Online file & malware scanner
Review malware indicators in EXE files, Python scripts and ZIP archives, with explanations and inspection coverage.
THREAT INTELLIGENCE · BINARY FORENSICSRedirect Checker &
Redirect Checker &
Short Link Expander.
Find where a shortened link leads. Follow the declared redirect path and review each URL, response status and connection before opening it.
No file executionNo automatic file sharingEvidence with every finding
Start an inspection Checking detection-engine availability…
01 / INSPECT
Files · Links · Trace · ImagesWhat would you like to check?
Drop your file here
PE executables, scripts and ZIP archives · Up to 50 MiB
Selection starts an upload to this server. Unknown formats receive limited byte checks.
ZIP inspection has no file-count limit. Up to 32 MiB per entry and 64 MiB expanded in total; a 20-second inspection budget applies. Encrypted, oversized and nested entries are reported as uninspected.
Inspect image content
Check image metadata and appended data · PNG or JPEG
Up to 50 MiB and 8 megapixels. Selection starts an upload.
GPS metadata is a privacy finding, not a malware verdict. Pixel-level hidden messages and image exploits are outside this check.
No sample is executed. This scanner reviews submitted content and cannot replace antivirus protection on your device.
Inspection in progress
Uploading and waiting for the server…
Inspection report
INDICATOR INDEX · NOT A PROBABILITY
How the Indicator Index was calculated
What could not be fully inspected
See every step before you open the link.
This is the path observed by this server, not a guarantee of your browser's destination. JavaScript, cookies, location and the destination's rules can change the route. URLs are shown as text to prevent accidental navigation.
Capability assessment
Inspected file structure
Inspected contents and structure. A component is not necessarily malicious.
Why this result?
Technical details
Extracted network references — not confirmed C2 servers
Detection engines
Checks & scope
Reveal the observed path behind a shortened link.
Redirect Trace displays the ordered URL chain, HTTP status, verified HTTPS, response time and domain changes. Copy individual URLs or export the report without automatically opening the destination.
Which redirects are followed?
HTTP Location redirects, Refresh headers and declared HTML Meta Refresh are followed within a ten-redirect and twenty-second budget. Private network destinations are blocked.
Will my browser always reach the same destination?
No. JavaScript, cookies, location and destination rules may change the route. JavaScript is not executed. If a trace stops, the report distinguishes the last attempted URL from a destination it actually reached.
File scanning, link checking and redirect tracing.
Suspicious link & URL checker
Inspect public links for tracking-domain indicators, HTTPS issues and available page evidence.
Redirect checker & short link expander
See where a shortened link leads. Review the ordered URL path, connection details and stop reasons.
Know what the evidence means.
01 · Inspect
The scanner checks bounded file content with YARA, decoded strings and PE imports. ClamAV signature scanning is disabled. This is not device antivirus protection.
02 · Explain
YARA checks combinations linked to token collection, credential access, file uploads and remote commands. These are static indicators, not observed behavior.
03 · Report coverage
Show skipped entries, connection failures and unsupported formats. Incomplete checks never become a clean bill of health.
What happens to your data?
The web application buffers uploads in memory for bounded static checks. ClamAV is not enabled. No automatic sample submission, external hash lookup, Discord forwarding or visitor analytics is implemented.
URL inspection makes requests to the submitted destination and its redirects; those servers see the scanner’s connection. Reports stay in this page until you export them or close/reload it. No new scan history is saved in browser storage.
Hosting providers, reverse proxies and operating systems may have their own logs, buffering or swap. This application cannot guarantee secure memory erasure or control infrastructure retention.
Older versions may have saved a local scan history.