Redirect checker and link expander
Follow a link through every redirect from our server, see where it really ends, and check each domain against Cloudflare’s malware and phishing blocklist. Your browser never opens the link.
By using these tools you accept the Terms and the Privacy page.
How the redirect trace works
The redirect trace shows where a link really goes before you click it. It’s for anyone checking a short link, an email link or an ad link, and for site owners who want to see their own redirect chains hop by hop.
What happens at each hop
Our server requests the link one hop at a time with automatic redirects turned off, so every status code, Location header and refresh is recorded. Before each request, the URL and every address its domain resolves to are checked, and internal or reserved addresses are refused. Cookies are kept and sent back the way a browser would, so cookie-check redirects resolve, and loops are detected from the address plus its cookies.
Each hop gets up to 8 seconds. The whole check, malware lookups included, has one 25-second limit: a trace that reaches it shows the chain up to there, marked as stopped, and a lookup that hasn’t answered shows as “couldn’t check”. HTML pages are read up to 512 KB to find the title, refresh tags, frames and scripts; they are read as text, never run. Each hop shows its status, timing, server, HTTPS or plain HTTP, content type, cookies set and IP addresses. Traces aren’t cached, so every check follows the link again.
Which domains the malware check covers
Every domain in the chain is looked up as soon as the trace reaches it, plus domains the trace saw but didn’t follow: a JavaScript redirect target, a framed page, a refresh meant for browsers without JavaScript, and an address carried in a parameter such as url= or next=. One trace checks up to 12 domains. Bare IP addresses are skipped, since there’s no name to look up.
A domain counts as flagged only when Cloudflare’s filtering resolver answers 0.0.0.0 and either adds its blocking marker or the normal resolver returns a real address. A domain whose own DNS points at 0.0.0.0, as some parked domains do, isn’t reported as malware.
Findings worth a second look
- A public URL shortener: anyone can create these links, so the short address says nothing about the destination.
- Email security wrappers and click trackers, with the original link when the wrapper carries it.
- Lookalike domains: a label that mixes alphabets, such as Latin with Cyrillic, or one made only of Cyrillic, Greek or Armenian letters that look Latin.
- A hop that drops from HTTPS to plain HTTP, or a destination served over plain HTTP.
- A bare IP address where a domain name would normally be.
- A file download. Programs, scripts, disk images and archives are marked as risky.
- A password field on the destination, raised to a warning when the link started on a different site.
- A page that automatically submits a form to another host, or shows another page inside a frame.
- Five or more redirects, typical of ad networks and click trackers.
Reading the verdict
The verdict is red when a domain is on the blocklist, the chain leads into an internal network, a domain doesn’t exist, or the link ends at an error page. It’s amber when the trace stopped early, a domain couldn’t be checked, a download looks risky, or a finding needs a look. Green means the chain reached a page, no domain is flagged and no finding needs a look.
If a bot check answered instead of the destination, the chain up to it is accurate, but later redirects can’t be seen. For a second opinion on the final domain, run the Google Safe Browsing check or the VirusTotal check, which use different lists.
Updated · Maintained by Liviu Tanase
Questions
Is it safe to trace a suspicious link here?
Yes. The requests are made by our server on Cloudflare’s network, not by your browser, so nothing on the link’s pages runs on your device. Pages are read as text, scripts are never executed, and downloads are stopped after the headers.
Which redirects does it follow?
HTTP redirects (301, 302, 303, 307 and 308), the Refresh header and <meta http-equiv="refresh"> tags, up to 10 hops. JavaScript redirects are read from the page’s code and shown with the line that does it, but never run, because running a suspicious page’s code is exactly what this tool protects you from.
What does the malware check mean?
Each domain is looked up on Cloudflare’s malware-blocking resolver (1.1.1.2), which answers 0.0.0.0 for domains it knows are malware or phishing. “Flagged” means it’s on that list. “Not flagged” is one signal, not proof of safety: new malicious domains appear every hour. “Couldn’t check” means the lookup failed, so treat that domain as unknown, not clean.
What are open redirects and tracking parameters?
An open redirect is a page on a trusted domain that forwards visitors to any address put in its URL (for example ?url= or ?next=); phishing links use them to start on a familiar domain. Tracking parameters such as utm_source, gclid and fbclid only tell the site where a click came from, so the trace offers a clean copy of the final address without them.
How do I see where a short link goes without clicking it?
Paste it here. The trace expands bit.ly, TinyURL, t.co and other short links, plus email security wrappers and click trackers, by following every redirect from our server, and shows the final address with a copy button. Your browser never opens the link. For a second opinion on where it ends, run the Safe Browsing check or the VirusTotal check.
Why does the trace end somewhere different from my browser?
Some links send different visitors to different places. The trace asks as a named checker in English from Cloudflare’s network, with only the cookies the chain itself sets, so a redirect that depends on your country, device, language or sign-in can go elsewhere. A bot check that answers instead of the page also ends the trace early. JavaScript redirects are listed but never run.
Why did the trace stop early?
It stops on a redirect loop, a redirect into a private or reserved network (a common attack on whoever opens the link), a domain that doesn’t exist, a server that doesn’t answer, a broken or over-long Location header, after 10 redirects, or at the 25-second limit. The result says which one, and at which hop.
Is anything stored?
Not by zerobounce.ai: traces are never cached or saved, and the site’s own logs don’t keep the link. Cloudflare’s request logs record the request, including the link, as the privacy page explains. Your browser keeps your last six links under the form until you press Clear.