Join the waitlist
FREE TOOL

Link checker

Paste a URL and StormDoor follows it — up to 10 redirects — and reports every hop, the final destination, and whether that destination's domain was registered in the last 30 days, is unregistered, or is a typo of a well-known brand. It does not fetch or scan the page content and it has no malware signatures or blocklist, so clean here means "the link's structure and its destination domain show nothing wrong", not "this page is safe to open". For a signature-based verdict use a service that has one.

INPUT
try
200 OK727 ms (api)
SUSPECT
Destination domain "paypa1.com" looks like a typo of "paypal.com" (edit distance 1)
3 checks run
No redirects → http://paypa1.com/login
code
domain.typosquat
severity
medium
The full /v1/links gate also checks
Redirect chainURL shortener
Also available through the API.
Join the waitlist/v1/links docs

Live call to the same /v1 endpoint customers use. Rules only on this page; nothing you type is stored.

What it checks

  • link.redirect_chain — follows 301, 302, 303, 307 and 308 up to 10 hops, re-resolving each hop. It refuses to follow a hop into a non-HTTP scheme or a non-public host (a private range, loopback, link-local) and reports that instead of a partial chain. Returns data.chain.hops[] with URL and status per hop, data.chain.finalUrl, and data.chain.truncated.
  • link.destination_reputation — the final domain through the same RDAP and typosquat checks as /v1/domains. Returns data.destination.rdap.createdAt and ageDays.
  • link.shortener — whether the submitted URL is on one of 29 known shortener hosts. Emits nothing on its own; returns data.shortener.service.

What the result means

FindingSeverityFires when
link.unsafe_redirect_targethighA hop tried to redirect to a non-public host or a non-HTTP scheme; the walk stopped there.
link.hop_cap_exceededmediumNo final response within 10 hops.
link.shortener_chainmediumTwo or more distinct shortener services in one chain.
domain.not_registeredhighThe destination domain has no registry record.
domain.newly_registeredmediumThe destination domain is under 30 days old.
domain.typosquatmediumThe destination domain is one or two edits from a listed brand.

clean: the chain resolved within 10 hops with no refused hop, at most one shortener, and a destination domain that is registered, older than 30 days and not a brand typo.

Why it matters

A phishing link is usually a redirect chain ending on a domain that did not exist last month. Neither of those facts needs a signature to detect: the chain is visible by following it, and the registration date is on record at the registry. A shortener chained through a second shortener is the other tell — one service is convenience, two is concealment. Those are the three things this page shows, and they are the three things a blocklist finds out about last.

QUESTIONS

Links,
answered.

From your own code

curl -s -X POST https://api.stormdoor.dev/v1/links \
  -H "Authorization: Bearer sk_live_..." \
  -H "content-type: application/json" \
  -d '{"url":"http://paypa1.com/login"}'

The API needs an account — signups open with paid plans, a one-time trial included, no card. Join the waitlist and you will hear first.

Read more

/v1/links docs · link.unsafe_redirect_target · link.hop_cap_exceeded · link.shortener_chain · domain.not_registered · domain.newly_registered · domain.typosquat · /v1/domains docs (the checks run on the destination)
Sibling tools: redirect checker, domain age checker.