XArrest
Slow down before the link.
A public check for redirects, certificate life, punycode, raw IP hosts, lookalike spellings, and a registration date when RDAP has one. Signals, not a verdict that someone committed a crime.
Signals
paypa1-secure.example
RedirectsFollow the chain
CertificateRead the dates
LookalikesCheck the spelling
Questions
Will you tell me a site is a scam?
No. The result is “looks ordinary,” “review these signals,” or “unavailable.” A signal is a reason to slow down, not a verdict.
Do you scan email and text messages?
Paste a link and the checker looks at that public address. It does not log into mailboxes.
Can this be used to attack a site?
No. Private addresses are blocked, bodies are capped, and the report returns signals rather than the page source.