Read the hostname first
A URL can contain a scheme, user information, host, port, path, query and fragment. The hostname identifies the destination name; words in a path or query do not identify the operator. In https://example.net/bank-login, bank-login is a path on example.net.
An @ symbol can introduce user information. In https://[email protected]/, the destination hostname is example.net, not trusted-name. Preserve the original string, then use a standards-aware parser rather than reading the link by eye alone.
Encoding and internationalized names
Percent encoding can conceal characters in paths and queries. Internationalized names may be represented using Punycode beginning xn--. Decode for interpretation while keeping the original text unchanged. Similar-looking Unicode characters are not necessarily identical.
Query strings can contain login tokens, identifiers or personal data. Do not send complete sensitive URLs to public analysis services without authorization. A fragment is normally handled by the browser rather than sent as part of the HTTP request.
Safe initial triage
Start with offline parsing and public DNS or registration lookups. Do not visit a suspicious destination in your everyday browser. A parser describes a URL; it does not certify that the destination is safe.
- Keep the original URL in its original message or artifact.
- Identify scheme, host, port, path and query separately.
- Check for user information, lookalikes and encoded characters.
- Remove sensitive data only from copies used for external submissions.