Safe Browser
Open suspicious URLs in a sandboxed headless browser. Screenshot, threat intelligence (Google Safe Browsing, VirusTotal, URLhaus, ThreatFox) and final-URL tracing without exposing your machine.
About the safe browser
Paste any URL and NetSight opens it in a sandboxed headless browser at our edge. You get a screenshot, the final URL after redirects, and a threat-intelligence roll-up from Google Safe Browsing, VirusTotal, URLhaus and ThreatFox. Your own machine never fetches the URL.
What we run
- IP-logger detection - matches the link and its redirect destination against a curated list of 150+ known IP-grabber services and their custom-domain aliases.
- URL-shortener detection - flags common shorteners that can mask any destination.
- Brand-lookalike detection - catches typosquats of high-value targets like payment providers, gaming platforms and major mail services.
- Multi-source threat intelligence - aggregated verdicts from several external reputation and malware-tracking providers.
- Safe-browsing database - social-engineering, malware and unwanted-software flags.
- Headless screenshot of the final page via our browser.
- Redirect trace - where the URL actually lands after 301/302.
NetSight Score
Every analysis boils down to a single number from 0 to 100. The NetSight Score is an aggregate of all signals we find: IP-logger matches, brand lookalikes, threat-intel hits, URL shorteners, punycode tricks, suspicious TLDs, redirect chains and more. Higher means riskier.
- 0-14 Safe - no signals beat the threshold. Green bar.
- 15-34 Caution - minor signals (shortener, suspicious TLD, unknown brand). Orange bar.
- 35-59 Suspicious - multiple signals or a single strong one (brand lookalike, 1-2 VT flags). Orange bar.
- 60-100 High risk - IP logger, URLhaus/ThreatFox listing, Google Safe Browsing flag, or multiple scanner verdicts. Red bar.
The breakdown of every contributing signal is shown under the score so you can see why.
IP loggers and how they work
IP-logger sites (IPLogger, Grabify, 2no.co, Blasze etc.) turn a short link into a tracker. When you click the link, the logger records your public IP address, approximate city, ISP, browser user agent and referrer, then forwards you to an innocent-looking destination. Common shorteners like bit.ly or tinyurl can be chained in front to hide the logger.
The typical pattern in scam DMs: "Look at this photo of you!" → https://iplogger.org/xxxxx → victim's IP ends up in an attacker's dashboard. Use this tool before you click.
NetSight maintains a curated blocklist and immediately flags matches with a red warning, even before the slower threat-intel scans complete.
When it's useful
- Checking a link from a suspicious DM, email or game chat without risking your IP or browser.
- Verifying a phishing landing page before reporting it.
- Confirming a URL shortener's actual destination.
- Investigating harassment links aimed at doxxing you or someone you know.