not to open the link in your own browser.

A login page that looks right but feels wrong

The screenshot shows a familiar sign-in page, but the address is unfamiliar. Check the host in the report and the form action. If the page asks for a password while the form submits to another domain, that is a strong phishing indicator regardless of how convincing the design is.

Common problems and how to fix them

• No screenshot: many sites reject automated browsers. The reputation checks and the address analysis still complete, and the report states when the remote browser was unavailable.
• Address is rejected: enter a domain or a full http or https URL. Other schemes such as file or mail links are not web pages.
• Policy block: the site belongs to a category that is not analysed. Choose a different approach, such as asking the sender for context.
• Too many requests: analyses are rate-limited. Wait a moment and try again.
• The result looks outdated: a page may have changed since the last analysis of the same address. Check again later if you suspect a change.
• The page needs a login: the tool sees only what an anonymous visitor sees, so pages behind authentication cannot be assessed.

Questions

Related tools